A method and device for identifying key nodes in a combat system network

Abstract

The invention relates to the field of combat system key node identification, and specifically relates to a combat system network key node identification method based on a kill chain; multiple nodes and multiple edges are modeled, and a combat system network model is constructed based on the node model and the edge model; multiple kill chain models are constructed based on target nodes; multiple Monte Carlo samplings are performed on the combat system network to determine the combat system network state vector; based on the Ullmann algorithm, multiple kill chains containing specific targets in the combat system network are determined; target nodes in multiple kill chains are searched, and the number of kill chains in which the nodes are located is counted; the kill chains are measured to obtain importance values ​​R of multiple target nodes, and key nodes are determined based on the importance values ​​R; the node importance index of the invention can reflect the influence of heterogeneous combat elements such as performance differences of different equipment and importance of strike targets, thereby realizing reasonable and effective identification of key nodes.

Description

Technical Field

[0001] The present invention relates to the field of combat system key node identification, and in particular to a combat system network key node identification method and device based on a kill chain. Background Art

[0002] With the in-depth application of modern high-tech in the military field, the operational coordination and coupling relationship between weapons and equipment is becoming stronger and stronger, and the war mode is also rapidly changing from "platform-centric warfare" to confrontation between the combat systems of both sides. Effective identification of key nodes in the combat system can, on the one hand, guide actual combat operations from the perspective of attack and achieve effective attacks on the enemy system, and on the other hand, identify the vulnerable nodes of our system from the perspective of defense and provide guidance for the defense and optimization of the system.

[0003] The combat system can be described based on the network model. There are currently two commonly used methods for identifying key nodes in the combat system network: one is to use the existing network centrality indicators (degree centrality, betweenness centrality, proximity centrality, etc.) to rank the importance of nodes in the combat system network, and the nodes with the highest ranking are the key nodes; the other is to start from the "OODA loop" of combat activities and count the number of "OODA loops" of each node in the combat system network. The nodes with more "OODA loops" are the key nodes of the combat system.

[0004] In practical applications, both methods have certain shortcomings. The former method uses a general network centrality index, which leads to insufficient reflection of the specific combat process, poor interpretability of the results and does not necessarily conform to the actual situation; although the latter method considers the dependency between the combat process and combat nodes from the perspective of the "OODA loop", it does not reflect the impact of heterogeneous factors such as the mission success rate of different equipment in the combat system network and the importance of target nodes on the key nodes of the system, and has certain defects. Summary of the invention

[0005] The embodiment of the present application provides a method and device for identifying key nodes in a combat coordination network. The method can effectively reflect the actual combat process and comprehensively reflect the influence of heterogeneous factors such as the mission success rate of different equipment nodes in the combat system network and the importance of target nodes, and at the same time, it should have the characteristics of good interpretability, high recognition accuracy and strong robustness.

[0006] In order to achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:

[0007] In a first aspect, this embodiment provides a method for identifying key nodes of a combat system network, which is applied to a combat system network, wherein the combat system network is mainly composed of multiple nodes and multiple edges, wherein the nodes include weapons and equipment, and includes the following methods: modeling multiple nodes and multiple edges, and constructing a combat system network model based on the node model and the edge model, wherein the edges include multiple paths formed between the nodes; extracting some nodes from the combat system network model as target nodes, and constructing multiple kill chain models based on the target nodes; performing multiple Monte Carlo sampling on the combat system network to determine the combat system network state vector x k ; Based on the Ullmann algorithm, determine multiple kill chains containing specific targets in the combat system network; search for multiple target nodes in the kill chains, and count the number of kill chains in which the nodes are located; measure the kill chains, obtain the importance values ​​R of multiple target nodes, and determine the key nodes based on the importance values ​​R.

[0008] With respect to the second possible implementation, in combination with the first aspect, modeling the plurality of nodes includes: establishing nodes of the combat system network according to a mapping relationship with combat entities or entity components in the combat system network, wherein the nodes include reconnaissance nodes, decision nodes, influence nodes, and target nodes; modeling the edges includes: obtaining an initial edge model based on connecting different nodes in the node model in pairs, and obtaining a target edge model by screening the initial edge model based on the target node type; constructing a combat system network model includes: constructing a directed weighted network based on a node set, an edge set, and an edge weight set, wherein the directed weighted network is G=(V, E, W), wherein V is a set of nodes, E is a set of edges, and W is a set of edge weights.

[0009] For the third possible implementation, in combination with the second possible implementation and the first aspect, the node set is V=V S ∪V D ∪V I ∪V T ,in For reconnaissance nodes, For decision nodes, To affect the class nodes and is the target class node, where n S 、n D 、n I and n T is the number of nodes; the edge set is where n e is the number of edges, where is the tth directed edge in the combat system network, and for e tThe nodes at both ends; the edge weight set is W = {w t |e t ∈E}, where n e is the number of edges, w t For edge e t The weight of h()∈(0,1), and Node and is a set of performance indicators, and h() represents the mapping relationship between node performance indicators and weights.

[0010] For the fourth possible implementation, in combination with the second possibility, the third possibility and the first aspect, the combat system network state vector is a vector composed of element values ​​of multiple edges, and the combat system network state vector x is determined. k The method includes determining element values ​​of multiple edges, wherein the element values ​​are real numbers of 0 or 1; the method for determining the element values ​​includes obtaining random numbers of edges corresponding to the sampling through Monte Carlo sampling, comparing the relationship between the random numbers of the corresponding edges and edge weights, and determining the element values ​​based on the comparison results; the comparison results include: the random number is greater than the edge weight, and the random number is less than or equal to the edge weight; when the random number is greater than the edge weight, the element value is 0, and when the random number is less than or equal to the edge weight, the element value is 1;

[0011] The calculation method of the element value of the corresponding edge includes:

[0012] in, is the random number corresponding to the tth edge in the kth sampling, is the element value corresponding to the tth edge in the kth sampling, and K is the total number of samples; the calculation method of the combat system network state vector includes:

[0013] For the fifth possible implementation, in combination with the fourth possible implementation, the third possible implementation and the first aspect, constructing multiple kill chain models based on the target node includes: constructing a link network G based on the target node set and the edge set l =(V l ,E l ), the link network is the kill chain G l , where V l is the target node set, where E l is the set of edges.

[0014] For the sixth possible implementation, in combination with the fifth possible implementation, the fourth possible implementation, the third possible implementation and the first aspect, determining multiple kill chains containing specific targets in the combat system network includes: constructing a search space based on the combat system network, and screening the multiple kill chains containing specific targets in the search space; the method for constructing the search space includes constructing a mapping relationship matrix, and the screening of multiple kill chains includes obtaining isomorphic relationships in the mapping relationship matrix, and determining the kill chain containing the specific target based on the isomorphic relationship; the constructing of the mapping relationship matrix includes: constructing a node mapping relationship matrix based on a kill chain model and a combat system network model; the determining the kill chain containing the specific target based on the isomorphic relationship includes: extracting multiple single node mapping relationship matrices in the node mapping relationship matrix, judging the isomorphic relationship between the multiple single node mapping relationship matrices and the kill chain and the combat system network, and determining the kill chain containing the target based on the isomorphic relationship.

[0015] With respect to the seventh possible implementation, in combination with the sixth possible implementation, the fifth possible implementation, the fourth possible implementation, the third possible implementation and the first aspect, the construction of the mapping relationship matrix also includes search space optimization, including: respectively obtaining the forward node type and the backward node type of the corresponding nodes in the kill chain model and the combat system network, as well as the forward node type set and the backward node type set, judging the relationship between the forward node type and the backward node type, as well as the relationship between the forward node type set and the backward node type set, and determining whether to delete this node mapping relationship based on the judgment result.

[0016] With respect to the eighth possible implementation, in combination with the seventh possible implementation, the sixth possible implementation, the fifth possible implementation, the fourth possible implementation, the third possible implementation, the second possible implementation and the first aspect, a plurality of target nodes in the kill chains are searched, and the number of kill chains in which the target nodes are located is counted, including: traversing all target nodes in the plurality of kill chains, and recording the kill chain number of each node other than the target node in the combat system network.

[0017] For the ninth possible implementation, in combination with the seventh possible implementation, the sixth possible implementation, the fifth possible implementation, the fourth possible implementation, the third possible implementation, the second possible implementation and the first aspect, the kill chain is measured to obtain an importance value R, and a key node is determined based on the importance value R, including: obtaining an importance weight vector of multiple target nodes in the kill chain, determining the importance values ​​R of the multiple target nodes based on the multiple importance weight vectors, comparing the multiple importance values, and determining the key node based on the comparison result; the importance weight vector is Among them, the element The values ​​are between 0 and 1 and satisfy

[0018] The importance value R is determined based on the following formula:

[0019]

[0020] In a second aspect, a network key node identification device is provided, which is applied to a combat system network, wherein the combat system network is mainly composed of multiple nodes and multiple edges, and the nodes include weapons and equipment; including: a model construction module, used to model multiple nodes to obtain node models, used to model multiple edges to obtain edge models, and used to construct a combat system network model based on the node model and the edge model; a kill chain construction module, used to construct a kill chain model based on a target node; a state determination module, used to determine the state of the combat system network; a kill chain determination module, used to determine multiple kill chains containing specific targets in the combat system network based on the Ullmann algorithm; a statistical module, used to count the number of kill chains in which a node is located; a correlation determination module, used to obtain an importance value R; and a judgment module, used to judge key nodes based on the importance value.

[0021] A method and device for identifying key network nodes provided in an embodiment of the present application comprehensively consider the influence of different edge weights, the number of kill chains and the importance of target nodes in a combat system network, and analyze the importance of nodes by identifying nodes that have passed through more kill chains, important kill chains and important target kill chains in the combat system network as the fundamental entry point; the constructed node importance index can reflect the influence of heterogeneous combat elements such as performance differences of different equipment and the importance of strike targets, thereby realizing reasonable and effective identification of key nodes. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] The methods, systems and / or programs in the accompanying drawings will be further described according to exemplary embodiments. These exemplary embodiments will be described in detail with reference to the drawings. These exemplary embodiments are non-limiting exemplary embodiments, wherein example numbers represent similar mechanisms in the various views of the accompanying drawings.

[0024] Figure 1 is a flow chart of a method according to some embodiments of the present application;

[0025] Figure 2 is a flow chart of a method according to another embodiment of the present application;

[0026] Figure 3 is a schematic structural diagram of a device according to an embodiment of the present application;

[0027] Figure 4 It is a schematic diagram of the network model of the combat system for air interception missions;

[0028] Figure 5 This is a diagram of the combat system network obtained by a Monte Carlo sampling;

[0029] Figure 6 This is a comparison chart of the recognition effects of key nodes. DETAILED DESCRIPTION

[0030] In order to better understand the above technical scheme, the technical scheme of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical scheme of the present application, rather than limitations on the technical scheme of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0031] In the following detailed description, numerous specific details are set forth by way of example in order to provide a comprehensive understanding of the relevant guidance. However, it will be apparent to those skilled in the art that the present application may be practiced without these details. In other cases, well-known methods, procedures, systems, compositions and / or circuits have been described at a relatively high level, without detail, in order to avoid unnecessarily obscuring aspects of the present application.

[0032] Flowcharts are used in the present application to illustrate the execution process performed by the system according to the embodiment of the present application. It should be clearly understood that the execution process of the flowchart may not be performed in order. On the contrary, these execution processes may be performed in reverse order or simultaneously. In addition, at least one other execution process may be added to the flowchart. One or more execution processes may be deleted from the flowchart.

[0033] See also Figure 1 This embodiment provides a method for identifying key nodes of a combat system network, which is applied to a combat system network. The combat system network in this embodiment is mainly composed of multiple nodes and multiple edges. The nodes include weapons and equipment, including the following specific methods:

[0034] 101. Model multiple nodes and multiple edges, and construct a combat system network model based on the node model and the edge model, wherein the edge includes multiple paths formed between the nodes.

[0035] 101a. In this embodiment, the nodes are first modeled to obtain a node model. In this embodiment, modeling is to mathematically transform the concrete nodes, i.e., weapons and equipment, to establish a mathematical model, i.e., a collection of nodes.

[0036] The combat system in this embodiment is composed of weapons and equipment of both sides. In the combat system, the weapon and equipment entities can be mapped to nodes in the network. At the same time, according to the functional characteristics of different equipment, the combat system network nodes are divided into the following four categories:

[0037] (1) Reconnaissance nodes S: Their main mission is to detect, reconnaissance, and monitor enemy targets, obtain battlefield information, and transmit the information to other equipment nodes in the system.

[0038] (2) Decision-making node D: Its main combat task is to process and analyze the input battlefield information, make action decisions, transmit the decision information to other nodes and perform command and control.

[0039] (3) Impact node I: Its main combat mission is to exert influence on the equipment nodes in the enemy system to interfere with the normal operation of the enemy system, including firepower strike equipment and electronic jamming equipment.

[0040] (4) Target node T, namely the above three types of nodes in the enemy combat system network to be attacked.

[0041] The set of nodes available V = V S ∪V D ∪V I ∪V T Indicates that and are the collections of reconnaissance, decision, influence and target nodes respectively, n S 、n D 、n I and n T is the number of nodes of four categories.

[0042] 101b. Model multiple edges. Similar to node modeling, in this embodiment, edge modeling is to establish a mathematical model between the connection relationships of various weapons and equipment, that is, an edge model.

[0043] In this embodiment, edge modeling is mainly based on connecting different nodes in the node model in pairs to obtain an initial edge model, and the initial edge model is screened based on the target node type to obtain a target edge model.

[0044] In the combat system network of this embodiment, the edge is used to represent the relationship between equipment, and on the basis of the model, the edge is used to represent the relationship between nodes. In this embodiment, according to the type of node, there are 16 different types of edges, but considering the actual combat situation, usually only the following 7 types of edges are analyzed, namely:

[0045] The T→S edge is used to represent the reconnaissance and surveillance of enemy target nodes by the reconnaissance node;

[0046] The S→D edge is used to represent the information transmission activity from the reconnaissance node to the decision node;

[0047] The D→I edge is used to represent the operational activities of the decision node transmitting the decision instruction to the influencing node;

[0048] I→T edge is used to represent the combat activities such as fire strikes and electronic jamming of the influencing node against the enemy target node;

[0049] S→S edge, used to represent information sharing activities between reconnaissance nodes;

[0050] D→D edge is used to represent the collaborative command and collaborative decision-making activities between decision nodes;

[0051] The D→S edge is used to represent the combat activity of the decision node feeding back decision information to the reconnaissance node.

[0052] The edges in the combat system network are the embodiment of specific combat activities. Each combat activity has a different probability of success, which is closely related to the performance indicators of the nodes at both ends of the edge, and can be reflected by assigning weights to the edges. represents the tth directed edge in the network, e t The nodes at both ends are and Where X and Y represent the types of nodes, then edge e t The weight w t for:

[0053]

[0054] in and Node and h(·) is a set of performance indicators of nodes, and h(·) represents the mapping relationship between node performance indicators and weights, which can be obtained through mathematical analysis, simulation and other means, and its value range is between 0 and 1.

[0055] 101c. Construct a combat system network model based on the node model and edge model.

[0056] Based on the node model and edge model, a directed weighted network G = (V, E, W) can be used to represent the combat system, where V is the set of nodes. is the set of edges, W = {w t |e t ∈E} is the set of edge weights, n e is the number of edges.

[0057] 102. Based on the extraction of some nodes from the combat system network model as target nodes, multiple kill chain models are constructed based on the target nodes.

[0058] In this embodiment, the method mainly includes: constructing a link network G based on the target node set and the edge set l =(V l ,E l ), the link network is the kill chain G l , where V l is the target node set, where E l is the set of edges.

[0059] According to the "OODA loop" theory, the basis for the combat system to achieve effective strikes on enemy targets is that there is a continuous path in the system network that implements the "discovery-perception-decision-strike" action on the target node. In this embodiment, the above continuous path containing the target node is defined as a kill chain. According to the above definition, in the system network, the kill chain starts and ends with the target node. The standard form of the kill chain is: T→S→D→I→T, that is, a continuous path from the target node to the target node via the reconnaissance, decision-making, and influence nodes.

[0060] In this embodiment, there are mainly the following seven types of kill chains:

[0061]

[0062]

[0063] Table 1. Kill chain type table

[0064] 103. Perform multiple Monte Carlo sampling on the combat system network to determine the combat system network state vector x k .

[0065] In this embodiment, the combat system network state vector is a vector composed of element values ​​of multiple edges. k It includes determining the element values ​​of multiple edges, where the element values ​​are real numbers of 0 or 1. In this embodiment, 1 and 0 respectively indicate that the states of the edges are connected and unconnected, respectively representing completed and uncompleted combat activities.

[0066] In this embodiment, the method for determining the element value includes obtaining a random number of an edge corresponding to the sampling through Monte Carlo sampling, comparing the relationship between the random number of the corresponding edge and the edge weight, and determining the element value based on the comparison result.

[0067] In this embodiment, the comparison result includes: the random number is greater than the edge weight, and the random number is less than or equal to the edge weight.

[0068] When the random number is greater than the edge weight, the element value is 0, that is, the edge state is not connected, which is used to represent unfinished combat activities. When the random number is less than or equal to the edge weight, the element value is 1, that is, the edge state is not connected, which is used to represent completed combat activities.

[0069] In this embodiment, the method for calculating the element value of the corresponding edge includes:

[0070]

[0071] in, is the random number corresponding to the tth edge in the kth sampling, is the element value corresponding to the tth edge in the kth sampling, and K is the total number of samples;

[0072] The calculation method of the combat system network state vector includes:

[0073] Use X t represents the number of times the t-th edge state is connected in K samplings. According to Kolmogorov's strong law of large numbers, when K is large, X t / K is w t Therefore, a series of network states obtained by repeated Monte Carlo sampling can reflect the impact of differences in network edge weights. In this embodiment, after the above sampling process, the combat system network is transformed from a directed weighted network to a directed unweighted network, which is convenient for subsequent analysis.

[0074] 104. Based on the Ullmann algorithm, multiple kill chains containing specific targets in the combat system network are determined.

[0075] Specifically, in this embodiment, by constructing a search space based on the combat system network, the search space is screened for multiple kill chains containing specific targets.

[0076] In this embodiment, after obtaining a specific network state, it is necessary to search for all kill chains containing specific enemy targets. To this end, the seven modes of kill chains can be regarded as specific network structures, and the problem is transformed into a search problem for specific structures in the combat system network. Since the network can be described by a graph, the problem is further transformed into a search for a specific subgraph in the graph, that is, a subgraph isomorphism problem, and the Ullmann algorithm is introduced to solve it.

[0077] The following steps are involved:

[0078] 104a. Construct a mapping relationship matrix.

[0079] In this embodiment, the mapping relationship matrix is ​​constructed by constructing a node mapping relationship matrix through a kill chain model and a combat system network model.

[0080] use Indicates that the target node is included n T The adjacency matrix of the nth (n=1,2,…,7) type of kill chain is in and They are A collection of nodes and edges, is the number of nodes; G k =(V k ,E k ) represents the combat system network obtained by the kth sampling, and its adjacency matrix is where p k is the number of nodes in the network.

[0081] Define a (row)×p k 0-1 matrix of (columns) The elements Represents the initial mapping relationship between the kill chain and the nodes in the combat system network. Specifically: The i-th node in G k The type of the jth node in is the same, then Indicates that the two have a mapping relationship; otherwise, There is no mapping relationship between the two.

[0082] In this embodiment, since the importance of target nodes varies, the types of target nodes are refined in order: Only when the target node in the kill chain and the target node in the combat system have the same detailed type, will there be a mapping relationship between the two.

[0083] 104b. If If some mapping relationships in do not meet certain conditions, the corresponding mapping relationships should be removed to reduce the search space. In this embodiment, the search space is reduced by pruning the node mapping relationship matrix.

[0084] This embodiment constructs the following pruning optimization algorithm based on the connection relationship between different types of nodes in the kill chain and combat system network:

[0085]

[0086] Among them, m ij Represents the node mapping relationship matrix after pruning The above pruning algorithm implements pruning according to the neighbor node type of the combat node, and finally outputs the mapping relationship matrix M after pruning. l .

[0087] 104c. Screening of kill chains for specific targets in a mapping relationship matrix based on isomorphic relationships.

[0088] The specific method includes: extracting multiple single node mapping relationship matrices from the node mapping relationship matrix, determining the isomorphic relationship between the multiple single node mapping relationship matrices and the kill chain and combat system network, and determining the kill chain containing the target based on the isomorphic relationship.

[0089] Define a l 0-1 matrices with the same structure Provision M′ l There is only one 1 in each row, no more than one 1 in each column, and when m′ ij 1 hour m ij Must be 1 to represent M l A kill chain and combat system network G k The specific mapping relationship. At the same time, define the matrix C:

[0090]

[0091] Where T stands for transpose.

[0092] According to the isomorphism judgment rule of Ullmann algorithm, if:

[0093]

[0094] Then M′l represents a target graph and query graph G k The isomorphic relationship between them is that a node containing the target node T is found in the combat system network. l The nth type of kill chain.

[0095] To obtain G k All included The nth type of kill chain needs to be enumerated using a depth-first search algorithm. l All possible M′ l The algorithm is based on the idea of ​​backtracking and recursion. lStarting from the "1" element in the first row, traverse M in the depth (row) direction. l The "1" element in M′ l The formation conditions; if the current depth reaches Then output the searched M′ l , and backtrack to other unsearched elements at the previous depth until M is completed. l Traverse all "1" elements in .

[0096] On this basis, the isomorphism judgment rules are used to screen out M′ that meets the conditions. l , thus completing the search for the specified nth type of kill chain. Finally, traversing the value of n, we can achieve the search for the node containing the target node. Get all the kill chains.

[0097] 105. Search for target nodes in multiple kill chains and count the number of kill chains the node is in.

[0098] The method includes: determining whether to traverse all target nodes in multiple kill chains, and recording the kill chain number of each node other than the target node in the combat system network.

[0099] If all target nodes in the multiple kill chains are not traversed, the process of 104 is repeated.

[0100] For example, traverse all target nodes in multiple kill chains and record the kill chain number of each node in the combat system network G except the target node in the kth sampling. Indicates the target node where a node is located in the kth sampling The number of kill chains for the target node Then only record whether there is a Kill chain and use Indicates that the kth sampling contains The existence of the kill chain, if it exists on the contrary

[0101] 106. Measure the kill chain, obtain importance values ​​R of multiple target nodes, and determine key nodes based on the importance values ​​R.

[0102] The method comprises: obtaining importance weight vectors of multiple target nodes in a kill chain, determining importance values ​​R of multiple target nodes based on multiple importance weight vectors, comparing multiple importance values, and determining key nodes based on the comparison results.

[0103] After completing K repeated Monte Carlo sampling of the network state, due to the differences in the importance of enemy target nodes, the nodes in the kill chain passing through important targets are relatively critical. Therefore, it is assumed that n T The importance weight vector of the target node is w T Elements in The values ​​are between 0 and 1 and satisfy

[0104] The importance of nodes in G can be measured by the indicator R:

[0105]

[0106] The larger the R value of a node in the combat system network G, the greater the role it plays in forming a kill chain with a higher probability against most target nodes or important target nodes, and the more critical it is relative to other nodes, thereby completing the identification of key nodes.

[0107] 107. Analyze the recognition effect of key nodes.

[0108] The recognition effect is reflected by comparing the method for identifying key network nodes provided by this embodiment with the existing key node identification method.

[0109] Specifically, it includes: using the method for identifying key network nodes provided by this embodiment and other existing methods to obtain the node importance in the combat system network, repeatedly removing the node ranked first in importance obtained by different methods and the edges connected to the node, and comparing the changes in the combat system network effectiveness before and after the removal. The greater the degree of reduction in effectiveness, the better the identification effect of the corresponding method. Among them, the calculation method of the combat system network effectiveness Ef is:

[0110]

[0111] This embodiment also provides a combat system network key node identification device 100, which is applied to a combat system network, wherein the combat system network is mainly composed of multiple nodes and multiple edges, wherein the nodes include weapons and equipment.

[0112] The system comprises: a model building module 110, which is used to model multiple nodes to obtain a node model, to model multiple edges to obtain an edge model, and to build a combat system network model based on the node model and the edge model; a kill chain building module 120, which is used to build a kill chain model based on the target node; a state determination module 130, which is used to determine the state of the combat system network; a kill chain determination module 140, which is used to determine multiple kill chains containing specific targets in the combat system network based on the Ullmann algorithm; a statistical module 150, which is used to count the number of kill chains in which the node is located; a correlation determination module 160, which is used to obtain an importance value R; and a judgment module 170, which is used to judge the key node based on the importance value.

[0113] In one or more embodiments, a terminal device is disclosed, including a server, the server including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements a signal reconstruction method based on sparse reconstruction when executing the program. For the sake of brevity, it will not be described here.

[0114] It should be understood that in the present embodiment, "module" may include a unit implemented in the form of hardware, software or firmware, and may be used interchangeably with other terms such as "logic", "logic block", "component" and "circuit". A module may be a single integrated component or the smallest unit or component of the single integrated component suitable for performing one or more functions. For example, according to an embodiment, a module may be implemented in the form of an application-specific integrated circuit (ASIC).

[0115] A computer readable signal medium may include a propagated data signal containing computer program code, such as in baseband or as part of a carrier wave. The propagated signal may have a variety of manifestations, including electromagnetic, optical, etc., or a suitable combination. A computer readable signal medium may be any computer readable medium other than a computer readable storage medium, which may be connected to an instruction execution system, device or apparatus to communicate, propagate or transmit a program for use. The program code on the computer readable signal medium may be propagated through any suitable medium, including radio, cable, fiber optic cable, RF, or similar medium, or a combination of any of the above mediums.

[0116] The computer program code required for the execution of various aspects of the present application can be written in any combination of one or more programming languages, including object-oriented programming, such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, C#, VB.NET, Python, etc., or similar conventional programming languages, such as "C" programming language, Visual Basic, Fortran2003, Perl, COBOL 2002, PHP, ABAP, dynamic programming languages ​​such as Python, Ruby and Groovy or other programming languages. The programming code can be executed entirely on the user's computer, or as an independent software package on the user's computer, or partially on the user's computer and partially on the remote computer, or completely on the remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any network form, such as a local area network (LAN) or a wide area network (WAN), or connected to an external computer (e.g., via the Internet), or in a cloud computing environment, or used as a service such as software as a service (SaaS).

[0117] Example 1

[0118] Specific embodiments are given below to further illustrate the technical solution.

[0119] The Red and Blue sides had a military conflict over sovereignty issues. The Blue side sent an air assault formation consisting of 5 fighter jets of various types to raid the Red side's targets. The Red side relied on its own combat system consisting of 20 pieces of various equipment to intercept the Blue assault formation. For this typical air interception mission, the key equipment nodes in the Red side's combat system were identified.

[0120] Step 1: Model the nodes and edges in the combat system network and build a network model of the combat system.

[0121] See also Figure 4 , a combat system network diagram is given. According to the functional characteristics and correlation of various equipment in combat missions, the combat system is mapped into a combat system network. Among them, the target nodes T1~T5 represent the 5 fighters of various types of the blue side, the reconnaissance nodes S1~S7, the decision nodes D1~D6, and the influence nodes I1~I7 represent the 20 different functional equipment of the red side. For the convenience of display, Figure 4 The target node T is split into source nodes and sink nodes, which inherit the inflow and outflow edges of the corresponding target nodes respectively.

[0122] Next, weights are assigned to the edges based on expert experience: except for the edges listed in Table 2, the weights of T→S edges are all 0.5, the weights of S→D edges are all 0.8, the weights of D→I edges are all 0.9, the weights of I→T edges are all 0.6, and the weights of S→S, D→S, and D→D edges are all 1.

[0123] side Weight side Weight T3→S1 0.3 S4→D4 0.9 T3 → S3 0.9 D4→I5 0.5 T3→S6 0.8 I2→T3 0.7 T4 → S4 0.9 I4→T4 0.8 T4→S5 0.7 I1→T3 0.8 S3 → D3 0.9

[0124] Table 2. Weights of some edges

[0125] Step 2: Based on the weights of the network edges, the specific status of the combat system network is obtained through Monte Carlo sampling.

[0126] According to the weight of the network edge of the combat system, the specific network state x obtained by Monte Carlo sampling at a certain time k Combat system network G k like Figure 5 shown.

[0127] Step 3: Use the Ullmann algorithm to search for all kill chains that include a specific target.

[0128] Step 3.1: Generate an initial node mapping set based on the node type.

[0129] The third type of kill chain includes the target node T3 (T3→S→D→D→I→T3) is used as an example for analysis. The nodes are numbered 5, 1, 2, 3, and 4. k The nodes are numbered as follows: S1 to S7 are 1 to 7, D1 to D6 are 8 to 13, I1 to I7 are 14 to 20, and T1 to T5 are 21 to 25. On this basis, the initial mapping relationship matrix can be obtained according to the node type: for:

[0130]

[0131] Step 3.2: Apply the improved pruning optimization algorithm to the initial node mapping set to narrow the search space.

[0132] The pruning optimization algorithm proposed in this invention is used to After pruning, the mapping relationship matrix M3 obtained after pruning is:

[0133]

[0134] Step 3.3: Obtain the entire kill chain containing specific targets in the combat system network through depth-first search and isomorphism judgment rules.

[0135] Perform a depth-first search on M3 to obtain all specific mapping relationships M′3. Take an M′3 obtained during the search as an example:

[0136]

[0137] The corresponding matrix C is:

[0138]

[0139] Also because The adjacency matrix of for:

[0140]

[0141] It can be seen that the searched M′3 satisfies the isomorphism rule, and thus a kill chain T3→S3→D2→D1→I1→T3 that meets the requirements is obtained. After the above search process is completed, the third type of kill chain that contains all target nodes T3 can be obtained.

[0142] Next, we search for other types of kill chains that include target node T3 and obtain G k The entire kill chain of T3 is included, and the results are shown in Table 3.

[0143]

[0144]

[0145] Table 3. All kill chains of Gk containing T3

[0146] Step 4: Traverse all target nodes and count the number of kill chains the nodes are in.

[0147] By statistically analyzing the results in Table 3, we can obtain the number of times all nodes except the target node are in the kill chain containing T3, as shown in Table 4. The number of times the nodes not listed are all 0.

[0148] node S3 S6 S7 D1 D2 D3 D5 D6 I1 I2 I3 I7 frequency 6 4 2 2 4 2 3 3 3 2 1 4

[0149] Table 4. Number of times a node is in a kill chain containing T3

[0150] In addition, due to the presence of the T3 kill chain, .

[0151] Next, by traversing all target nodes, we can obtain the number of kill chains of each node in the combat system network Gk, as shown in Table 5.

[0152] node S1 S2 S3 S4 S5 S6 S7 D1 D2 D3 frequency 9 10 6 1 5 4 10 12 17 2 node D4 D5 D6 I1 I2 I3 I4 I5 I6 I7 frequency 1 12 3 8 2 1 1 0 13 7

[0153] Table 5. Number of kill chains for each node in Gk

[0154] Further, according to the existence of the kill chain containing the target node, we can get:

[0155] Step 5: Repeat the Monte Carlo sampling of network status K times, comprehensively consider the number of kill chains the node is in and the importance of the enemy target, and identify the key nodes in the combat system network.

[0156] Let K = 100, and specify the importance weight vector w of the target node T =(0.05, 0.1, 0.5, 0.3, 0.05), repeat steps 2 to 4 for K times, on this basis, the importance (R value) of each node other than the target node can be obtained, as shown in Table 6.

[0157]

[0158]

[0159] Table 6. Importance values ​​of other nodes besides the target node

[0160] According to the results, the D2 node plays the most important role in the combat system, and the importance of other nodes in this state can be ranked according to specific values.

[0161] Step 6: Analyze the recognition effect of key nodes.

[0162] The recognition effect of the present invention is compared and analyzed by using the existing key node identification methods such as degree, betweenness, and the number of "OODA loops" in which the node is located. By repeating steps 2 to 5, the nodes with the largest importance values ​​and their edges under different methods are removed each time until the network efficiency of the combat system drops to 0. The final result is as follows: Figure 6 And as shown in Table 7.

[0163]

[0164] Table 7. Nodes removed by different methods in turn

[0165] It can be seen from the obtained results that, due to the comprehensive consideration of the influence of edge weights and target node importance, after removing the key nodes identified by the present invention, the network efficiency of the combat system decreases at the fastest rate, with better recognition effect.

[0166] The above contents disclosed in the embodiments of the present application are clear and complete for those skilled in the art. It should be understood that the process of deducing and analyzing the unexplained technical terms based on the above disclosed contents by those skilled in the art is based on the contents recorded in the present application, and therefore the above contents are not a judgment on the creativity of the overall solution.

[0167] The basic concepts have been described above. Obviously, for those skilled in the art, the above detailed disclosure is only for example and does not constitute a limitation of the present application. Although not explicitly stated herein, those skilled in the art may make various modifications, improvements and amendments to the present application. Such modifications, improvements and amendments are suggested in the present application, so such modifications, improvements and amendments still belong to the spirit and scope of the exemplary embodiments of the present application.

[0168] At the same time, the present application uses specific terms to describe the embodiments of the present application. For example, "one embodiment", "an embodiment", and / or "some embodiments" refer to a certain feature, structure or characteristic related to at least one embodiment of the present application. Therefore, it should be emphasized and noted that "one embodiment" or "an embodiment" or "an alternative embodiment" mentioned twice or more in different parts of this specification does not necessarily refer to the same embodiment. In addition, some features, structures or characteristics in at least one embodiment of the present application can be appropriately combined.

[0169] In addition, it will be appreciated by those skilled in the art that various aspects of the present application may be illustrated and described by a number of patentable categories or situations, including any new and useful process, machine, product or combination of substances, or any new and useful improvements thereto. Accordingly, various aspects of the present application may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as a "unit", "component" or "system". In addition, various aspects of the present application may be represented as a computer product located in at least one computer-readable medium, the product including a computer-readable program code.

[0170] In addition, unless expressly stated in the scope of the patent application, the order of the processing elements and sequences described in this application, the use of digital letters, or the use of other names are not intended to limit the order of the processes and methods of this application. Although the above disclosure discusses some invention embodiments that are currently considered useful through various examples, it should be understood that such details are only for illustrative purposes, and the attached patent scope is not limited to the disclosed embodiments. On the contrary, the scope of the patent application is intended to cover all modifications and equivalent combinations that are consistent with the essence and scope of the embodiments of the present application. For example, although the system components described above can be implemented by hardware devices, they can also be implemented only by software solutions, such as installing the described system on an existing server or mobile device.

[0171] It should also be understood that in order to simplify the description disclosed in this application and thus help understand at least one embodiment of the invention, in the above description of the embodiments of the application, multiple features are sometimes combined into one embodiment, figure or description thereof. However, this disclosure method does not mean that the features required by the object of the application are more than the features mentioned in the claims. In fact, the features of the embodiment are less than all the features of the single embodiment disclosed above.

Claims

1. A method for identifying key nodes in a combat system network, characterized in that: Applied to a combat system network, the combat system network is mainly composed of multiple nodes and multiple edges, the nodes include weapons and equipment, The following methods are included: Modeling the plurality of nodes and the plurality of edges, and constructing a combat system network model based on the node model and the edge model, wherein the edges include a plurality of paths formed between the nodes; Extracting some nodes from the combat system network model as target nodes, and constructing multiple kill chain models based on the target nodes; Perform multiple Monte Carlo sampling on the combat system network to determine the combat system network state vector x k ; Based on the Ullmann algorithm, determining multiple kill chains containing specific targets in the combat system network; Searching for target nodes in a plurality of the kill chains, and counting the number of kill chains in which the nodes are located; Measuring the kill chain to obtain importance values ​​R of multiple target nodes, and determining key nodes based on the importance values ​​R; Wherein, determining a plurality of kill chains containing specific targets in the combat system network includes: constructing a search space based on the combat system network, and screening the plurality of kill chains containing specific targets in the search space; The method for constructing the search space includes constructing a mapping relationship matrix, and the screening of multiple kill chains includes obtaining isomorphic relationships in the mapping relationship matrix, and determining a kill chain containing a specific target based on the isomorphic relationships; The constructing of the mapping relationship matrix includes: constructing a node mapping relationship matrix based on the kill chain model and the combat system network model; The method of determining a kill chain including a specific target based on an isomorphic relationship includes: extracting multiple single node mapping relationship matrices from the node mapping relationship matrix, determining the isomorphic relationship between the multiple single node mapping relationship matrices and the kill chain and combat system network, and determining the kill chain including the target based on the isomorphic relationship.

2. The method for identifying key nodes in a combat system network according to claim 1, characterized in that: Modeling the plurality of nodes includes: establishing nodes of the combat system network according to a mapping relationship with combat entities or entity components in the combat system network, wherein the nodes include reconnaissance nodes, decision nodes, influence nodes, and target nodes; Modeling the edge includes: connecting different nodes in the node model in pairs to obtain an initial edge model, and filtering the initial edge model based on a target node type to obtain a target edge model; Constructing a combat system network model includes: constructing a directed weighted network based on a node set, an edge set and an edge weight set, wherein the directed weighted network is G=(V, E, W), where V is a node set, E is an edge set, and W is an edge weight set.

3. The method for identifying key nodes in a combat system network according to claim 2, characterized in that: The node set is V=V S ∪V D ∪V I ∪V T ,in For reconnaissance nodes, For decision nodes, To affect the class nodes and is the target class node, where n S 、n D 、n I and n T is the number of nodes; the edge set is Where n e is the number of edges, where is the tth directed edge in the combat system network, and for e t The nodes at both ends; the edge weight set is W = {w t |e t ∈E}, w t For edge e t The weight of and Node and is a set of performance indicators, and h(·) represents the mapping relationship between node performance indicators and weights.

4. The method for identifying key nodes in a combat system network according to claim 3, characterized in that: The combat system network state vector is a vector composed of the element values ​​of multiple edges. Determine the combat system network state vector x k The method comprises determining element values ​​of a plurality of edges, wherein the element values ​​are real numbers of 0 or 1; The method for determining the element value includes obtaining a random number of an edge corresponding to the sampling through Monte Carlo sampling, comparing the relationship between the random number of the corresponding edge and the edge weight, and determining the element value based on the comparison result; The comparison result includes: the random number is greater than the edge weight, and the random number is less than or equal to the edge weight; when the random number is greater than the edge weight, the element value is 0, and when the random number is less than or equal to the edge weight, the element value is 1; The calculation method of the element value of the corresponding edge includes: Among them, r t k is the random number corresponding to the tth edge in the kth sampling, is the element value corresponding to the tth edge in the kth sampling, and K is the total number of samples; The calculation method of the combat system network state vector includes:

5. The method for identifying key nodes in a combat system network according to claim 4, characterized in that: Constructing multiple kill chain models based on the target node includes: Construct a link network G based on the target node set and the edge set l =(V l ,E l ), the link network is the kill chain G l , where V l is the target node set, where E l is a set of edges, where l is the number of the target.

6. The method for identifying key nodes in a combat system network according to claim 5, characterized in that: The construction of the mapping relationship matrix also includes search space optimization, including: respectively obtaining the forward node type and backward node type of the corresponding nodes in the kill chain model and the combat system network, as well as the forward node type set and the backward node type set, judging the relationship between the forward node type and the backward node type, and the relationship between the forward node type set and the backward node type set, and determining whether to delete this node mapping relationship based on the judgment result.

7. The method for identifying key nodes in a combat system network according to claim 6, characterized in that: Searching for target nodes in multiple kill chains and counting the number of kill chains in which the target nodes are located includes: traversing all target nodes in multiple kill chains and recording the kill chain numbers of other nodes in the combat system network except the target nodes.

8. The method for identifying key nodes in a combat system network according to claim 6, characterized in that: Measuring the kill chain to obtain an importance value R, and determining a key node based on the importance value R, including: obtaining an importance weight vector of multiple target nodes in the kill chain, determining the importance values ​​R of the multiple target nodes based on the multiple importance weight vectors, comparing the multiple importance values, and determining the key node based on the comparison result; The importance weight vector is Among them, the element The values ​​are between 0 and 1 and satisfy The importance value R is determined based on the following formula:

9. A device for identifying key nodes in a combat system network, characterized in that: Applied to a combat system network, the combat system network is mainly composed of multiple nodes and multiple edges, the nodes include weapons and equipment; including: A model building module, used for modeling multiple nodes to obtain a node model, used for modeling multiple edges to obtain an edge model, and used for building a combat system network model based on the node model and the edge model; Kill chain building module, used to build a kill chain model based on the target node; A status determination module is used to determine the network status of the combat system; The kill chain determination module is used to determine multiple kill chains containing specific targets in the combat system network based on the Ullmann algorithm; Statistics module, used to count the number of kill chains a node is in; A relevance determination module, used to obtain an importance value R; A judgment module, used for judging key nodes based on importance values; Among them, the kill chain determination module is specifically used to: construct a search space based on the combat system network, and screen the search space for multiple kill chains containing specific targets; the search space construction method includes constructing a mapping relationship matrix, and the screening of multiple kill chains includes obtaining isomorphic relationships in the mapping relationship matrix, and determining the kill chain containing the specific target based on the isomorphic relationship; the construction of the mapping relationship matrix includes: constructing a node mapping relationship matrix based on the kill chain model and the combat system network model; the determination of the kill chain containing the specific target based on the isomorphic relationship includes: extracting multiple single node mapping relationship matrices in the node mapping relationship matrix, judging the isomorphic relationship between the multiple single node mapping relationship matrices and the kill chain and the combat system network, and determining the kill chain containing the target based on the isomorphic relationship.

Images