# Cyber Attack and Defense Emulation Agents
## 2 Related Works  
There are several tools for the automated adversary emulation: CALDERA [4], CASCADE [5], Uber Metta [6], Atomic Red Team [7], and APTSimulator [8]. The CALDERA is developed by MITRE corporation and it automatically attacks target systems using tactics and techniques described in the ATT&CK framework [9]. [PERSON] et al. [10] introduced the design and implementation of CALDERA. [PERSON] et al. [11] described how to handle the planning problem of adversary emulation by CALDERA, when CALDERA needs to handle uncertainties of the target systems. The CASCADE automatically analyzes suspicious behaviors and determines their maliciousness with the ATT&CK framework. It mainly focuses on the analysis of the detected threats and not on threat mitigation.  
The Metta is a tool for adversary emulation using Redis/Celery, Python and Vagrant. The Metta uses the concept of 'Action', which is a sequence of commands. Metta can execute the defined action when it performs the adversary emulation. Metta supports creating a batch of actions to make scenarios for adversary emulation. Metta's such functionalities support to create a test scenario and actions without difficulty. It is very helpful to security administrators but its scenario creation process is not automated.  
The Atomic Red Team is an execution framework using PowerShell, Python and Ruby. 'Atomic test' is a unit of the Atomic Red Team and it represents the sequence of commands for a behavior. Each atomic test can run on multiple operating systems including Linux, Windows, and macOS. Although the Atomic Red Team has many merits to test various systems, it does not have the concept of a scenario. It cannot execute a series of atomic tests automatically. Thus, users need to write a batch job with scripting language manually when they want to create a test scenario.  
The APTSimulator is another adversary emulation tool that can run through a Windows batch file.The APTSimulator uses the concept of 'test-set', a sequence of Windows commands. APTSimulator launches the 'test-set' to carry out the adversary emulation. As well as the Atomic Red Team, it does not support the automated scenario test (i.e., series of test-sets).  
In addition to the several tools described above, there are also related studies on the cyber-attack simulation and modeling. In [PERSON] et al.'s work [12], the authors focused on the simulation environment for building the simulation scenario. In this study, characterizations of the system and actor were addressed. One consideration is that the attacker and defender's behavior modeling was not covered in depth.  
In the work of [PERSON] et al. [13], the cyber-attack modeling was built for the network security analysis covering the both external and internal network. The study categorized all available cyber-attacks into 10 stages and used them with graph-based approach. It assumed the attacker had full information about the target's environment, thus the optimal decision for the cyber-attack could be gained.  
In the work of [PERSON] et al. [14], the authors designed the emulation testbed. Their testbed established the attacker's modeling on the Windows enterprise network environment. Multiple experiments were conducted on the adversary emulation and the results were compared. The experiments used various strategies for automated attacks, such as random selection, perfect knowledge, and so on.