# Cyber Attack and Defense Emulation Agents
## 4 Red Team Agent
### Generating and Performing Attack Scenarios  
#### 4.5.1 Generating Attack Scenarios  
This section shows one example of how the red team agent generates scenarios for the attack. The attack scenario generation is according to Algorithm 2. In the scenario generation, two key points need to be reminded. The first point is that the state in this phase is not the actual state of the red team agent, but a copy of the actual one. Using the copied state, the red team agent would generate attack scenarios by selecting available attack techniques.The other point is the keyword 'UNKNOWN' on some post-conditions. As mentioned in Section 4.3, the keyword is used to replace the uncertain information without halting scenario generation process. Figures 2-7 depict one example of the scenario generation. Each figure consists of four factors: 'technique pool', 'pre-state', 'post-state', and 'technique sequence'. Technique pool is a collection of potentially available attack techniques that are not on the technique sequence yet. Pre-state is a state of the red team agent before one attack technique is selected from the technique pool. 'Pre-condition  
validation' should be performed to select attack techniques suitable for the pre-state. Contrary to the pre-state, the post-state is a state of the red team agent after one attack technique is selected. Assuming the technique succeeds, the pre-state is updated along with the post-conditions of the selected attack technique and it becomes the post-state. This process is called the 'post-condition reflection.' \"Technique sequence' is a sequence of attack techniques in the selected order. Every time the sequence gets new attack techniques, 'goal verification' is performed to verify whether the post-state achieves the goal of the red team agent. If the result of the verification says the goal is achieved, the technique sequence will be considered as a valid scenario and be stored. Otherwise, the scenario generation will keep updating the technique sequence until the goal is achieved. Figure 4: The example of the process of scenario generation: system investigation chosen. Figure 3: The example of the process of scenario generation: CVE-2016-3714 exploitation chosen. Figure 2: The example of the process of scenario generation: port scanning chosen. Figure 2 describes an initial status of the scenario generation. It contains nothing on the technique sequence. The pre-state stores the address and the protocol information of the target system which were 192.168.10.1 and IPv4, respectively. The red team agent searches for an available attack technique from the technique pool through the pre-condition validation. In the figure, it shows that the 'Nmap scanning' technique was selected because its pre-conditions are satisfied; the target address does exist (Address EXIST), the protocol being used was IPv4 (Protocol EQ IPv4), and the ports were not examined (Ports NOT EXIST). The red team agent selects the Nmap scanning technique and creates the post-state through the post-condition reflection. The next step is depicted in Figure 3. The technique sequence is no more empty and it contains one attack technique, Nmap scanning. The post-state created in Figure 2 is used as the pre-state in the current step. The scenario generator performs the pre-condition validation to find the next attack technique based on its pre-conditions. The figure shows 'CVE-2016-3714 exploitation' passes the validation. Successively, it performs the post-condition reflection to create the post-state. The similar process is repeated in Figures 4-6 to select attack techniques in sequence. At last, Figure 7 shows how the goal is achieved as a result of the goal verification. After the goal verification, the process continues if the post-state does not meet the goal of the red team agent. If the goal is achieved, the technique sequence will be exported as a valid attack scenario. red team agent. The keyword UNKNOWN is not used in this phase because all unknown information is revealed while the real attacks are performed.