currently, I prepare for an exam about cryptanalysis. In class, we talked about linear cryptanalysis for FEAL-4. We constructed four linear equations, extended them to equations for three rounds and then applied a Brut Force search in order to find the keys of every round.

My question is as follows: **How can I prevent such an attack?**

My idea: I think, it is necessary to replace the S-Boxes of FEAL with 'better' S-Boxes? Such that, it is not possible to find relationships between input and output bits of the S-boxes (and therefore, also for the whole F-Function). But how does such an 'good' S-Box look like?