Quantitative Analysis Method for the Four Core Capabilities of Cyber ​​Resilience

Abstract

The present invention relates to the field of network resilience assessment technology, and specifically to a quantitative analysis method for the four core capabilities of network resilience, including: building a system to be analyzed, constructing a threat model and attacking the system to be analyzed, and then collecting the performance values ​​exhibited by each key function at each moment within a preset time period; summarizing the performance values ​​exhibited by a key function at each moment, and drawing a function change scatter plot, wherein the horizontal axis of the function change scatter plot is time and the vertical axis is the performance value exhibited by a key function; performing image analysis on the function change scatter plot to determine the resistance, recovery, perception and adaptability of the system to be analyzed. The present invention not only has the advantages of being objective, accurate and comparable, but can also analyze the network resilience capabilities exhibited by system functions in four stages when they are attacked, so as to facilitate a more in-depth analysis of the resilience capabilities of the system.

Description

Technical Field

[0001] The present invention relates to the technical field of network resilience assessment, and in particular to a quantitative analysis method for four core capabilities of network resilience. Background Art

[0002] Existing network resilience testing methods are primarily categorized into two main categories: qualitative analysis and quantitative analysis. Qualitative analysis involves subjective expert evaluation based on relevant evaluation indicators. This method is relatively easy to implement and requires minimal measurement tools. However, it is highly subjective, meaning the accuracy of test results may be affected by subjective factors and lack comparability. However, the same system may have different evaluation indicators in different environments or over different time periods, necessitating comparative analysis. Compared to qualitative analysis, quantitative analysis focuses on quantifying data through numerical and statistical analysis methods to facilitate measurement and comparison. It is also highly objective, with test results determined entirely by the data displayed by the system and eliminating the need for subjective expert evaluation.

[0003] However, current quantitative analysis methods only yield a final value for network resilience, failing to capture the system's core capabilities across four phases: perception, defense, recovery, and adaptation. This lack of assessment of network resilience at each phase can lead to misunderstandings of the network's overall resilience, limiting its ability to respond to dynamic changes and potentially contributing to deficiencies in resource allocation, policy development, and risk management. Therefore, to fully understand and improve network resilience, conducting a phased quantitative assessment is essential. Summary of the Invention

[0004] To address the aforementioned technical problem of the lack of existing assessments of network resilience at different stages, the present invention aims to provide a quantitative analysis method for the four core capabilities of network resilience. The technical solutions employed are as follows:

[0005] An embodiment of the present invention provides a quantitative analysis method for four core capabilities of network resilience, comprising the following steps:

[0006] Build a system to be analyzed, construct a threat model and attack the system to be analyzed, and then collect the performance values ​​of each key function at each moment in a preset time period;

[0007] Summarize the performance values ​​of a key function at each moment and draw a function change scatter plot corresponding to the key function, where the horizontal axis of the function change scatter plot is time and the vertical axis is the performance value of the key function;

[0008] Performing image analysis on the function change scatter plot to determine the resistance, recovery, perception, and adaptability corresponding to the key function of the system to be analyzed;

[0009] A comprehensive analysis is conducted on the resistance, recovery, perception and adaptability corresponding to each key function of the system to be analyzed to obtain the resistance, recovery, perception and adaptability of the system to be analyzed.

[0010] Furthermore, the image analysis of the function change scatter plot is performed to determine the resistance, recovery, perception, and adaptability corresponding to the key function of the system to be analyzed, including:

[0011] Determine the resistance and recovery capabilities corresponding to the key function of the system to be analyzed based on the performance value changes of the data points in the function change scatter plot;

[0012] Analyze the degree to which the system to be analyzed can detect attacks in advance based on the function change scatter plot, and determine the perception capability corresponding to the key function of the system to be analyzed;

[0013] The recovery status of the key function of the system to be analyzed is analyzed according to the function change scatter diagram, and the adaptability corresponding to the key function of the system to be analyzed is determined.

[0014] Furthermore, determining the resistance and recovery capabilities corresponding to the key function of the system to be analyzed based on the performance value changes of the data points in the function change scatter plot includes:

[0015] Constructing an expression for resilience based on the performance value trend and the performance value decline rate in the functional change scatter plot;

[0016] Constructing an expression for recovery capability based on the performance value trend and performance value recovery rate in the function change scatter plot;

[0017] Based on the function change scatter plot and in combination with the expression of the resistance capability and the expression of the recovery capability, the resistance capability and the recovery capability corresponding to the key function of the system to be analyzed are determined.

[0018] Furthermore, the expression of the resistance is: F(t)=e -(1-W)t+C1 +m; where F(t) represents the performance value of the data point at time t, t represents the time of the data point, e represents the natural constant, W represents the resistance, C1 represents the first constant, and m represents the minimum performance value in the functional change scatter plot;

[0019] The expression of the recovery ability is: F(t)=-e -Rt+C2 +n; where R represents recovery capability, C2 represents the second constant, and n represents the stability energy value in the function change scatter plot, which is used to represent the stability level of the key function of the system to be analyzed after recovery.

[0020] Furthermore, the determining of the resistance capability and the recovery capability corresponding to the key function of the system to be analyzed based on the function change scatter plot and in combination with the resistance capability expression and the recovery capability expression includes:

[0021] The least squares method is used to jointly optimize the curve corresponding to the expression of the resistance capability and the curve corresponding to the expression of the recovery capability, so as to determine the resistance capability and recovery capability corresponding to the key function of the system to be analyzed; wherein the data used for the joint optimization is the performance value of the key function of the system to be analyzed at each moment in the function change scatter plot.

[0022] Furthermore, analyzing the degree of the system to be analyzed in detecting attacks in advance based on the function change scatter plot and determining the perception capability corresponding to the key function of the system to be analyzed includes:

[0023] In the function change scatter plot, determine the time point when the attack is discovered and the target time point when the performance value drops. The difference between the target time point when the performance value drops significantly and the time point when the attack is discovered in advance is used as the advance prediction time. The target time point is the time corresponding to the first time when the performance value drops by a greater magnitude than the normal performance value.

[0024] Determine the time point when the attack starts, and take the difference between the target time point when the performance value obviously drops and the time point when the attack starts as the attack hiding time;

[0025] The ratio of the advance prediction time to the attack hiding time is used as the perception capability corresponding to the key function of the system to be analyzed.

[0026] Furthermore, analyzing the recovery status of the key function of the system to be analyzed based on the function change scatter plot to determine the adaptability corresponding to the key function of the system to be analyzed includes:

[0027] Based on the function change scatter plot, the stable performance value after the function level is restored is determined, the baseline level value corresponding to the key function of the system to be analyzed is obtained, and the difference between the stable performance value and the baseline level value is used as the adaptability of the key function of the system to be analyzed.

[0028] The present invention has the following beneficial effects:

[0029] To overcome the inability of current quantitative analysis methods to reflect the core capabilities of a system across four phases and to fully understand and improve network resilience, this paper proposes a quantitative analysis method for the four core capabilities of network resilience. This method determines the system's resilience, recovery, perception, and adaptability by plotting a scatter plot of functional changes and performing image analysis on the plot. This method is not only objective, accurate, and comparable, but can also analyze the system's network resilience at four phases when under attack, facilitating a more in-depth analysis of the system's resilience. It also helps improve the system's responsiveness to dynamic changes, thereby facilitating resource allocation, policy formulation, and risk management. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0031] Figure 1 This is an example diagram of a function curve diagram in a quantitative analysis method of four core capabilities of network resilience according to an embodiment of the present invention;

[0032] Figure 2 This is a flowchart of a quantitative analysis method for four core capabilities of network resilience according to an embodiment of the present invention;

[0033] Figure 3 This is an example diagram of a function change ladder diagram in a quantitative analysis method for four core capabilities of network resilience according to an embodiment of the present invention;

[0034] Figure 4 This is a flowchart for implementing step S3 in a quantitative analysis method for four core capabilities of network resilience according to an embodiment of the present invention;

[0035] Figure 5 This figure illustrates an example of a fitting curve during a joint optimization process in a quantitative analysis method for four core capabilities of network resilience according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] To further illustrate the technical means and effects employed by the present invention to achieve its intended objectives, the following, in conjunction with the accompanying drawings and preferred embodiments, describes in detail the specific implementations, structures, features, and effects of the technical solutions proposed by the present invention. In the following description, references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0037] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0038] The commonly used and representative method in quantitative analysis is the area under the curve method, and its specific implementation steps are as follows:

[0039] 1) Prepare the environment, build a system simulation platform, and construct a threat model.

[0040] 2) Start the attack, use the threat model to simulate the attack on the system, and collect indicator data related to the functional level of the system during the attack period.

[0041] 3) Data collation: Draw the collected data into a curve showing the system function changing over time. The example of the function curve is as follows: Figure 1 shown.

[0042] 4) Network elasticity analysis: By calculating the area under the function curve and performing normalization processing, the network elasticity value of the system can be obtained.

[0043] Since the area under the curve method lacks analysis of network resilience at different attack stages when evaluating the network resilience of a system, in order to analyze the resilience of the system from a more in-depth perspective and take more effective measures to improve the network resilience of the system, this embodiment proposes a quantitative analysis method for the four core capabilities of network resilience based on the area under the curve method, such as Figure 2 As shown, the following steps are included:

[0044] S1: Build the system to be analyzed, construct a threat model and attack the system to be analyzed, and then collect the performance values ​​of each key function at each moment within a preset time period.

[0045] In this embodiment, a network resilience analysis is conducted on an intelligent connected vehicle (ICV) system, taking the system under analysis as an example. Specifically, a vehicle simulation platform is built, which has all the functions of a real vehicle and can read the vehicle's operating data through relevant tools. Within the vehicle simulation platform, a threat model is constructed and an attack is launched against the ICV system to affect various functions of the ICV, such as reducing the level of a specific function, such as the remote control function in the T-Box (Telematics Box) module. Performance values ​​of the relevant ICV functions over time are collected starting from a period before the attack until the attack ends or the function level stabilizes.

[0046] In intelligent connected vehicle systems, the security of remote control functions is crucial, especially in the face of potential cyberattacks. To assess how remote control functions react to attacks, the following performance metrics can be used as a reference: Control Response Time, which measures the time it takes for the vehicle to respond to remote control commands. Under attack, this response time may increase, reflecting system latency and load. Control Command Success Rate, which measures the proportion of successfully executed remote control commands to all commands. Under attack, this success rate may decrease, indicating system interference or control restrictions. Connection Stability, which measures the quality of the connection between the remote control system and the vehicle. Under attack, the connection may become unstable, leading to frequent disconnections and reconnections. Abnormal Behavior Detection, which measures the number of abnormal or unauthorized control attempts identified and recorded by the system. During an attack, the number of abnormal behaviors may increase significantly.

[0047] It is worth noting that when simulating an attack, it is necessary to ensure that the attack intensity remains constant in each set of experiments; the preset time period for collecting data can be the sum of the 5 minutes before the start of the attack and the time period corresponding to the entire attack process. The size of the preset time period can be set by the implementer based on the specific actual situation and is not specifically limited.

[0048] At this point, this embodiment has obtained basic data for subsequent data processing, that is, a set of performance values ​​exhibited by different functions when simulating an attack on the system to be analyzed.

[0049] S2, summarize the performance values ​​of a key function at each moment and draw a scatter plot of the function changes corresponding to the key function.

[0050] After obtaining the data set from the simulated attack, in order to subsequently analyze the network resilience capabilities of the system to be analyzed at different stages, it is necessary to organize the performance values ​​of a certain key function at each moment, taking the performance value of the key function as an example, to facilitate observation and analysis of the degree to which the key function is affected by the attack. This embodiment uses the connection stability of the remote control function as an example to conduct subsequent evaluations of the four core capabilities of network resilience.

[0051] In this embodiment, data collation is achieved by analyzing the changes in functions over time. Specifically, the connection stability at each moment is summarized, and a function change scatter plot or a function change ladder plot corresponding to the connection stability of the remote control function is drawn. The horizontal axis of the function change scatter plot is time, and the vertical axis is the connection stability of the remote control function, that is, the performance value. An example of a function change ladder plot is shown in FIG. Figure 3 As shown. Among them, the process of drawing a scatter plot is a prior art and is not within the scope of protection of the present invention, and will not be elaborated here. It should be noted that the actual measured indicator data is not continuously distributed in time, so the scatter plot drawn here is more convenient for subsequent fitting of the model curve.

[0052] At this point, this embodiment has obtained a functional change scatter plot for subsequent image analysis.

[0053] S3, perform image analysis on the function change scatter plot to determine the resistance, recovery, perception and adaptability corresponding to the key function of the system to be analyzed.

[0054] In this embodiment, by performing image analysis on the function change scatter plot, the network resilience capabilities of the key function in the four stages of perception, resistance, recovery, and adaptation, namely, perception capability, resistance capability, recovery capability, and adaptability, can be analyzed.

[0055] The above step S3 can be Figure 4 The steps shown are implemented:

[0056] S31, determining the resistance and recovery capabilities corresponding to the key function of the system to be analyzed based on the performance value changes of the data points in the function change scatter diagram.

[0057] In this embodiment, the expression of the defense capability is defined based on the change in the rate of decrease of the performance value of the system when it is attacked in real situations; and the expression of the recovery capability is defined based on the change in the rate of recovery of the performance value of the system when it is attacked in real situations.

[0058] The above step S31 can be implemented through steps S311 to S312 (not shown):

[0059] S311, construct an expression for resilience based on the performance value trend and performance value decline rate in the function change scatter plot.

[0060] First, combining the performance values ​​at each moment, we construct the differential equation of resilience as shown in formula (1):

[0061] Where F represents the performance value of the data point, t represents the time of the data point, W represents the resistance, S D (t) represents the functional drop space at the tth moment, and d represents the calculus.

[0062] In the differential equation of resilience, the resilience W ranges from 0 to 1, where 1-W represents the portion of malicious influence that the system fails to effectively resist. As the system's resilience W increases, (1-W) decreases, indicating that the portion of malicious influence that the system fails to resist decreases, leading to a lower rate of functional degradation, and thus a stronger system resilience.

[0063] Secondly, determine the functional drop space at the tth moment, as shown in formula (2):

[0064] S D (t) = F(t) - m (2) where F(t) represents the performance value of the data point at the tth moment, and m represents the minimum performance value in the function change scatter plot.

[0065] Finally, the expression for resilience is the solution to the differential equation, as shown in formula (3):

[0066] Where F(t) represents the performance value of the data point at time t, t represents the time of the data point, e represents the natural constant, W represents the resistance, C1 represents the first constant, and m represents the minimum performance value in the functional change scatter plot.

[0067] It should be noted that the attack intensity is not enough to cause a significant change in the level of the key function of the system to be analyzed, that is, in the time interval from the start of the attack to the end of the attack, the function curve does not show any downward trend. At this time, the defense capability corresponding to the key function of the system to be analyzed can be directly assigned a value of 1; on the contrary, if the attack intensity is too high, the performance value of the key function of the system to be analyzed will show a cliff-like drop. That is, when the attack starts, the performance value of the key function will immediately drop to an unacceptable level and will no longer change or recover. At this time, the defense capability corresponding to the key function of the system to be analyzed can be directly assigned a value of 0.

[0068] S312: Construct an expression for recovery capability based on the performance value trend and the performance value recovery rate in the function change scatter plot.

[0069] First, combining the performance values ​​at each moment, we construct the differential equation of recovery capability as shown in formula (4):

[0070] In the formula, R represents the recovery capacity, S R (t) represents the functional recovery space at the tth moment.

[0071] Secondly, determine the functional recovery space at the tth moment, as shown in formula (5):

[0072] S R (t) = nF(t) (5) where n represents the stability energy value in the functional change scatter plot.

[0073] Finally, the expression of resilience is the solution of the differential equation, as shown in formula (6):

[0074] F(t)=-e -Rt+C2 +n(6); where R represents the recovery capacity, C2 represents the second constant, and n represents the stability energy value in the function change scatter plot. The stability energy value is used to represent the stability level after the system function is restored.

[0075] In formula (3) and formula (6), the first constant and the second constant are arbitrary constants in the general solution of the differential equation and have no actual physical meaning. However, the first constant and the second constant will affect the final fitting effect in the subsequent fitting process; m represents the lowest performance value of the key function of the system to be analyzed, that is, the minimum performance value in the function change scatter plot, and n represents the stable level of the system performance after recovery, that is, the vertical coordinate of the data point in the scatter plot where the system performance finally tends to be stable.

[0076] S313 , based on the function change scatter plot and in combination with the expression of resistance capability and the expression of recovery capability, determine the resistance capability and recovery capability corresponding to the key function of the system to be analyzed.

[0077] Specifically, the least squares method is used to jointly optimize the curve corresponding to the expression of resistance and the curve corresponding to the expression of recovery, so as to determine the resistance and recovery corresponding to the key function of the system to be analyzed; wherein, the data used for the joint optimization is the performance value of the data point at each moment in the function change scatter diagram. The implementation process of the least squares method is existing technology and is not within the scope of protection of the present invention, and will not be elaborated here.

[0078] In this embodiment, after constructing the mathematical model of resistance and recovery, it can be seen from formula (3) and formula (6) that the two equations have four unknowns, namely resistance, recovery, the first constant and the second constant. In order to determine the size of the four unknowns, the least squares method is used to jointly optimize curve (3) and curve (6). The data used in the joint optimization process is the real data measured when the system is attacked. By continuously adjusting the size of the four unknowns, the curve and the observed data are made to reach the best fit. At this time, the resistance and recovery corresponding to the key function of the system to be analyzed can be determined. Among them, the example of the fitting curve in the joint optimization process is as follows: Figure 5 As shown, the horizontal axis of the fitting curve represents time, and the vertical axis represents the connection stability of the remote control function, that is, the performance value exhibited by the key function; the observation data specifically refers to the function change scatter plot; the use of the least squares method to achieve the joint optimization process of the two curves is a prior art and is not within the scope of protection of the present invention, and will not be elaborated here.

[0079] S32: Analyze the degree to which the system to be analyzed can detect attacks in advance based on the function change scatter plot, and determine the perception capability corresponding to the key function of the system to be analyzed.

[0080] In this embodiment, the perception capability refers to the ability of the key function of the system to be analyzed to perceive an attack in advance. The perception capability can be expressed by the ratio between the advance prediction time and the attack hiding time. The larger the ratio of the advance prediction time to the attack hiding time, the faster the system to be analyzed can detect the hidden attack and take perception measures in advance.

[0081] The above step S32 can be implemented through steps S321 to S323 (not shown):

[0082] S321, in the function change scatter plot, determine the time point at which the attack is discovered and the target time point at which the performance value decreases, and use the difference between the target time point at which the performance value significantly decreases and the time point at which the attack is discovered in advance as the advance prediction time.

[0083] The "predicted time" specifically refers to the time between the discovery of an attack and the onset of a significant performance degradation. This significant degradation can be determined by obtaining normal performance values. The value of normal performance values ​​can be set by the implementer based on specific circumstances and is not limited. When the performance value first decreases by a magnitude greater than the normal value, the corresponding moment is the target time point for significant performance degradation. The time of attack discovery can be determined by the system being analyzed.

[0084] S322, determining the time point at which the attack starts, and taking the difference between the target time point at which the performance value significantly decreases and the time point at which the attack starts as the attack hiding time.

[0085] The attack hiding time specifically refers to the time from the start of the attack to the beginning of a significant decline in functionality.

[0086] S323: The ratio of the advance prediction time to the attack hiding time is used as the perception capability corresponding to the key function of the system to be analyzed.

[0087] As an example, the calculation formula for the perception capability of the system to be analyzed can be:

[0088] Where A represents the perception capability of the system to be analyzed, t1 represents the target time point when the indicator obviously decreases, and t f Indicates the time point when the attack is discovered in advance, t1-t f Indicates the predicted time in advance, t * It indicates the time when the attack starts, and t1-t0 indicates the attack hiding time.

[0089] It should be noted that, under normal circumstances, any type of attack has a certain hiding period after launching, so the attack hiding time in the denominator of the perception ability cannot be zero. fThe larger t1 is, and the smaller the attack hiding time t1-t0 is, the greater the degree to which the system to be analyzed can detect the attack in advance, and the greater the perception ability A of the system to be analyzed.

[0090] S33, analyzing the recovery status of the key function of the system to be analyzed according to the function change scatter diagram, and determining the adaptability corresponding to the key function of the system to be analyzed.

[0091] In this embodiment, the adaptability can be understood as the degree of recovery of the key function of the system to be analyzed, which can be analyzed by the difference between the stable performance value after the functional level is restored and the baseline level value corresponding to the key function of the system to be analyzed. The greater the adaptability, the stronger the network resilience of the key function of the system to be analyzed during the adaptation stage.

[0092] Specifically, by observing the scatter plot of functional changes, the stable performance value after the functional level is restored can be determined; by the size of the indicator data before the attack, the baseline level value corresponding to the key function of the system to be analyzed can be determined, that is, the indicator before the attack is used as the baseline level value; the difference between the stable performance value and the system baseline level value is used as the adaptability of the system to be analyzed.

[0093] As an example, the calculation formula for the adaptability corresponding to the key function of the system to be analyzed may be:

[0094] In the formula, ε represents the adaptability of the key function of the system to be analyzed, n represents the stability energy value in the function change scatter plot, and F N Indicates the baseline level value.

[0095] In the adaptive capacity calculation formula, when the performance value of the key function of the system to be analyzed tends to stabilize after being attacked, the stable performance value can be determined. The closer the stable performance value is to the baseline level value, the stronger the functional adaptability of the system to be analyzed and the greater the adaptive capacity. Under normal circumstances, the stable performance value after the functional level is restored will be lower than the baseline level value, so the value range of adaptive capacity can be between 0 and 1.

[0096] Thus, this embodiment obtains the network resilience indicators corresponding to different stages after a key function of the system to be analyzed is attacked, namely, the resistance, recovery, perception and adaptability.

[0097] S4, conduct a comprehensive analysis of the resistance, recovery, perception and adaptability corresponding to each key function of the system to be analyzed, and obtain the resistance, recovery, perception and adaptability of the system to be analyzed.

[0098] In this embodiment, by referring to the process for determining the resilience, recovery, perception, and adaptability corresponding to a key function, the resilience, recovery, perception, and adaptability corresponding to each key function of the system to be analyzed can be obtained. By performing a weighted summation of the same core capability for different key functions, the resilience, recovery, perception, and adaptability of the system to be analyzed can be obtained. The implementation process of this weighted summation is prior art and is beyond the scope of protection of this invention, and will not be elaborated on here.

[0099] Thus, this embodiment obtains the network resilience indicators corresponding to different stages of the system to be analyzed after being attacked, namely, the resistance, recovery, perception and adaptability.

[0100] In summary, the quantitative analysis method for the four core capabilities of network resilience proposed in this embodiment is objective, accurate, and comparable. It can also analyze the network resilience capabilities of a system in four stages when it is attacked. This helps to analyze the resilience capabilities of the system from a more in-depth perspective, so that more effective measures can be taken to improve the system's network resilience.

[0101] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A quantitative analysis method for the four core capabilities of network resilience, characterized by: The following steps are involved: Build the system to be analyzed, construct a threat model, and attack the system to be analyzed, thereby collecting performance values ​​of each key function at each moment within a preset time period; the performance values ​​include at least control response time, control command success rate, connection stability, and abnormal behavior detection; Summarize the performance values ​​of a key function at each moment and draw a function change scatter plot corresponding to the key function, where the horizontal axis of the function change scatter plot is time and the vertical axis is the performance value of the key function; Performing image analysis on the function change scatter plot to determine the resistance, recovery, perception, and adaptability corresponding to the key function of the system to be analyzed; Comprehensively analyze the resistance, recovery, perception and adaptability of each key function of the system to be analyzed, and obtain the resistance, recovery, perception and adaptability of the system to be analyzed; The image analysis of the function change scatter plot to determine the resistance, recovery, perception, and adaptability corresponding to the key function of the system to be analyzed includes: Determine the resistance and recovery capabilities corresponding to the key function of the system to be analyzed based on the performance value changes of the data points in the function change scatter plot; Analyze the degree to which the system to be analyzed can detect attacks in advance based on the function change scatter plot, and determine the perception capability corresponding to the key function of the system to be analyzed; Analyze the recovery of the key function of the system to be analyzed according to the function change scatter diagram, and determine the adaptability corresponding to the key function of the system to be analyzed; Determining the resistance and recovery capabilities corresponding to the key function of the system to be analyzed based on the performance value changes of the data points in the function change scatter plot includes: Constructing an expression for resilience based on the performance value trend and the performance value decline rate in the functional change scatter plot; Constructing an expression for recovery capability based on the performance value trend and performance value recovery rate in the function change scatter plot; Based on the function change scatter plot, combined with the expression of the resistance capability and the expression of the recovery capability, determine the resistance capability and recovery capability corresponding to the key function of the system to be analyzed; The expression of the resistance is: Where, represents the performance value of the data point at time t, t represents the time of the data point, e represents the natural constant, W represents the resistance, represents the first constant, m represents the minimum performance value in the functional change scatter plot; The expression of the recovery ability is: ; In the formula, R represents the recovery capacity, represents the second constant, n represents the stability energy value in the function change scatter diagram, and the stability energy value is used to represent the stability level of the key function of the system to be analyzed after recovery.

2. The quantitative analysis method for the four core capabilities of network resilience according to claim 1 is characterized by: The determining, based on the function change scatter plot and in combination with the resistance expression and the recovery expression, of the resistance and recovery capabilities corresponding to the key function of the system to be analyzed includes: The least squares method is used to jointly optimize the curve corresponding to the expression of the resistance capability and the curve corresponding to the expression of the recovery capability, so as to determine the resistance capability and recovery capability corresponding to the key function of the system to be analyzed; wherein the data used for the joint optimization is the performance value of the key function of the system to be analyzed at each moment in the function change scatter plot.

3. The quantitative analysis method for the four core capabilities of network resilience according to claim 1 is characterized by: Analyzing the extent to which the system to be analyzed detects attacks in advance based on the function change scatter plot and determining the perception capability corresponding to the key function of the system to be analyzed includes: In the function change scatter plot, determine the time point when the attack is discovered and the target time point when the performance value drops. The difference between the target time point when the performance value drops significantly and the time point when the attack is discovered in advance is used as the advance prediction time. The target time point is the time corresponding to the first time when the performance value drops by a greater magnitude than the normal performance value. Determine the time point when the attack starts, and take the difference between the target time point when the performance value obviously drops and the time point when the attack starts as the attack hiding time; The ratio of the advance prediction time to the attack hiding time is used as the perception capability corresponding to the key function of the system to be analyzed.

4. The quantitative analysis method for the four core capabilities of network resilience according to claim 1 is characterized by: Analyzing the recovery status of the key function of the system to be analyzed according to the function change scatter plot to determine the adaptability corresponding to the key function of the system to be analyzed includes: Based on the function change scatter plot, the stable performance value after the function level is restored is determined, the baseline level value corresponding to the key function of the system to be analyzed is obtained, and the difference between the stable performance value and the baseline level value is used as the adaptability of the key function of the system to be analyzed.

Images