An initial foray into understanding adversary planning and courses of action

The term information warfare encourages a mapping between traditional or `kinetic´ warfare and the use of information technology. To prevail in modern warfare, you need a high degree of knowledge of implicit and explicit behaviors exhibited by defenders and attackers. These behaviors revolve around logistics tactics, strategy, planning, and intelligence gathering and preparation. Little work has been done to examine these behaviors and activities in the domain of information warfare. The activity of planning and executing an attack, with fallback positions and alternatives is called attacker course of action. This paper describes an experiment that was designed to look explicitly for the broad characteristics of a sophisticated adversary during the planning and execution phases of an attack