## 4 Cyber Warfare Experiment with Range Connection
IER delay limit: The delay limit that IER should be received by in order to not to affect a military operation. It is a concept similar to service level agreement (SLA). 2. IER size and inter-arrival time: These factors are used to define traffic characteristics of IER. Average traffic volume of IER can be calculated by IER size/IER interval. 3. DDoS Attack Information: These parameters describe the characteristics of a DDoS attack by an attacker; # of DDoS participating terminals means the number of terminals that generate the DDoS attack traffic. DDoS attack maintains during the attack duration after the attack start time. Attack interval and DDoS traffic size mean the attack traffic generation interval and the traffic size per a DDoS attack, respectively. Thus, we can calculate the traffic volume of the DDoS attack by DDoS traffic size/attack inter-arrival time. 4. End-to-end IER transmission delay: Automation support for accurate repetitive testing of the time it takes from the generation of an IER on the Corps C4I server until the Joint Chiefs of Staff interlocking server receives the IER. 5. IER received ratio: The percentage of IERs sent that are successfully received. 6. IER success ratio: The percentage of IERs received that arrive within the IER delay limit (the percentage of IERs that satisfy timeliness). 7. IER failure ratio: The ratio of received IERs to those who arrive after three times the IER latency limit time. 8. IER perished ratio: The percentage of IERs received that exceed the IER delay limit time but arrive within three times the IER delay limit time. Figure 14 shows the number of cyberattack infected terminals over time. Terminals participating in DDoS attacks are variable depending on the time of the vaccine patch. The patch time is variable depending on the scenario, but the attack start time dramatically increases, and the infection occurs even during the course of a DDoS attack. Figure 15 shows the end-to-end IER transmission delay according to the simulation time by scenario. The figure shows that the delay in end-to-end IER transmission increases during the time of the DDoS attack. In particular, scenarios 1 and 2 show that DDoS traffic exceeds the link load (the link on the legion server is 10 Mbps, creating a bottleneck for experimentation), resulting in a dramatic increase in transmission delays. Not only can DDoS attack traffic be affected by end-to-end transmission delays even when the traffic is  
Figure 14: Number of devices participating in a cyberattack according to simulation time. less than the link load, but it takes a certain amount of time to process the IERs that have been queued up even after the end of the attack. Figure 16 is an illustration of the transmission characteristics of the IER according to the scenario: (a) is the reception rate of the IER, (b) is the success rate of the IER transmission, (c) is the IER transmission failure rate, and (d) is the IER delay reception rate. (a) shows that in all scenarios, except scenario 8, the IER reception rate decreases during the DDoS attack and then increases again when the DDoS attack ends. However, (b), (c), and (d) show that the IER did not satisfy the timeliness required and exceeded it by 20%, even in situations where the DDoS attack was low relative to the link load (scenarios 7 and 8). Therefore, a cyberattack by an internal attacker can have a serious impact on the battlefield management system. Figure 15: End-to-end IER transmission delay according to the DDoS attack volume. The scenario applied in this paper is presented as a way to simulate or analyze the impact of a cyberattack on military operations in the event of a cyberattack on a military network.