## 5 Conclusions  
In this paper, we proposed a hierarchical multi-stage attack scenario modeling method based on the G&E model, which is not limited to specific types of attacks, but can represent various goals of attacks and their damage effects. The proposed method enables the organization of complex scenarios systematically and facilitates the intuitive understanding cyber attack progress. Furthermore, it provides scalability to large-scale network environments and can be used to analyze the effect of cyber attacks on large assets that must be protected by the military. Additionally, we proposed a combat experiment analysis system that enabled cyber risk simulation over time in a large-scale network environment. Combat experiments for various cyber attacks could be conducted to analyze potential threats and damages in advance and secure the course of action. We evaluated the performance of the proposed modeling method and analysis system via simulation runs. Results showed that the proposed method can be used to proactively analyze vulnerabilities. Preparation for countermeasures is possible in advance when a cyber attack occurs against a military tactical network. In addition, to evaluate the applicability of the proposed modeling method and analysis system to real world, we implemented a small real-world network. A real SYN flooding attack occurred, and the performance of the proposed method was analyzed. Results showed that the attack deployment pattern, number of infected hosts, and amount of transmitted DoS traffic of the proposed analysis system were almost the same as those of the small real-world network. Proposed modeling method and analysis system are expected to be used for strengthening the military's ability to prepare for cyber attacks. In the future, we will continue our research by expanding the battle experimental analysis area to analyze its effect on military operations or combat missions. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **Proposed Analysis System** & **Real-World Network** \\ \hline Number of BotNets & 9 & 9 \\ Number of infected hosts & 11 & 11 \\ Dos Traffic from a BotNet to a target server (bits/s) & 1000 & 1010 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Performance evaluation results. Figure 14: DoS traffic sent from Host to Target Sever: (**a**) DoS Traffic sent in real-world network of Figure 11. (**b**) DoS Traffic sent in the proposed analysis system of Figure 12.  
**Author Contributions**: Writing--original draft, M.K.A. ; Writing--review & editing, Y.H.K. and J.-R.L. All authors have read and agreed to the published version of the manuscript. **Funding:** This work was supported by the Chung-Ang University research grant and Agency for Defense Development. **Conflicts of Interest**: The authors declare no conflict of interest. **Acronyms**: The following acronyms are used in this manuscript: G&E (Goal & Effect): the attacker's goal to the victim and the target's damage effect from the attack. APT (Advanced Persistent Threat): a covert cyber attack on a computer network where the attacker gains and maintains unauthorized access to the targeted network and remains undetected for a significant period [21]. TTP (Tactics, Techniques, and Procedures): the behavior of an attacker. Tactics are high-level descriptions of behavior, techniques are detailed descriptions of behavior in the context of a tactic, and procedures are even lower-level, highly detailed descriptions in the context of a technique [22]. CAPEC (Common Attack Pattern Enumeration and Classification): a comprehensive dictionary of known patterns of attack employed by adversaries to exploit known weaknesses in cyber-enabled capabilities. CVE (Common vulnerabilities and exposures): a list of entries--each containing an identification number, a description, and at least one public reference--for publicly known cybersecurity vulnerabilities.