## 4 Simulation and Performance Evaluation
### Advanced Persistent Threat Modeling under Proposed System  
The procedure of the large-scale APT attack is shown in Figure 5. First, an external attacker builds a command & control (C&C) server and infects an external web server. The terminal connecting to the infected external web server in the target network is used as BotNet. A BotNet refers to a group of computers which have been infected by malware and have come under the control of a malicious actor. Figure 4: Overview of decision-making logic. Figure 3: Conceptual diagram of the analysis system. BothNet infects the web server of the target internal network, administrator terminal by accessing the web server, antivirus server, and terminals by accessing the antivirus server, in that order. Finally, all internal systems in the target network are destroyed by infected anti-virus update files. This complicated procedure comprises four stages, as shown in S1-S4 in Figure 5. The stage of the attacker building a C&C server is defined as Stage 1, and the stage of penetration into the target network is defined as Stage 2. The process of infecting the target network is defined as Stage 3, and the process of finally destroying the target network is defined as Stage 4. Each stage is embodied through a unit attack utilizing the G&E model. Through the hierarchical multi-stage attack scenario modeling proposed herein, can be constructed systematically, as shown in Figure 6.  
Through the analysis system proposed herein, cyber risk simulation and combat experiment analysis can be performed over time in a large-scale military tactical network environment. The network  
Figure 5: Procedure of advanced persistent threat. Figure 6: Advanced persistent threat (APT) scenario using the proposed hierarchical multi-stage attack scenario modeling method. is constructed as shown in Figure 7. Additionally, the APT attack of Figure 6, which is represented by the hierarchical multi-stage cyber attack scenario proposed herein, can be performed to analyze the damage of the internal network in advance. An information exchange requirement (IER) is the description of the requirement to transfer information between hosts for military operations. To perform missions for military operations, we assume the scenario where there is a critical IER between hosts 14 and 34 and information with the size of 1500 bytes should arrive at the other host within 1 s every 5 s.  
In an APT attack scenario, Host 14 is infected with BotNet and eventually the system is destroyed in 2000 s, as shown in Figure 8a. This causes loss of IER message to be transmitted from Host 14 to Host 34. As shown in Figure 8b, The IER success ratio is reduced to 0% and the IER traffic is reduced to 0 bits/sec. These results have a fatal effect on military operations. To proactively prepare for the possible damages from these cyber attacks, various alternatives can be prepared in advance. Alternatively, preparations for threats can be implemented by setting up course of actions such as installing additional security devices in major sections, changing firewall policies, and performing OS updates. The ability to organize large assets that the military must protect and analyze the effect of cyber attacks is critical. Figure 9 shows part of a large-scale network, which consists of thousands of assets and hundreds of subnets. To construct such a large-scale network in a real environment, significant cost and resources are required, and it is difficult to construct in reality. The attack graph approach has been widely used in the literature and industry for a long time. However, in large-scale network, as shown in Figure 9, the calculation is very complicated and there is a problem of scalability, so it is not easy to utilize well. However, the proposed analysis system and cyber attack scenario modeling make it possible. Especially, the proposed approach enables the organization of complex scenarios systematically and facilitates the intuitive understanding cyber attack progress.