Detail View

In cyber warfare, enemies attempt to destroy, steal, and falsify the critical information that an organization or system uses for accomplishing its mission. The cyberattack, as a weapon to achieve these objectives, damages the targeted defense mission system. To decide if we operate this damaged defense mission system, we must know how much it is damaged, and thus, we need a trustable damage assessment. Many researches proposed assessment methods for the damage caused by cyberattacks, but they were not strong enough to be utilized in the defense domain for cyber warfare. Their purpose was mainly to detect a cyberattack, not to evaluate its damage, and the assessment results had low accuracy to correctly determine the actual situation. They also needed a long assessment time and had limitations for a swift response to cyber incidents. They were still far from the requirements in the defense domain for cyber warfare. To resolve these problems, accurate and fast damage assessments of cyberattacks are required from the comprehensive perspective. We enlarged the scope of the target to an entire defense mission system, defined measures to precisely evaluate the damage of cyberattacks, and develop a comprehensive method to rapidly assess the damage to the entire system at the mission level. Experiments are performed to demonstrate that our method has superior performance and that it can be successfully applied to actual defense applications. This research proposes a comprehensive assessment of the mission-level damage caused by cyberattacks on an entire defense mission system and contributes to the enhancement of damage assessment of cyberattacks with a faster and more accurate method.

ABSTRACT  ................................ i
1. Introduction  ................................ 1
1.1 Research Motivation  ................................ 1
1.2 Research Purpose  ................................ 3
1.3 Research Taxonomy  ................................ 3
1.4 Organization of the Dissertation  ................................ 5
2. Related Works  ................................ 6
2.1 Intrusion Detection Phase  ................................ 6
2.2 Risk, Threat, or Vulnerability Evaluation Phase  ................................ 7
2.3 Impact Assessment Phase  ................................ 9
2.4 Impact Assessment on Mission Phase  ................................ 10
3. Comprehensive Damage Assessment  ................................ 12
3.1 Basic Concept  ................................ 12
3.2 Layers and Components  ................................ 13
3.3 Measures  ................................ 15
3.4 Damage Assessment Process  ................................ 18
3.4.1 Asset Layer Process ................................ 18
3.4.2 Mission Layer Process  ................................ 20
3.4.3 Overall Process  ................................ 21
4. Experiment and Evaluation  ................................ 24
4.1 Experiment  ................................ 24
4.1.1 Experimental Design  ................................ 25
4.1.2 Experimental Data  ................................ 27
4.1.3 Mission Capability Before Cyberattack  ................................ 31
4.2 Experimental Result  ................................ 34
4.2.1 Mission Capability After Cyberattack  ................................ 34
4.2.2 Damage Assessment Results  ................................ 44
4.3 Comparitive Evaluation ................................ 46
4.3.1 Comparitive Experiment Design  ................................ 46
4.3.2 Comparison Objects ................................ 48
4.3.3 Quantitative Comparison  ................................ 50
4.3.4 Qualitative Comparison  ................................ 55
4.4 Discussion  ................................ 57
4.4.1 Pros and Cons of CDAC Method ................................ 57
4.4.2 Requirements for Result Review ................................ 61
5. Conclustion and Future Works ................................ 64
5.1 Conclusion ................................ 64
5.2 Future Works ................................ 66
Bibliography  ................................ 68
Abstaract (Korean) ................................ 72