# A Study on Cyber Target Importance Quantification and Ranking Algorithm
## 5 Conclusions  
In this study, a method for assigning cyber target importance to calculate cyber target priorities was developed. To conduct the research, the importance of the target was defined by first examining domestic and foreign manuals. To calculate the importance score of the defined target, PageRank, an event prioritization framework, and host criticality evaluation cases were investigated. The TIR algorithm was designed by deriving target importance criteria based on the investigated cases and synthesizing the formulas and indicators of the research cases. To prove this, the STUXNET case was analyzed, experimental data were created, and an experiment was conducted. As a result, the S7-315 PLCs, which were physically and logically the closest to the objectives of the operation, were selected as the most important targets. \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Name**} & \multirow{2}{*}{**CVE**} & \multicolumn{8}{c}{**CVSS v2**} & \multicolumn{8}{c}{**Host Exposure**} & \multirow{2}{*}{\begin{tabular}{c} **Target** \\ **Exposure** \\ \end{tabular} } & \multirow{2}{*}{\
\begin{tabular}{c} **Target** \\ **Exposure** \\ \end{tabular} } & \multirow{2}{*}{
\begin{tabular}{c} **TIR** \\ **(Result)** \\ \end{tabular} } \\ \cline{3-13}  & & & **AV** & & **AC** & & **Au** & & **C** & **I** & **A** & **IC** & **MI** & **MV** & **ACA** & **ATT** & **nectivity** & **Criticality** & **Target** & **Exposure** & **TIR** \\ \hline \multirow{3}{*}{S7-315 PLCs} & CVE-2012-3015 & 0.395 & 0.61 & 0.45 & 0.7 & 0.7 & 0.66 & & & & & & & & & & & & & & \\  & CVE-2012-9272 & 0.395 & 0.61 & 0.45 & 0.7 & 0.7 & 0.66 & & & & & & & & & & & & & \\  & CVE-2016-9159 & 1 & 0.61 & 0.45 & 0.3 & 0 & 0 & 0.66 & & & & & & & & & & & & \\  & CVE-2016-9158 & 1 & 0.71 & 0.45 & 0 & 0 & 0.66 & & & & & & & & & & & & & \\  & CVE-2012-92015 & 0.395 & 0.61 & 0.45 & 0.7 & 0.7 & 0.66 & & & & & & & & & & & & & \\  & CVE-2016-9159 & 1 & 0.61 & 0.45 & 0.3 & 0 & 0 & 0 & 1 & 0.66 & 1.14 & 1.2 & 4 & 2 & 9 & 9.31 & 8.95 \\  & CVE-2016-9272 & 0.395 & 0.61 & 0.45 & 0.7 & 0.7 & 0.66 & & & & & & & & & & & & \\  & CVE-2010-2772 & 0.395 & 0.61 & 0.45 & 0.7 & 0.7 & 0.66 & & & & & & & & & & & \\  & CVE-2007-3039 & 1 & 0.71 & 0.56 & 0.7 & 0.7 & 0.66 & & & & & & & & & & & & \\  & CVE-2008-1556 & 1 & 0.35 & 0.45 & 0.7 & 0 & 0.28 & 1 & 0.66 & 1.14 & 1.29 & 4 & 3 & 8 & 9.47 & 8.45 \\ Server & CVE-2008-4250 & 1 & 0.71 & 0.45 & 0.7 & 0.7 & 0.66 & & & & & & & & & & & & \\  & CVE-2009-3676 & 1 & 0.61 & 0.45 & 0 & 0 & 0.66 & & & & & & & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 13: Part of TIR algorithm experiment result data. When designing cyber operations, the TIR algorithm can be used to determine which of the cyber targets located on the network are the most important. In addition, it could be a good reference for flexibly designing the operation by checking the connectivity, criticality, and exposure scores of the target, respectively. In the private sector, if the TIR algorithm is used when designing operations belonging to the red team during cyber defense training, the operation success rate can be further increased. Cybersecurity teams can use the TIR algorithm to identify the riskiest network nodes and establish security measures for them. Overall, our experiments with the TIR algorithm derive the importance of assets in cyberspace. This suggests that it is very useful in terms of cybersecurity. In future research, after collecting BGP-Archive-Data and processing it into geographic information, the network status map will be visualized on the battlefield map. From this visualized network information, we will collect information (PC, Server, IP, SNS ID/PW, E-Mail, etc.) on friendly network areas, hostile network areas and private network areas and identify target groups. Thereafter, there are plans to further develop procedures and techniques for cyberattacks, such as prioritizing each target within the identified target group and selecting a policy to attack the target. Conceptualization, K.K., S.O.