Network elasticity capability assessment method, device, equipment and medium

Abstract

The invention relates to the technical field of computers, and discloses a network elasticity capability evaluation method and device, equipment and a medium, and the method comprises the steps: determining a network elasticity capability measurement index set matched with a submitted object; scoring each network elasticity capability measurement index in the network elasticity capability measurement index set to obtain a scoring set of the network elasticity capability measurement index set in different dimensions; summarizing the obtained score sets on different dimensions to obtain a target score corresponding to each network elasticity capability measurement index; and summarizing the target scores layer by layer according to a hierarchical structure of a preset network elasticity evaluation index system to obtain a network elasticity capability score of the submitted object, and determining a network elasticity capability evaluation result of the submitted object according to the network elasticity capability score. According to the technical scheme provided by the invention, the evaluation accuracy of the recovery capability of the network security system in the face of advanced persistent threats can be improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device and medium for assessing network resilience. Background Technology

[0002] With the intertwining of the physical and information domains, cyberattacks, especially advanced persistent threats (APTs), pose a greater challenge to network security, driving the development of the concept of cyber resilience. The goal of cyber resilience engineering is to build "trustworthy" systems capable of withstanding various attacks and failures, and to enhance network recovery and adaptability through redundancy, diversity, and dynamic technologies.

[0003] With the evolution of network resilience technologies, effectively assessing and measuring network resilience capabilities has become a research focus. However, existing static assessment and qualitative analysis methods suffer from limitations in expert knowledge and lack reproducibility and security testing. Therefore, overcoming the limitations of single static assessment and adversarial assessment in existing network resilience assessment methods, and improving the accuracy of assessing the resilience of network security systems in the face of advanced persistent threats, is a pressing technical problem that needs to be solved. Summary of the Invention

[0004] This application provides a method, apparatus, device, and medium for assessing network resilience capabilities, which overcomes the limitations of existing network resilience assessment methods, such as single static assessment and adversarial assessment, and improves the accuracy of assessing the resilience capabilities of network security systems in the face of advanced persistent threats.

[0005] To achieve the above objectives, the main technical solutions adopted in this application include: In a first aspect, embodiments of this application provide a method for assessing network resilience, the method comprising: Based on the business architecture of the submitted object, the submitted object is decomposed to determine a set of business components, and a set of network resilience metrics that matches the submitted object is determined based on the set of business components. Each network resilience metric in the network resilience metric set is scored to obtain a score set of the network resilience metric set on different dimensions; wherein, the different dimensions include at least the technical completeness dimension, the multi-expert knowledge fusion dimension, and the dynamic verification attack dimension. The scores obtained from different dimensions are summarized to obtain the target score corresponding to each network resilience metric. The target scores are summarized layer by layer according to the hierarchical structure of the preset network resilience evaluation index system to obtain the network resilience capability score of the submitted object, and the network resilience capability assessment result of the submitted object is determined based on the network resilience capability score.

[0006] This embodiment provides a network resilience assessment method that, based on the business architecture of the submitted object, determines a set of network resilience metrics that meet business requirements, effectively avoiding the blind spots of traditional methods that neglect the complexity of the business layer. It introduces multiple dimensions such as technical completeness, multi-expert knowledge fusion, and dynamic attack verification, ensuring that the assessment is not limited to static analysis but also comprehensively reflects expert judgment and the system's dynamic response capabilities. By aggregating scores from different dimensions, the target scores for each network resilience metric are further improved, making the assessment results more comprehensive and accurate. The hierarchical aggregation method ensures the hierarchy and detail of the assessment results, avoiding the one-sidedness of a single level or dimension. Overall, this assessment method, through a multi-dimensional, dynamic, and hierarchical framework, effectively improves the comprehensiveness and accuracy of network resilience assessment, providing a more accurate assessment of the resilience capabilities of network security systems facing complex threats.

[0007] In one implementation, the set of network resilience metrics is determined in the following manner: The submitted inspection object is decomposed based on its business architecture to determine the set of business components of the submitted inspection object. Based on the three-level indicators in the preset network resilience evaluation index system, a set of three-level indicators related to each business component in the set of business components is selected. The three-level indicator sets related to each business component are summarized to obtain the summarized three-level indicator set of the submitted object; duplicate items in the three-level indicator set are deleted to obtain the network resilience capability measurement indicator set that matches the submitted object.

[0008] This embodiment decomposes the business architecture of the tested object, accurately identifying each business component, avoiding overlooking key parts, and improving the comprehensiveness of the assessment. Based on a preset network resilience evaluation index system, a set of three-level indicators related to the business components is selected to reflect the resilience performance of the tested object under different threats from multiple dimensions. The three-level indicator sets of each business component are summarized to form a comprehensive three-level indicator set, further ensuring an accurate assessment of the overall recovery capability and durability of the tested object. The indicator set is optimized by removing duplicates, improving assessment efficiency and accuracy.

[0009] In one implementation, scoring each network resilience metric in the network resilience metric set to obtain a score set of the network resilience metric set across different dimensions includes: Based on the aforementioned set of network resilience metrics, determine the target set of network resilience technologies that the submitted test object should possess; and based on the implementation status of the submitted test object, determine the actual set of network resilience technologies that the submitted test object actually possesses. Based on the target network resilience technology set and the actual network resilience technology set, determine the technical completeness of the submitted object on each network resilience metric. Each network resilience metric is scored based on the technical completeness, resulting in a first score set for the network resilience metric set on the technical completeness dimension.

[0010] This embodiment ensures the comprehensiveness and adaptability of the evaluation system by determining the set of target network resilience capabilities that the submitted device should possess. Based on actual implementation, the actual set of network resilience capabilities that the submitted device possesses is determined, reflecting its performance in a real-world environment. Subsequently, by calculating the completeness of the technology, the implementation status of the submitted device on each resilience capability indicator is precisely quantified, providing more accurate and valuable data for the evaluation. Finally, through a scoring mechanism, the evaluation results are converted into quantitative scores, providing a clear basis for the evaluation.

[0011] In one implementation, determining the target set of network resilience technologies that the submitted test object should possess based on the network resilience capability metric set includes: From the preset network resilience engineering framework, select the first set of network resilience technologies corresponding to each network resilience capability metric; From the first set of network resilience technologies, a second set of network resilience technologies that matches each service component in the set of service components is selected. By integrating all the second network resilience technology sets, the target network resilience technology set corresponding to the submitted object is obtained.

[0012] This embodiment selects a first set of network resilience capabilities corresponding to each network resilience capability metric from a pre-defined network resilience engineering framework, ensuring more accurate evaluation and avoiding the shortcomings of a single static evaluation. From these first set of network resilience capabilities, a second set of network resilience capabilities matching the needs of each business component is selected, enabling the evaluation to consider not only network security factors but also optimization tailored to the characteristics of each business component. Finally, all first sets of network resilience capabilities are integrated to form a target set of network resilience capabilities, comprehensively improving the accuracy of the submitted resilience capability evaluation while avoiding redundancy.

[0013] In one implementation, scoring each network resilience metric in the network resilience metric set to obtain a score set of the network resilience metric set across different dimensions includes: Based on the implementation status of the submitted object, determine the actual set of business technologies possessed by the submitted object; Based on the pre-set skill information of each expert and the set of business technologies, determine the knowledge matching degree of each expert for each network resilience metric; Based on the knowledge matching degree, the scoring weight of each expert for each network resilience metric is determined; in response to the compliance score of each expert for each network resilience metric, the compliance scores are weighted and summed using the scoring weights to obtain a second scoring set of the network resilience metric set on the multi-expert knowledge fusion dimension.

[0014] This embodiment determines the technical implementation of the submitted test object through a set of business technologies, ensuring that the evaluation results are more closely aligned with practical applications. Next, the scoring weight is determined based on the knowledge matching degree of each expert, ensuring that the opinions of more authoritative experts account for a larger share in the final evaluation. Finally, the opinions of multiple experts are integrated through a weighted summation method to obtain a more objective and comprehensive evaluation result. This process effectively improves the accuracy of evaluating the resilience of cybersecurity systems in the face of advanced persistent threats, making the evaluation results more scientific and reliable.

[0015] In one implementation, scoring each network resilience metric in the network resilience metric set to obtain a score set of the network resilience metric set across different dimensions includes: Determine the threat set for each business component in the set of business components; For each threat in the threat set, construct an attack tree; Simulated attack tests are performed on each of the service components using an attack tree, and each network resilience metric is scored based on the test results to obtain a third score set of the network resilience metric set on the dynamic verification attack dimension.

[0016] This embodiment defines the threat set for each business component in the business component set, constructs an attack tree for each threat based on these threats, and uses the attack tree to drive simulated attack tests on each business component, scoring network resilience metrics accordingly. This forms a dynamic, evidence-driven evaluation loop. It transforms static asset and vulnerability lists into executable attack paths, revealing complex link weaknesses that are easily overlooked in traditional static assessments. By repeatedly simulating real attack scenarios on different business components, it obtains quantitative scores for various resilience capabilities such as detection, isolation, degradation, and recovery, achieving credible scoring of metrics in the "dynamically verified attack" dimension. Attack tree-driven simulations can reproduce the long-cycle, multi-stage behavior of Advanced Persistent Threats (APTs), enabling the assessment to not only reflect current vulnerabilities but also test the evolutionary capabilities of defenses in the face of continuous confrontation. In summary, the above process overcomes the limitations of previous single static assessments, which cannot reflect attack processes, and single adversarial assessments, which lack sufficient coverage, significantly improving the accuracy of assessing the resilience of network security systems in the face of Advanced Persistent Threats.

[0017] In one implementation, the step of summarizing the target score layer by layer according to the hierarchical structure of a preset network resilience evaluation index system to obtain the network resilience capability score of the submitted object includes: According to the preset network resilience evaluation index system, assign specified scores to the remaining indicators outside the network resilience capability measurement index set; Based on the hierarchical structure of the preset network resilience evaluation index system, the target scores corresponding to each network resilience capability measurement index at each level are weighted and summed to obtain the total score for each level. The network resilience score of the submitted object is obtained by summing the total scores of each level.

[0018] This embodiment avoids evaluation blind spots and ensures comprehensiveness by reasonably allocating scores for inapplicable indicators. Through hierarchical weighted summation, each indicator is dynamically reflected according to its importance. Finally, the total scores at each level are aggregated to comprehensively reflect the network resilience of the submitted object, ensuring the comprehensiveness and accuracy of the evaluation.

[0019] Secondly, embodiments of this application provide a network resilience assessment device, the device comprising: The metrics determination unit is used to decompose the submitted object into a set of business components based on the business architecture of the submitted object, and to determine a set of network resilience metrics that match the submitted object based on the set of business components. The metric scoring unit is used to score each network resilience metric in the network resilience metric set to obtain a score set of the network resilience metric set in different dimensions; wherein, the different dimensions include at least the technical completeness dimension, the multi-expert knowledge fusion dimension, and the dynamic verification attack dimension. The different dimension aggregation unit is used to aggregate the scores obtained in different dimensions to obtain the target score corresponding to each network resilience capability metric. The scoring aggregation unit is used to aggregate the target score layer by layer according to the hierarchical structure of the preset network resilience evaluation index system to obtain the network resilience capability score of the submitted object, so as to determine the network resilience capability assessment result of the submitted object based on the network resilience capability score.

[0020] Thirdly, embodiments of this application provide a computer device, including: The system includes a memory and a processor, which are interconnected. The memory stores computer instructions, and the processor executes these computer instructions to perform the network resilience assessment method described above.

[0021] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer instructions, which are used to cause a computer to execute the network resilience assessment method described above. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 A flowchart of a network resilience assessment method provided in this application embodiment; Figure 2 A flowchart illustrating the method for determining the set of network resilience metrics provided in this application embodiment; Figure 3 This is a partial schematic diagram of the network resilience evaluation index system provided in the embodiments of this application; Figure 4 A flowchart of step S3 from a technical completeness perspective, provided for embodiments of this application; Figure 5 A flowchart of step S311 provided in an embodiment of this application; Figure 6 A flowchart of step S3 in the multi-expert knowledge fusion dimension provided for embodiments of this application; Figure 7 A flowchart of step S3 in the dynamic verification attack dimension provided in the embodiments of this application; Figure 8 A flowchart of step S7 provided in an embodiment of this application; Figure 9 A block diagram of a network resilience assessment device provided in this application embodiment; Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] As the physical and information domains become increasingly intertwined, the threat and potential destructive power of cyberattacks are constantly increasing. The emergence of Advanced Persistent Threats (APTs), in particular, has made cybersecurity issues increasingly complex. APT attacks are typically highly covert and persistent; attackers use long-term monitoring and multi-stage attack methods to continuously infiltrate target systems, causing severe economic losses or political impact. The technical characteristics of this attack method are gradually revealing that the goal of ensuring absolute network security is unrealistic.

[0026] In this context, the concept of Cyber ​​Resiliency emerged as a crucial approach to ensuring network security. The core objective of Cyber ​​Resiliency Engineering is to build "trustworthy" network systems capable of withstanding various attacks, failures, and compromises. To achieve this goal, researchers have proposed various network security technologies, such as high-availability redundancy mechanisms and dynamic heterogeneous redundancy architectures. The design principles of these technologies include redundancy, diversity, and dynamism, aiming to enhance the resilience and adaptability of network systems in the face of attacks.

[0027] With the development of network resilience technologies, assessing and measuring network resilience capabilities has become a key research focus for major cybersecurity organizations. Network resilience assessment metrics not only measure the effectiveness of network resilience engineering implementation but also provide guidance for future technology optimization and risk prevention. Currently, many countries have introduced measurement frameworks and evaluation criteria to help network operators design more resilient network information systems.

[0028] Currently, most methods for measuring network resilience rely on static assessments and qualitative analysis. While these methods offer some reference, they suffer from limitations imposed by expert knowledge. Since network resilience encompasses multiple disciplines, such as cybersecurity, systems engineering, and mission assurance engineering, assessments by a single expert often exhibit cognitive biases. Furthermore, traditional static assessment methods struggle to conduct comprehensive security testing, failing to provide sufficient and reproducible verification of system security. Therefore, combining multiple assessment methods and employing more comprehensive testing approaches can effectively reduce errors and improve the accuracy and reliability of the assessment.

[0029] Therefore, overcoming the limitations of existing network resilience assessment methods, such as single static assessment and adversarial assessment, and improving the accuracy of assessing the resilience of network security systems in the face of advanced persistent threats is a pressing technical problem that needs to be solved.

[0030] To address the aforementioned technical problems, according to an embodiment of this application, a method for assessing network resilience is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] This embodiment provides a method for assessing network resilience. Figure 1 A flowchart of a network resilience assessment method provided in this application embodiment is shown below. Figure 1 As shown, the process includes the following steps: Step S1: Based on the business architecture of the submitted object, decompose the submitted object to determine the set of business components, and determine the set of network resilience metrics that match the submitted object based on the set of business components.

[0032] Specifically, an in-depth analysis of the submitted business architecture is conducted to identify a set of business components, such as databases, front-end frameworks, and load balancing components. Each business component has specific functional and performance requirements, which form the basis for evaluating network resilience. Next, based on the three-level indicators in the pre-defined network resilience evaluation indicator system, a set of three-level indicators related to each business component is selected. These indicator sets cover multiple aspects, from data recovery capabilities to system availability, ensuring a comprehensive evaluation of the network resilience of each business component. Finally, the three-level indicator sets of all business components are summarized and duplicates are removed to form a set of network resilience metrics covering all business components of the submitted business component. This set of indicators not only reflects the resilience of the submitted business component in the face of various network threats but also provides clear quantitative standards for subsequent evaluation and improvement, making the evaluation process more systematic and standardized.

[0033] Step S3: Score each network resilience metric in the network resilience metric set to obtain a score set of the network resilience metric set in different dimensions; wherein, the different dimensions include at least the technical completeness dimension, the multi-expert knowledge fusion dimension, and the dynamic verification attack dimension.

[0034] Specifically, to comprehensively evaluate the network resilience capabilities of the submitted test subjects, it is necessary to score each network resilience capability metric in the set of network resilience capability metrics across multiple dimensions. These dimensions include at least the technical completeness dimension, the multi-expert knowledge fusion dimension, and the dynamic verification attack dimension. In the technical completeness dimension, the actual set of network resilience capability technologies possessed by the submitted test subject is compared with the target set of network resilience capability technologies that should be possessed, and the technical completeness is calculated accordingly, with a score assigned. In the multi-expert knowledge fusion dimension, the knowledge and experience of multiple experts are combined to quantitatively score each set of network resilience capability metrics, and a comprehensive score is obtained by calculating the expert knowledge matching degree and scoring weights. In the dynamic verification attack dimension, simulated attack tests are conducted, and each set of network resilience capability metrics is scored based on the test results. Finally, the scores from different dimensions are summarized to obtain the comprehensive score for each network resilience capability metric, thereby comprehensively evaluating the network resilience capabilities of the submitted test subjects. This process ensures the comprehensiveness and accuracy of the evaluation, providing a scientific basis for system optimization and improvement.

[0035] Step S5: Summarize the scores obtained from different dimensions to obtain the target score corresponding to each network resilience metric.

[0036] Specifically, for each network resilience metric c i The target score S of the indicator is obtained by averaging and weighting the scores from the three dimensions. i .

[0037] Among them, s 1,i s 2,i and s 3,i These represent the network resilience metrics c. i Scores in the dimensions of technical completeness, multi-expert knowledge fusion, and dynamic verification attack.

[0038] This approach ensures that the score of each network resilience metric comprehensively reflects its overall performance in network resilience, providing a balanced and objective basis for the final assessment.

[0039] Step S7: The target score is summarized layer by layer according to the hierarchical structure of the preset network resilience evaluation index system to obtain the network resilience capability score of the submitted object, so as to determine the network resilience capability assessment result of the submitted object based on the network resilience capability score.

[0040] Specifically, for each level of indicators, a weighted sum is calculated based on their target scores to obtain the total score for that level. This weighting process considers the importance of different indicators within that level, ensuring the accuracy and reasonableness of the assessment. These total scores are then aggregated layer by layer, starting from the lowest-level indicator scores and gradually increasing upwards, ultimately yielding the network resilience score of the submitted device. This score comprehensively reflects the overall performance of the submitted device in terms of network resilience, providing a quantitative basis for assessing its network resilience capabilities. Based on this score, a judgment can be made according to preset thresholds to determine the network resilience assessment result of the submitted device, judging whether it meets the expected standards or requirements, thereby providing support for subsequent decision-making and improvement. For example, if the network resilience score of the submitted device is close to 1 (e.g., above 0.8), its network resilience capability can be considered good, indicating excellent performance in network resilience and the ability to effectively cope with various network threats and failures.

[0041] This embodiment provides a network resilience assessment method that, based on the business architecture of the submitted object, determines a set of network resilience metrics that meet business requirements, effectively avoiding the blind spots of traditional methods that neglect the complexity of the business layer. It introduces multiple dimensions such as technical completeness, multi-expert knowledge fusion, and dynamic attack verification, ensuring that the assessment is not limited to static analysis but also comprehensively reflects expert judgment and the system's dynamic response capabilities. By aggregating scores from different dimensions, the target scores for each network resilience metric are further improved, making the assessment results more comprehensive and accurate. The hierarchical aggregation method ensures the hierarchy and detail of the assessment results, avoiding the one-sidedness of a single level or dimension. Overall, this assessment method, through a multi-dimensional, dynamic, and hierarchical framework, effectively improves the comprehensiveness and accuracy of network resilience assessment, providing a more accurate assessment of the resilience capabilities of network security systems facing complex threats.

[0042] Figure 2 A flowchart illustrating the method for determining the set of network resilience metrics provided in this application embodiment, the process may include the following steps: Step S11: Decompose the submitted object based on its business architecture to determine the set of business components of the submitted object.

[0043] Specifically, business architecture is the high-level design of the submitted object, providing its functional framework, processes, data flow, and interaction model. Its main purpose is to help understand the core functional modules of the submitted object and their interactions. For example, in a web system, business architecture might involve the following parts: User Management: responsible for user registration, login, and permission management; Data Storage: responsible for persistent data storage and management, typically handled by a database system; Page Display: responsible for rendering and interacting with the front-end pages; Load Balancing: ensuring that the system can evenly distribute requests during high concurrency, improving system availability and stability.

[0044] The business architecture is broken down into multiple modules, each corresponding to a functional component. Specifically, each module of the business architecture is the core part of the submitted object, containing a set of interrelated functions to ensure the normal operation of the submitted object. By decomposing the submitted object into these modules, the components of the submitted object can be clearly identified. Each module contains one or more specific business components, which together implement the functionality of the module. The selection of business components depends not only on business requirements but also on the feasibility and optimization of technical implementation. By analyzing these business modules and their respective business components, the set of business components for the submitted object is determined. For example, the set of business components B = {b1: database, b2: front-end Vue.js framework, b3: Nginx load balancer, b4: payment gateway integration module, b5: order management module}.

[0045] Step S13: Based on the three-level indicators in the preset network resilience evaluation index system, select the set of three-level indicators related to each business component in the business component set.

[0046] Specifically, the predefined network resilience evaluation index system is a predefined index system used to assess the network resilience capabilities of the submitted test object. It includes multiple levels of indicators, with the third-level indicators being the most specific and operational. The third-level indicators are the lowest level of the evaluation system, directly used to assess the specific performance and security characteristics of the submitted test object. Please refer to the illustrative example. Figure 3 This is a partial schematic diagram of the network resilience evaluation index system provided in the embodiments of this application.

[0047] Each business component b i Each has its specific functional requirements. For example, the main function of a database is data storage and management, the main function of a front-end framework is user interface display, and the main function of a load balancing component is request distribution and high availability. Each business component b i Each has its specific performance requirements. For example, database performance requirements include data recovery time and data integrity; front-end framework performance requirements include user interface response time and front-end rendering performance; load balancing component performance requirements include the amount of DDoS attack traffic it can withstand and request distribution efficiency. Based on business component b... i Based on functional and performance requirements, select components that are compatible with each business component. i The relevant set of three-level indicators C i ={c1,c2,...,c n For database b1, its related three-level metric set C1 might include: C1 = {data recovery capability, data integrity, backup strategy}. For the front-end Vue.js framework b2, its related three-level metric set C2 might include: C2 = {user interface response time, front-end rendering performance, user experience}.

[0048] Step S15: Summarize the three-level indicator sets related to each business component to obtain the summary three-level indicator set of the submitted object.

[0049] Specifically, the three-level indicator sets C1, C2, ..., C of all business components are... n The data is aggregated into a single set, resulting in a aggregated three-level indicator set C′.

[0050] Step S17: Duplicate items in the three-level indicator set are deleted to obtain a set of network resilience measurement indicators that match the submitted object.

[0051] Specifically, in the aggregated three-level indicator set C′, some three-level indicators may appear repeatedly in multiple business components. For example, data recovery capability and system availability may appear in the indicator sets of both the database and load balancing components. A deduplication operation is performed on the three-level indicators in the aggregated three-level indicator set C′ to ensure that each indicator appears only once in the final indicator set. This deduplicated indicator set is then denoted as the network resilience capability measurement indicator set C.

[0052] This embodiment decomposes the business architecture of the tested object, accurately identifying each business component, avoiding overlooking key parts, and improving the comprehensiveness of the assessment. Based on a preset network resilience evaluation index system, a set of three-level indicators related to the business components is selected to reflect the resilience performance of the tested object under different threats from multiple dimensions. The three-level indicator sets of each business component are summarized to form a comprehensive three-level indicator set, further ensuring an accurate assessment of the overall recovery capability and durability of the tested object. The indicator set is optimized by removing duplicates, improving assessment efficiency and accuracy.

[0053] Figure 4 The flowchart for step S3 in terms of technical completeness provided for embodiments of this application may include the following steps: Step S311: Based on the network resilience measurement index set, determine the target network resilience technology set that the submitted test object should possess.

[0054] Specifically, based on each network resilience metric c i Select the corresponding first set of network resilience technologies T from the preset network resilience engineering framework. i Based on the functional and performance requirements of the business components, from the first network resilience technology set T i The second set of network resilience technologies T was selected from the actual needs. i All second network resilience technologies are integrated into T i Integrate them into a set T to form a set T of target network resilience capabilities that the submitted object should possess.

[0055] Step S313: Based on the implementation status of the submitted object, determine the actual set of network resilience technologies that the submitted object possesses.

[0056] Specifically, based on the actual implementation of the submitted devices, the technical means actually used by the submitted devices are identified through system test reports, code review, system configuration review, and system log analysis. The identified technical means are then compiled into a set of actual network resilience technologies.

[0057] Step S315: Based on the target network resilience technology set and the actual network resilience technology set, determine the technical completeness of the submitted object on each network resilience metric.

[0058] Specifically, the technical completeness TC i It is a collection of technologies related to the actual network resilience of the submitted test subjects. The ratio of the number of intersections with the target network resilience technology set T to the number of target network resilience technology sets T.

[0059] For example, for the network resilience metric c1, T1 = {redundant storage, multi-site data backup, data encryption} and Step S317: Score each network resilience metric based on technical completeness to obtain the first score set of the network resilience metric set on the technical completeness dimension.

[0060] Specifically, based on the level of technological completeness (TC) i For each network resilience metric c i Scoring is performed to obtain the first score set Score1 = {s1, s2, ..., s} n Scoring rules: This embodiment ensures the comprehensiveness and adaptability of the evaluation system by determining the set of target network resilience capabilities that the submitted device should possess. Based on actual implementation, the actual set of network resilience capabilities that the submitted device possesses is determined, reflecting its performance in a real-world environment. Subsequently, by calculating the completeness of the technology, the implementation status of the submitted device on each resilience capability indicator is precisely quantified, providing more accurate and valuable data for the evaluation. Finally, through a scoring mechanism, the evaluation results are converted into quantitative scores, providing a clear basis for the evaluation.

[0061] Figure 5 The flowchart for step S311 provided in the embodiments of this application may include the following steps: Step S3111: Select the first set of network resilience technologies corresponding to each network resilience capability metric from the preset network resilience engineering framework.

[0062] Specifically, the predefined network resilience engineering framework is a predefined technical framework that includes the technical means required to achieve various network resilience capability metrics. For example, data recovery capability may require technologies such as redundant storage and multi-site data backup. Based on each network resilience capability metric c... iSelect the corresponding first set of network resilience technologies T from the preset network resilience engineering framework. i For example, for the data recovery capability metric c1, the first set of network resilience technologies T1′ might include: T1′ = {redundant storage, multi-site data backup, data encryption}. For the user interface response time metric c2, the first set of network resilience technologies T2′ might include: T2′ = {code optimization, caching mechanism, resource compression}.

[0063] Step S3113: Select the second set of network resilience technologies that each business component in the business component set should possess from the first set of network resilience technologies.

[0064] Specifically, based on the functional and performance requirements of each service component in service component set B, from the first network resilience technology set T... i The technology set T that should be possessed for the second network resilience capability was selected from the data. i For database b1, its functional and performance requirements include data recovery capabilities and data integrity. Therefore, the second network resilience technology set T1 selected from the first network resilience technology set T1′ may include: T1 = {redundant storage, multiple data backups}.

[0065] Step S3115: Integrate all the second network resilience technology sets to obtain the target network resilience technology set that the submitted object should possess.

[0066] Specifically, the second network resilience technology set T for all business components i Integrate them into a set T to form a set T of target network resilience capabilities that the submitted object should possess.

[0067] This embodiment selects a first set of network resilience capabilities corresponding to each network resilience capability metric from a pre-defined network resilience engineering framework, ensuring more accurate evaluation and avoiding the shortcomings of a single static evaluation. From these first set of network resilience capabilities, a second set of network resilience capabilities matching the needs of each business component is selected, enabling the evaluation to consider not only network security factors but also optimization tailored to the characteristics of each business component. Finally, all first sets of network resilience capabilities are integrated to form a target set of network resilience capabilities, comprehensively improving the accuracy of the submitted resilience capability evaluation while avoiding redundancy.

[0068] Figure 6 The flowchart of step S3 in the multi-expert knowledge fusion dimension provided in the embodiments of this application may include the following steps: Step S321: Determine the actual set of business technologies possessed by the submitted object based on its implementation status.

[0069] Specifically, based on the actual implementation of the submitted device, the technical means actually used by the submitted device are identified through system test reports, code review, system configuration review, and system log analysis. The identified technical means are then compiled into a Business Technology Set (OBT). i For example, for the data recovery capability indicator c1, the business technology set OBT1 includes: OBT1 = {redundant storage, multi-site data backup, data encryption}.

[0070] Step S323: Based on the pre-set skill information and business technology set of each expert, determine the knowledge matching degree of each expert for each network resilience metric.

[0071] Specifically, Pre-set Skill Information (EBT) j It is the business and technical knowledge possessed by each expert, obtained through investigation.

[0072] The knowledge matching degree is calculated using the pre-set skill information EBT of each expert j. j With each network resilience metric c i The business technology set involved is OBT i The total number of intersection elements and the business technology set OBT i The ratio of the total number of elements can be obtained: Assuming expert 1's pre-set skill information EBT1 = {redundant storage, data encryption}, for the network resilience metric c1: Step S325: Determine the scoring weight of each expert for each network resilience metric based on the knowledge matching degree.

[0073] Specifically, the scoring weights are: Step S327: In response to each expert's compliance score for each network resilience metric, the compliance scores are weighted and summed to obtain a second score set of the network resilience metric set in the multi-expert knowledge fusion dimension.

[0074] Specifically, experts evaluated each network resilience metric c based on national standard evaluation criteria. i A compliance score is assigned: 1 point for compliance, 0.5 points for partial compliance, and 0 points for non-compliance. For each network resilience metric c... i According to the expert's scoring weight w i,j The expert scores for compliance are weighted and summed to obtain all expert scores for each network resilience metric: Among them, s i For all expert scores corresponding to network resilience metric i; s i,j Let be the score given by expert j for conformity to network resilience metric i; m be the number of experts. The final result is the second score set of the network resilience metric set: Score2 = {s1, s2, ..., s}. n}

[0075] This embodiment determines the technical implementation of the submitted test object through a set of business technologies, ensuring that the evaluation results are more closely aligned with practical applications. Next, the scoring weight is determined based on the knowledge matching degree of each expert, ensuring that the opinions of more authoritative experts account for a larger share in the final evaluation. Finally, the opinions of multiple experts are integrated through a weighted summation method to obtain a more objective and comprehensive evaluation result. This process effectively improves the accuracy of evaluating the resilience of cybersecurity systems in the face of advanced persistent threats, making the evaluation results more scientific and reliable.

[0076] Figure 7 The flowchart of step S3 in the dynamic verification attack dimension provided in the embodiments of this application may include the following steps: Step S331: Determine the threat set for each business component in the business component set.

[0077] Specifically, taking the set of business components B as the starting point, each business component b i It has specific functional and performance requirements. Using threat analysis trees or other existing technologies, analyze each business component. i Potential threats, identifying its threat set Z i ={z1,z2,…,z n}

[0078] Step S333: Build an attack tree for each threat in the threat set.

[0079] Specifically, for each threat z i Draw an attack tree, where the root node represents the attack target, intermediate nodes correspond to a specific ATT&CK tactic, and leaf nodes correspond to ATT&CK techniques. For example, for data breach threat z1, the attack tree includes: root node: data breach; intermediate nodes: escalation of data access permissions, data encryption cracking; leaf nodes: SQL injection, brute force attack.

[0080] Step S335: Simulate attack tests on each business component using the attack tree, and score each network resilience metric based on the test results to obtain the third score set of the network resilience metric set on the dynamic verification attack dimension.

[0081] Specifically, an adversarial assessment method is used to simulate an attacker targeting each business component b according to the attack tree. i Initiate a simulated attack test to observe business component b i The corresponding network resilience metric c i Scoring rules: If the network resilience metric c i If the observable and attack verification metrics fail to meet the standards, the score is 0.

[0082] If the network resilience metric c i If the observable and attack verification metrics partially meet the standards, the score is 0.5.

[0083] If the network resilience metric c i If the attack is observable and the attack verification metrics meet the standards, the score is 1.

[0084] If the network resilience metric c i If a test case is unobservable or has no applicable test cases, the score is 1.

[0085] Based on the above rules, each business component b can be obtained. i The corresponding indicator set C i The score for each indicator is calculated. A weighted average summation method is used to combine identical terms to obtain the network resilience measure, c. i The score. For example, each business component b i There is a corresponding set of indicators C i These metrics set contain the scores that the business component has received in different tests or evaluations: C1 = {s1, s2} 1,2 ,s 1,3 C2 = {s4, s5, s6}, C2 = {s5, s6} 2,6 ,s7},C3={s 3,6 ,s 3,8 ,s 3,9}, C4={s 4,6 ,s 4,8 ,s 4,9}, C5={s 5,2 ,s 5,3 ,s 10}, each element s in these sets i,j This represents the score of a specific network resilience metric within a particular service component. Within this set of metrics, some metrics may appear in multiple service components. For example, network resilience metric c2 ​​may appear in both C1 and C5. To obtain the overall score for each network resilience metric, the scores of these identical metrics need to be combined. A weighted average summation method is used. here, This represents the weight, indicating the contribution of each score to the overall score. If more business components include metric c2, the weight will be adjusted accordingly. For example, if three business components include c2, the weight would be...

[0086] Finally, a comprehensive score is obtained for each network resilience metric, and all network resilience metrics are combined. i Score s i Organize into the final third score set Score3 = {s1, s2, ..., s...} n}

[0087] This embodiment defines the threat set for each business component in the business component set, constructs an attack tree for each threat based on these threats, and uses the attack tree to drive simulated attack tests on each business component, scoring network resilience metrics accordingly. This forms a dynamic, evidence-driven evaluation loop. It transforms static asset and vulnerability lists into executable attack paths, revealing complex link weaknesses that are easily overlooked in traditional static assessments. By repeatedly simulating real attack scenarios on different business components, it obtains quantitative scores for various resilience capabilities such as detection, isolation, degradation, and recovery, achieving credible scoring of metrics in the "dynamically verified attack" dimension. Attack tree-driven simulations can reproduce the long-cycle, multi-stage behavior of Advanced Persistent Threats (APTs), enabling the assessment to not only reflect current vulnerabilities but also test the evolutionary capabilities of defenses in the face of continuous confrontation. In summary, the above process overcomes the limitations of previous single static assessments, which cannot reflect attack processes, and single adversarial assessments, which lack sufficient coverage, significantly improving the accuracy of assessing the resilience of network security systems in the face of Advanced Persistent Threats.

[0088] Figure 8 The flowchart for step S7 provided in the embodiments of this application may include the following steps: Step S71: According to the preset network resilience evaluation index system, assign specified scores to the remaining indicators outside the network resilience capability measurement index set.

[0089] Specifically, the preset network resilience evaluation index system is a comprehensive index system that includes all possible network resilience capability metrics. The network resilience capability metric set is a filtered set of indicators that covers the business components of the submitted test object. For the remaining indicators outside of the network resilience capability metric set C, they are marked as inapplicable and assigned a score of 1 point.

[0090] Step S73: Based on the hierarchical structure of the preset network resilience evaluation index system, the target scores corresponding to each network resilience capability measurement index at each level are weighted and summed to obtain the total score for each level.

[0091] Specifically, the pre-defined network resilience evaluation index system typically has a hierarchical structure, with each level containing indicators of different granularities. The target scores of each network resilience capability measurement indicator in each level are weighted and summed to obtain the total score for each level.

[0092] Step S75: Summarize the total scores at each level to obtain the network resilience score of the submitted object.

[0093] Specifically, the total score for each level is aggregated from the bottom up to the top, ultimately yielding the network resilience score of the submitted device. This process not only considers the overall score of each network resilience metric but also appropriately handles inapplicable metrics, ensuring the comprehensiveness and accuracy of the assessment. The final score comprehensively reflects the submitted device's overall performance in network resilience, providing a scientific basis for its optimization and improvement.

[0094] This embodiment avoids evaluation blind spots and ensures comprehensiveness by reasonably allocating scores for inapplicable indicators. Through hierarchical weighted summation, each indicator is dynamically reflected according to its importance. Finally, the total scores at each level are aggregated to comprehensively reflect the network resilience of the submitted object, ensuring the comprehensiveness and accuracy of the evaluation.

[0095] Accordingly, please refer to Figure 9 A block diagram of a network resilience assessment device provided in this application embodiment, the device comprising: The metrics determination unit 101 is used to decompose the service component set of the submitted object based on the service architecture of the submitted object, and determine the network resilience metric set that matches the submitted object based on the service component set. The metric scoring unit 103 is used to score each network resilience metric in the network resilience metric set, thereby obtaining a set of scores for the network resilience metric set in different dimensions; wherein, the different dimensions include at least the technical completeness dimension, the multi-expert knowledge fusion dimension, and the dynamic verification attack dimension. The different dimension aggregation unit 105 is used to aggregate the scores obtained in different dimensions to obtain the target score corresponding to each network resilience metric. The scoring aggregation unit 107 is used to aggregate the target score layer by layer according to the hierarchical structure of the preset network resilience evaluation index system to obtain the network resilience capability score of the submitted object, so as to determine the network resilience capability assessment result of the submitted object based on the network resilience capability score.

[0096] In some alternative implementations, the set of network resilience metrics is determined in the following ways: Decompose the submitted inspection object based on its business architecture to determine the set of business components of the submitted inspection object. Based on the three-level indicators in the preset network resilience evaluation index system, a set of three-level indicators related to each business component in the business component set is selected. The three-level indicator sets related to each business component are summarized to obtain the summary three-level indicator set of the submitted inspection object; Duplicate items in the three-level indicator set are removed to obtain a set of network resilience measurement indicators that match the submitted test objects.

[0097] In some optional implementations, the metric scoring unit 103 includes: Based on the set of network resilience metrics, determine the set of target network resilience technologies that the submitted test object should possess. Based on the implementation status of the submitted test objects, determine the actual set of network resilience technologies that the submitted test objects possess. Based on the target network resilience technology set and the actual network resilience technology set, determine the technical completeness of the submitted test object on each network resilience metric; Each network resilience metric is scored based on its technological completeness, resulting in the first score set of the network resilience metric set on the technological completeness dimension.

[0098] In some optional implementations, based on a set of network resilience metrics, the target set of network resilience technologies that the submitted device should possess is determined, including: From the pre-defined network resilience engineering framework, select the first set of network resilience technologies corresponding to each network resilience capability metric; From the first set of network resilience technologies, select a second set of network resilience technologies that matches each business component in the set of business components. By integrating all the second network resilience technology sets, the target network resilience technology set corresponding to the submitted object is obtained.

[0099] In some optional implementations, the metric scoring unit 103 includes: Based on the implementation status of the submitted object, determine the actual set of business technologies possessed by the submitted object; Based on each expert's pre-set skill information and business technology set, determine the knowledge matching degree of each expert for each network resilience metric; Based on the knowledge matching degree, determine the scoring weight of each expert for each network resilience metric; In response to each expert's compliance score for each network resilience metric, the compliance scores are weighted and summed to obtain a second score set of the network resilience metric set in the multi-expert knowledge fusion dimension.

[0100] In some optional implementations, the metric scoring unit 103 includes: Identify the threat set for each business component in the set of business components; Build an attack tree for each threat in the threat set; Simulated attack tests are conducted on each business component using an attack tree, and each network resilience metric is scored based on the test results to obtain a third scoring set of network resilience metrics on the dynamic verification attack dimension.

[0101] In some alternative implementations, the score aggregation unit 107 includes: Based on the preset network resilience evaluation index system, assign specific scores to the remaining indicators outside the network resilience capability measurement index set; based on the hierarchical structure of the preset network resilience evaluation index system, perform a weighted summation of the target scores corresponding to each network resilience capability measurement index at each level to obtain the total score for each level. The total scores at each level are aggregated to obtain the network resilience score of the submitted object.

[0102] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0103] In this embodiment, a network resilience assessment device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0104] Please see Figure 10 , Figure 10 This application provides a schematic diagram of the structure of a computer device, as shown in the embodiment of the present application. Figure 10As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 10 Take a processor 10 as an example.

[0105] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0106] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0107] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0108] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0109] The computer device also includes a communication interface 30 for communicating with other devices or communication networks.

[0110] This application also provides a computer-readable storage medium. The methods described in this application can be implemented in hardware or firmware, or implemented as recordable on a storage medium, or implemented as computer code downloaded over a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and subsequently stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the methods shown in the above embodiments are implemented.

[0111] The apparatus and units described in the above embodiments can be implemented by a computer chip or physical entity, or by a product with a certain function. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0112] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0113] Those skilled in the art will understand that the embodiments of this application can be provided as methods or apparatus. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0114] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatuses, and devices according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0115] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0116] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0117] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0118] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0119] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

[0120] Although embodiments of this application have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of this application, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for network resilience capability assessment, the method comprising: The method comprises: based on the business architecture of the object under test, decomposing the object under test to determine a set of business components, and determining a set of network resilience capability metrics matched with the object under test according to the set of business components; scoring each network resilience capability metric in the set of network resilience capability metrics to obtain a scoring set of the set of network resilience capability metrics in different dimensions; wherein the different dimensions at least include a technical completeness dimension, a multi-expert knowledge fusion dimension, and a dynamic verification attack dimension; summarizing the obtained scoring set in different dimensions to obtain a target score corresponding to each network resilience capability metric; layer-by-layer summarizing the target score according to the hierarchical structure of the preset network resilience evaluation index system to obtain a network resilience capability score of the object under test, so as to determine a network resilience capability evaluation result of the object under test according to the network resilience capability score.

2. The method of claim 1, wherein, The set of network resilience capability metrics is determined in the following way: based on the business architecture of the object under test, decomposing the object under test to determine a set of business components of the object under test; according to the third-level indicators in the preset network resilience evaluation index system, screening out a set of third-level indicators related to each business component in the set of business components; summarizing the set of third-level indicators related to each business component to obtain a summarized set of third-level indicators of the object under test; deleting duplicates in the set of third-level indicators to obtain a set of network resilience capability metrics matched with the object under test.

3. The method of claim 1, wherein, The scoring of each network resilience capability metric in the set of network resilience capability metrics to obtain a scoring set of the set of network resilience capability metrics in different dimensions comprises: based on the set of network resilience capability metrics, determining a set of target network resilience capability technologies that the object under test should have; according to the implementation of the object under test, determining a set of actual network resilience capability technologies that the object under test actually has; according to the set of target network resilience capability technologies and the set of actual network resilience capability technologies, determining a technical completeness degree of the object under test on each network resilience capability metric; based on the technical completeness degree, scoring each network resilience capability metric to obtain a first scoring set of the set of network resilience capability metrics in the technical completeness dimension.

4. The method of claim 3, wherein, The determination of the set of target network resilience capability technologies that the object under test should have based on the set of network resilience capability metrics comprises: from the preset network resilience engineering framework, screening out a first set of network resilience capability technologies corresponding to each network resilience capability metric; from the first set of network resilience capability technologies, screening out a second set of network resilience capability technologies matched with each business component in the set of business components; integrating all the second sets of network resilience capability technologies to obtain a set of target network resilience capability technologies corresponding to the object under test.

5. The method of claim 1, wherein, The scoring on each network resilience capability measurement index in the network resilience capability measurement index set obtains a scoring set of the network resilience capability measurement index set in different dimensions, including: According to the implementation of the submission object, determine the business technology set actually possessed by the submission object; According to the preset skill information of each expert and the business technology set, determine the knowledge matching degree of each expert to each network resilience capability measurement index; According to the knowledge matching degree, determine the scoring weight of each expert to each network resilience capability measurement index; in response to the conformity scoring of each expert to each network resilience capability measurement index, the conformity scoring is weighted and summed through the scoring weight, to obtain a second scoring set of the network resilience capability measurement index set in the multi-expert knowledge fusion dimension.

6. The method of claim 1, wherein, The scoring on each network resilience capability measurement index in the network resilience capability measurement index set obtains a scoring set of the network resilience capability measurement index set in different dimensions, including: Determine the threat set of each business component in the business component set; For each threat in the threat set, build an attack tree; Through the attack tree, simulate the attack test on each business component, and score each network resilience capability measurement index according to the test result, to obtain a third scoring set of the network resilience capability measurement index set in the dynamic verification attack dimension.

7. The method of claim 1, wherein, The target score is sequentially aggregated according to the hierarchical structure of the preset network resilience evaluation index system, to obtain the network resilience capability score of the submission object, including: According to the preset network resilience evaluation index system, configure a specified score for the remaining indicators other than the network resilience capability measurement index set; According to the hierarchical structure of the preset network resilience evaluation index system, the target score corresponding to each network resilience capability measurement index in each level is weighted and summed to obtain the level total score of each level; The level total scores are sequentially aggregated to obtain the network resilience capability score of the submission object.

8. A network resilience capability assessment apparatus, characterized by, The device comprises: A measurement index determination unit is configured to determine a business component set based on the business architecture of the submission object, and determine a network resilience capability measurement index set matched with the submission object according to the business component set; A measurement index scoring unit is configured to score each network resilience capability measurement index in the network resilience capability measurement index set to obtain a scoring set of the network resilience capability measurement index set in different dimensions; wherein the different dimensions at least include a technical completeness dimension, a multi-expert knowledge fusion dimension, and a dynamic verification attack dimension; A different dimension aggregation unit is configured to aggregate the obtained scoring sets in different dimensions to obtain a target score corresponding to each network resilience capability measurement index. A score layer-by-layer aggregation unit is configured to aggregate the target scores layer by layer according to a hierarchical structure of a preset network resilience evaluation index system, to obtain a network resilience capability score of the submission object, and to determine a network resilience capability evaluation result of the submission object according to the network resilience capability score.

9. A computer device, comprising: The network resilience capability evaluation method comprises the following steps: A memory and a processor are in communication connection with each other, and the memory stores computer instructions. The processor executes the computer instructions to perform the network resilience capability evaluation method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling a computer to perform the network resilience capability evaluation method according to any one of claims 1 to 7.

Images