{'fraction_non_alphanumeric': 0.0219435736677116, 'fraction_numerical': 0.0, 'mean_word_length': 5.695804195804196, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Targeting technology: Mapping military offensive network operations

State-sponsored network intrusions are publicly and frequently exposed but assessing how militaries conduct offensive network operations remains difficult. Data can be transmitted near-instantaneously, yet cyber-attacks can take months or even years to mature, complicating attempts to integrate them into joint operations. What challenges, risks, opportunities and advantages are associated with attacking networks? This paper argues that military offensive network operations can be usefully cast into a two-part taxonomy: event-based attacks and presence-based attacks. These are then applied to practical use-cases drawn from existing strategies, case studies and current military platforms. Event-based operations include all instances in which the target is directly and in real time attacked by compromise of its software and may appear roughly analogous to physical weapons. Presence-based operations include all network intrusions in which the attackers traverse compromised networks until targets are located, assessed, and weaponized for later activation, more analogous to a clandestine sabotage operation. Distinguishing between these two types is crucial; they offer different solutions, encompass varying risks, and may require different resources to accomplish. Event-based attacks can offer a tactical advantage against a single adversary platform or network. A successful presence-based operation may result in a strategic advantage against a stronger force. Each of the two operation types is broken into phases as defined by the US Department of Defense Common Cyber Threat Framework. The model envisions four steps in the network operation life- cycle: preparation, engagement, presence and effect. By anchoring the assessment using the framework, the unique characteristics of both operation types become easier to analyze.