# Cyber Attack and Defense Emulation Agents
## 4 Red Team Agent
### Attack Technique  
The red team agent uses attack techniques to conduct automated attacks. For automated attacks, the red team agent should decide what attack technique is available on the current state and it also should predict the result of using the selected technique.  
Table 2 shows that each technique has four fields: 'technique ID', 'pre-conditions', 'post-conditions', and 'commands'. The concept of pre-conditions and post-conditions was inspired by STRIPS [15] and MITRE Caldera [10].  
* Technique ID is the identifier of attack techniques.
* Pre-conditions are requirements of an attack technique. Each pre-condition consists of one or two operands and an operator. A field of the red team agent's state can be an operand, and there are four operators: EQUAL, EXIST, NON-EXIST, and INCLUDE. As an example of a pre-condition, 'Address EQUAL \"192.168.10.1\" means 'the red team agent's state says Address is equal to \"192.168.10.1\".
* Post-conditions represent the conditions which are satisfied after an attack technique is successfully used. Combined with the pre-conditions and the post-conditions, attack techniques can be linked with each other. The red team agent searches the technique DB to find the next coming attack technique, checking if the pre-condition of the attack technique is completely fulfilled by the post-condition of the current state. We introduce 'UNKNOWN,' a keyword used in post-conditions, to represents an undetermined value. Some post-conditions can include the keyword; The keyword is necessary to deal with uncertain information during scenario generation. For example, we assume that the installed OS in the target system is either Windows or Linux. In this case, the scenario generator cannot process further until the OS information is exactly classified. Therefore, to continue the attack scenario generation, the UNKNOWN keyword should fill in uncertain elements of post-conditions. If a selected technique has a post-condition, 'OS is UNKNOWN,' then the following technique contains the pre-condition saying 'OS is Windows' or 'OS is Linux.' When the red team agent performs attack scenarios, if it can take certain information, then the UNKNOWN value of the post-condition can be replaced with the acquired information.  
Admittedly, some attack scenarios can be discarded during the scenario performance process. As mentioned above, attack techniques having 'OS is Windows' or 'OS is Linux' as their pre-conditions satisfy the 'OS is UNKNOWN' condition. If the determined OS information is 'OS is Linux', then the scenarios with attack techniques only available on Windows should be discarded. Instead, other attack scenarios with techniques available on Linux are adopted.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Field** & **Description** \\ \hline Address & Address of the target node \\ Protocol & Protocol to access the target node \\ OS & Operating System installed in the target node \\ Ports & Ports to access the target node \\ Shell & State of the shell to access the target node (TEMPORAL or DOWNLOADED or PERMANENT) \\ Privilege & Privilege over the target node \\ Binaries & Available binaries installed in the target node \\ CWD & Current working directory of the shell which have accessed to the target node \\ Misudo & Array of exploitable sudo configurations \\ \hline \hline \end{tabular}
\end{table}
Table 1: Model of red team agent’s state.  
* 'Commands' is a list of file paths that contain commands for the attack techniques. The red team agent inputs the commands sequentially to operate the attack techniques in order.