Military Communications and Information Technology: A Trusted ...

420 Military Communications and Information Technology...
• permanence and periodicity (every daily mission, which is realized usually
during one combat day (24 hours) is focused on new experiences, every
completed cycle of processing creates a foundation for next iterations);
• incremental construction (every cycle generates added value in the form
of extended/qualitative and quantitative changes in repository of experiences
gained) and exploiting new experiences (experiences gained can be
used as a request for change of warfare regulations, add new content to
training program/syllabuses and eventually justify changes in doctrines).
A. Classification of factual data
Classification of factual data and especially of the extracted incidents in cyber
defence domain is necessary to perform a statistical analysis of the data. Rules/
guidelines/methods for classifying factual data (especially incidents) in cyber defence
domain are presented in this subsection. Proper taxonomy should be created
considering rules below e.g.:
• Ockham's razor – reduce additional duplicable entities;
• divisibility of categories – entity classified to one category cannot be classified
elsewhere;
• completeness – all categories comprise entire set of possible categories;
• unequivocal – classification criteria should be precise enough so that
the result of classification is always the same, no matter who is responsible
for performing it;
• repeatability – classification process is repeatable, no matter how many
times it will be repeated;
• acceptability – target taxonomy is commonly accepted;
• usability – has high informative value.
Statistical analysis of particular incidents occurrence is helpful in determination
of appropriate defense system against cyber attacks. Factual data collected
should be starting point for identification of e.g.:
• the weakest elements in military network topology,
• vulnerabilities of these networks on cyber attacks,
• trends,
• cycles,
• regularities,
• deviations,
• anomalies.
B. Aims of collecting factual data in cyberspace
Cyber terrorist attack can manifest itself in the intrusion on target’s software
or information technology systems and hardware. There is plenty of methods to