## 3 Multi-Cyber Range Structure for Training, Testing, and Evaluation
### Multiple Cyber Range Scenario Authoring and Traffic Flow Control
#### 3.2.2 Normal Traffic Generation  
Normal traffic generation and reproduction is a very important factor in the reproduction of the actual environment, and at the same time as the establishment of a practical training and test evaluation environment. In a related study [17], network traffic was generated in three ways: probabilistic generation, replication of actual network traffic, and the use of instruction lists for applications in the test network. [PERSON], [PERSON] et al. proposed a new approach to generating datasets for cyber threat research on multi-node systems [18]. This has been made useful in fields where information concealment technology is applied. Traffic in military systems is likely to generate traffic with regular statistics depending on wartime/peacetime situations. Therefore, the method of replicating and generating actual network traffic according to the situation is considered the most efficient. The traffic used by a cyber range requires the process of building a dataset, as shown in Figure 8 [19].  
In order to develop a plan for traffic generation, a traffic generating node must first be set up in the network topology. The traffic generating node should be specified on the basis of what actually occurs at the server node, but, according to the scenario, a special node can be set up to generate the collected traffic, and the traffic generated by the terminal node may be generated by mixing the use of the terminal traffic template by designation. The terminal traffic template selects the terminal traffic template to be used in the basic dataset DB, and grasps the traffic distribution terminal through the traffic distribution terminal information in the header. In addition, the traffic distribution process can be reproduced through the number of messages and traffic type information.  
In the battlefield management system, direct traffic between the terminals is limited, so assuming the traffic between the terminal and the server, it is possible to reproduce simple traffic. Normal traffic is managed in a Packet Capture (PCAP) file and used as basic data by managing the data set collected during peacetime/training, and the server included in the configuration of the network map is essentially designated as traffic generation equipment and operated. Traffic generated at the other terminal should be separately specified to generate traffic. In addition, since the characteristics of training and test evaluation are set at the time to be reproduced, and not the current time, traffic generation should also be designed so that a multiplier generation or hold function can be given a timer function.  
In order to establish a practical environment, traffic flow reflecting the characteristics of the military battlefield management system needs to be efficient to perform with the concept of replay based on the information collected. Attack traffic generation is often replayed by building existing case data into a basic data set, but it is difficult to judge it as actual traffic due to differences in training and testing environments. Therefore, if possible, traffic is naturally generated by attack agents or Red Team actions that are applied to training and testing, so a separate attack traffic generation is not necessary for real-world environment configuration.  
Traffic generating nodes according to the scenario are specified as shown in Figure 9 to configure a normal training environment. TA1 and TA2 nodes can be considered as acting  
Figure 8: Collect real operation traffic.  
as interoperating servers that make up each system, and the TS1 node can be assumed to be a node that generates information as they move. However, when configured in a scenario that requires a separate small amount of traffic generation for training purposes, traffic generation agents such as mail behavior and Internet usage behavior are utilized without using large basic traffic.