An effectiveness evaluation method based on modeling of an anti-system-of-systems kill chain
By constructing a three-dimensional network model of the kill chain of an adversarial system and combining it with the analytic hierarchy process, a rapid and accurate assessment of the effectiveness of complex adversarial systems was achieved, providing an important reference for decision-making and solving the problem of assessing the strike effectiveness of adversarial systems.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- HARBIN ENG UNIV
- Filing Date
- 2023-11-01
- Publication Date
- 2026-05-26
AI Technical Summary
Existing technologies are insufficient to effectively assess the effectiveness of complex adversarial systems, especially in modern conditions where there is a lack of rapid and accurate methods for evaluating the strike effectiveness of adversarial systems.
By modeling the kill chain of the adversarial system, an adversarial network with three dimensions of time, information, and accuracy is constructed. The analytic hierarchy process (AHP) is used to evaluate the effectiveness of the network. The evaluation results of time, information, and accuracy are combined and weighted to form a comprehensive evaluation of the adversarial effectiveness.
It enables quantitative evaluation of the effectiveness of the adversarial system, provides a basis for decision-making, highlights the impact of time, information, and precision dimensions on adversarial effectiveness, and solves the problem of evaluating the strike effectiveness of the kill chain under complex adversarial systems.
Smart Images
Figure CN117473751B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of system evaluation technology, and more specifically, relates to an effectiveness evaluation method based on the modeling of the kill chain of an adversarial system. Background Technology
[0002] With the development of information technology and intelligence in equipment systems, the interrelationships between equipment are becoming increasingly diverse. A system is an integration of a finite number of component systems that are independent and operational, and interconnected over a period of time to achieve a higher objective. An adversarial system is one manifestation of a system. However, due to the extreme complexity of adversarial systems, applying system models to actual adversarial processes requires extensive research. How to study the effectiveness evaluation of adversarial systems is a pressing issue that researchers need to address. Summary of the Invention
[0003] To address the aforementioned issues, the purpose of this invention is to expand the existing research on the effectiveness of countermeasure systems. It proposes an effectiveness assessment method that facilitates rapid and effective evaluation of strike effectiveness, serving the evaluation and simulation of system strike effectiveness in complex countermeasure contexts under modern conditions. This provides necessary technical support for countermeasure system research and offers research references for equipment development.
[0004] To achieve the above technical objectives, this application provides a performance evaluation method based on adversarial system kill chain modeling, comprising the following steps:
[0005] Based on the given start and end conditions of the task, in the time dimension, each interaction process of the task is taken as the first node, and the logic and time constraints between the first nodes are obtained. In the information dimension, the interaction units participating in the task are taken as the second node, and the information transmission path between the second nodes is obtained. In the accuracy dimension, each interaction process that affects the accuracy of task completion is taken as the third node, and the influence coefficient of each third node on task completion is obtained.
[0006] Based on the preceding and following logic, time constraints, information transmission paths, and influence coefficients, and according to the correspondence between the first, second, and third nodes, the adversarial interactive network with a time dimension is formed by connecting the events in the task process in the order they occur.
[0007] Based on adversarial interaction networks, the effectiveness of the task process is evaluated in terms of time, information, and accuracy. The analytic hierarchy process is used to analyze the adversarial effectiveness in different dimensions and to assign scores to the evaluation results in different dimensions.
[0008] The scores from different dimensions of the evaluation results are weighted and integrated to obtain a comprehensive evaluation result of the countermeasure effectiveness.
[0009] Preferably, in the process of obtaining the preceding and following logic and time constraints, the preceding and following logic and time constraints between the first nodes are obtained by obtaining the action sequence of each first node, the time constraints of each first node in the task process, and the time constraints of each first task stage in the entire process and the task process.
[0010] Preferably, in the process of obtaining the information transmission path, the node type of each second node in the information dimension and the probability of the information node failing during the task are obtained, and output and input interfaces for information transmission are planned between each node for a single node, thereby generating the information transmission path between the second nodes.
[0011] Preferably, in the process of obtaining the influence coefficient, the influence coefficient of the third node on the completion of the task is obtained by acquiring the baseline probability of each third node completing the corresponding task, the action order of each third node, the logical sequence between the third nodes, the influence coefficient of whether the preceding node occurs on the probability of the subsequent node occurring, and the influence coefficient of whether the subsequent node occurs on the probability of the preceding node occurring.
[0012] Preferably, in the process of constructing the adversarial network, in the time dimension, each first node is connected according to the task start and end conditions, the logical sequence between nodes, and the time constraints between nodes to form the first adversarial network in the time dimension.
[0013] Preferably, in the process of constructing the adversarial network, based on the first adversarial network, in the information dimension, each second node is connected sequentially according to the task start and end conditions, the output and input interfaces for information transmission between nodes by a single node, and the main paths for information transmission between nodes during the task process, to form a second adversarial network with a time dimension.
[0014] Preferably, in the process of constructing the adversarial network, based on the second adversarial network, in terms of precision, each third node is connected sequentially according to the task start and end conditions, the action order of each third node, and the logical sequence between the third nodes, in the order of the events in the task process to form an adversarial network with a time dimension.
[0015] Preferably, in the process of performance evaluation through adversarial networks, the adversarial network is used to analyze the time flexibility of the task process, the total time spent in adversarial operations, and the time conflicts in the task process in the time dimension.
[0016] The time flexibility of a task process is represented by the difference between the upper bound of the total task time window constraint interval and the sum of the lower bounds of the time constraints intervals for all adversarial processes that need to be completed within the task. It is denoted as... For the time flexibility of the r-th kill chain during the mission, ∑t is the upper bound of the time window constraint interval for the total time of tasks on this kill chain. l This is the sum of the lower bounds of the time constraints for all adversarial processes that need to be completed within the time chain of tasks.
[0017] The total time taken during the task process represents the total time taken from the start to the end of the task.
[0018] The task process time conflict situation indicates the number of time conflicts between the time constraints that oppose the entire process and the time constraints of each stage of the task, and the time constraints generated by the sum of the time constraints of each node in the entire process and each stage of the task.
[0019] Preferably, in the performance evaluation process using adversarial networks, the resilience of information transmission during the task process is analyzed in the information dimension using adversarial networks. Here, information transmission resilience represents the ability of the information transmission link in the corresponding task process to maintain connectivity when subjected to external attacks, denoted as... For the survivability of the k-th information transmission chain during the mission, CL k This represents the total number of nodes traversed in the information transmission chain. This represents the probability that the information transmission chain will be attacked and broken.
[0020] Preferably, in the performance evaluation process using adversarial networks, the adversarial network is used to analyze the strike accuracy index, first-order effect accuracy sensitivity coefficient, and total effect accuracy sensitivity coefficient of the mission process in terms of accuracy dimension. The strike accuracy index represents the success probability of closing the kill chain in the current mission process, calculated by the accuracy-affected network. The first-order effect accuracy sensitivity coefficient and the total effect accuracy sensitivity coefficient represent the degree of influence of different accuracy parameters on the final result during the mission process. The first-order effect accuracy sensitivity coefficient is denoted as... The overall effect precision sensitivity coefficient is denoted as
[0021] The present invention discloses the following technical effects:
[0022] Compared with existing technologies, this invention can quantitatively evaluate the countermeasure effectiveness of the countermeasure system, making it easier for decision-makers to make the best choice;
[0023] This invention fully considers the influence of each node in the adversarial system on the system's effectiveness, highlights the significant impact of the kill chain of the adversarial system on adversarial effectiveness in terms of time, information, and accuracy, and solves the problem of evaluating the strike effectiveness of kill chains formed by different kill methods under complex adversarial systems. Attached Figure Description
[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0025] Figure 1 This is a schematic diagram of the time conflict detection method described in this invention;
[0026] Figure 2 This is a schematic diagram illustrating the detailed indicators of the analytic hierarchy process (AHP) for analyzing the effectiveness of countermeasures as described in this invention.
[0027] Figure 3 This is a schematic diagram illustrating an example of the output results of analyzing the effectiveness of adversarial analysis using the analytic hierarchy process as described in this invention.
[0028] Figure 4 This is a schematic diagram of the method described in this invention. Detailed Implementation
[0029] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.
[0030] like Figure 1-4 As shown, this invention provides a performance evaluation technique based on kill chain modeling of adversarial systems, specifically including the following process:
[0031] Step 1: Perform feature analysis on the kill chain hypernetwork model of the task process according to the three dimensions of time, information, and precision to obtain the correspondence between each node in the task process in the dimensions of time, information, and precision.
[0032] The specific steps for performing feature analysis on the kill chain hypernetwork model according to the three dimensions of time, information, and accuracy include:
[0033] Throughout the task, obtain the task start and end conditions.
[0034] In the time dimension, each adversarial process of the task is taken as an adversarial node, and the action sequence of each node is obtained, the time constraints of each node in the task process, the time constraints of the entire adversarial process and each adversarial stage in the task process are obtained; the preceding and following logic between nodes and the time constraints between nodes are obtained.
[0035] In the information dimension, each attacking unit participating in information interaction during the mission is regarded as an adversarial node. The node type of each node in the information dimension is obtained (including five categories: target node (T), information acquisition (C), information processing (P), information transmission (Tr), information use (U), and influencing node (I)). The probability of information nodes failing during the mission is also considered. The output and input interfaces of a single node for information transmission between nodes are also considered. The main paths of information transmission between nodes during the mission are also considered.
[0036] In terms of accuracy, each adversarial process that affects the accuracy of task completion is taken as an adversarial node. The baseline probability of each node completing the corresponding task, the action order of each node, the logic between nodes, the influence coefficient of whether the preceding node occurs on the probability of the subsequent node, and the influence coefficient of whether the subsequent node occurs on the probability of the preceding node.
[0037] Step 2: Based on the correspondence between nodes, construct an adversarial network with time, information, and precision dimensions;
[0038] In the time dimension, each adversarial node is connected according to the task start and end conditions, the logic between nodes, and the time constraints between nodes to form a time-dimensional adversarial network.
[0039] In the information dimension, each adversarial node is connected in the order of information transmission during the task, based on the task start and end conditions, the output and input interfaces of a single node for information transmission between nodes, and the main paths of information transmission between nodes during the task, to form a time-dimensional adversarial network.
[0040] In terms of precision, each adversarial node is connected sequentially according to the task's start and end conditions, the order of each node's actions, and the logical sequence between nodes, forming a time-dimensional adversarial network.
[0041] Step 3: Based on the formed adversarial network, analyze the time flexibility, total adversarial time, and time conflict of the mission process in the time dimension; analyze the information transmission resilience of the mission process in the information dimension; and analyze the strike accuracy index, first-order effect accuracy sensitivity coefficient, and total effect accuracy sensitivity coefficient of the mission process in the accuracy dimension. Form an effectiveness assessment of the mission process in the time, information, and accuracy dimensions respectively.
[0042] The time flexibility of the task process is represented by the difference between the upper bound of the total task time window constraint interval and the sum of the lower bounds of the time constraint intervals for all strike processes to be completed within the task, denoted as . For the time flexibility of the r-th kill chain during the mission, ∑t is the upper bound of the time window constraint interval for the total time of tasks on this kill chain. l This is the sum of the lower bounds of the time constraints for completing all strike processes within the task on this time chain.
[0043] The total time taken during the mission process represents the total time taken from the start to the end of the mission.
[0044] The time conflict situation in the mission process indicates the number of time conflicts between the time constraints of the entire attack process and each attack phase in the mission process, and the time constraints generated by summing the time constraints of the entire process and each node in each phase of the mission process.
[0045] The resilience of information transmission during a task process refers to the ability of the information transmission link during the corresponding task process to maintain connectivity when subjected to external attacks, denoted as . For the survivability of the k-th information transmission chain during the mission, CL k This represents the total number of nodes traversed in the information transmission chain. This represents the probability that the information transmission chain will be attacked and broken.
[0046] The accuracy index, represented by the probability of a successful kill chain closure during the current mission, is calculated from the accuracy impact network.
[0047] The first-order effect precision sensitivity coefficient and the total effect precision sensitivity coefficient of the task process represent the degree of influence of different precision parameters on the final result during the task process. Given a form Y = f(X1, X2, ..., X...),... k The model is given, where Y is a scalar and X is a parameter. i The first-order effect based on variance can be expressed as: In the formula, X ～i Indicates the difference between X and X i The matrix of all external factors; Indicates in X i With Y remaining constant, the mean of X ～i The value in space. V(Y) is the unconditional variance of the output value. The first-order effect precision sensitivity coefficient is denoted as... The overall effect precision sensitivity coefficient is denoted as In the formula, To calculate the residuals.
[0048] Step 4: Combining the time, information, and accuracy dimensions to evaluate the effectiveness of the task process, the Analytic Hierarchy Process (AHP) is used to analyze the effectiveness of the adversarial process in different dimensions, and scores are assigned to the evaluation results in different dimensions.
[0049] Among them, the method used for performance evaluation is the Analytic Hierarchy Process (AHP). Through comparative analysis and expert experience, different analysis results under the same analysis dimension are scored. Each key indicator is scored in a scoring format of 1-6, and the evaluation result of the task process confrontation effectiveness is output. The task process confrontation effectiveness is evaluated according to the score.
[0050] Step 5: Weight and integrate the scores of the time, information, and accuracy dimensions to obtain a comprehensive evaluation result of the combat effectiveness.
[0051] Based on the actual needs of the mission, reference weights for time, information, and accuracy are defined. The output results of time, information, and accuracy obtained in step four are integrated with their respective reference weights to obtain a comprehensive evaluation result of the combat effectiveness, which serves as a reference for the effectiveness of the kill chain strike.
[0052] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0053] In the description of this invention, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.
[0054] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.
Claims
1. A performance evaluation method based on kill chain modeling of adversarial systems, characterized in that, Includes the following steps: Based on the given start and end conditions of the task, in the time dimension, each interaction process of the task is taken as the first node, and the logic and time constraints between the first nodes are obtained. In the information dimension, the units participating in the task are taken as the second node, and the information transmission path between the second nodes is obtained. In the accuracy dimension, each interaction process that affects the accuracy of task completion is taken as the third node, and the influence coefficient of each third node on task completion is obtained. Based on the aforementioned logic, time constraints, information transmission paths, and influence coefficients, and according to the correspondence between the first node, the second node, and the third node, an adversarial network with a time dimension is formed by connecting them sequentially according to the order in which the events in the task process occur. Based on the adversarial network, the effectiveness of the adversarial task process is evaluated in terms of time, information, and accuracy. The analytic hierarchy process is used to analyze the adversarial effectiveness in different dimensions, and the evaluation results in different dimensions are scored. The scores from different dimensions of the evaluation results are weighted and integrated to obtain a comprehensive evaluation result of the countermeasure effectiveness; In the performance evaluation process using adversarial networks, the adversarial network is used to analyze the time flexibility of the task process, the total time spent in adversarial operations, and the time conflicts in the task process in the time dimension. The time flexibility of a task process is represented by the difference between the upper bound of the total task time window constraint interval and the sum of the lower bounds of the time constraints intervals for all adversarial processes that need to be completed within the task. It is denoted as... For the time flexibility of the r-th kill chain during the mission, ∑t is the upper bound of the time window constraint interval for the total time taken by tasks on this kill chain. l The sum of the lower bounds of the time constraints for completing all combat processes within the mission on this kill chain; The total time taken during the task process represents the total time taken from the start to the end of the task. Task process time conflict situation, representing the number of time conflicts between the time constraints of the entire process and each stage of the task, and the time constraints generated by the sum of the time constraints of the entire process and each node in each stage of the task. In the performance evaluation process using adversarial networks, the resilience of information transmission during the task process is analyzed in the information dimension. This resilience represents the ability of the information transmission link in the corresponding task process to maintain connectivity when subjected to external attacks, denoted as [missing information]. For the survivability of the k-th information transmission chain during the mission, CL k This represents the total number of nodes traversed in the information transmission chain. This represents the probability that the information transmission chain will be attacked and broken. In the performance evaluation process using adversarial networks, the network analyzes the strike accuracy index, first-order effect accuracy sensitivity coefficient, and total effect accuracy sensitivity coefficient of the mission process in terms of precision. The strike accuracy index represents the success probability of closing the kill chain in the current mission process, calculated by the accuracy-affected network. The first-order effect accuracy sensitivity coefficient and the total effect accuracy sensitivity coefficient represent the degree of influence of different precision parameters on the final result during the mission process. The first-order effect accuracy sensitivity coefficient is denoted as... The overall effect precision sensitivity coefficient is denoted as Parameter X i The first-order effect based on variance can be expressed as: In the formula, X ～i Indicates the difference between X and X i The matrix of all external factors; Indicates in X i With Y remaining constant, the mean of X ～i The value of the space, V(Y) is the unconditional variance of the output value.
2. The performance evaluation method based on kill chain modeling of adversarial systems according to claim 1, characterized in that: In the process of obtaining the preceding and following logic and time constraints, the preceding and following logic and time constraints between the first nodes are obtained by acquiring the action sequence of each first node, the time constraints of each first node in the task process, and the time constraints of each first stage in the entire process and the task process.
3. The performance evaluation method based on kill chain modeling of adversarial systems according to claim 2, characterized in that: In the process of obtaining the information transmission path, the node type of each second node in the information dimension and the probability of the information node failing during the task are obtained. For each individual node, output interfaces and input interfaces for information transmission are planned between nodes, and the information transmission path between the second nodes is generated.
4. The performance evaluation method based on kill chain modeling of adversarial systems according to claim 3, characterized in that: In the process of obtaining the influence coefficient, the influence coefficient of the third node on the completion of the corresponding task is obtained by acquiring the baseline probability of each third node completing the corresponding task, the interaction order of each third node, the logic between the third nodes, the influence coefficient of whether the preceding node occurs on the probability of the subsequent node occurring, and the influence coefficient of whether the subsequent node occurs on the probability of the preceding node occurring.
5. The performance evaluation method based on kill chain modeling of adversarial systems according to claim 4, characterized in that: In the process of constructing the adversarial network, in the time dimension, each first node is connected according to the task start and end conditions, the logical sequence between nodes, and the time constraints between nodes, to form the first adversarial network in the time dimension.
6. The performance evaluation method based on kill chain modeling of adversarial systems according to claim 5, characterized in that: In the process of constructing the adversarial network, based on the first adversarial network, in the information dimension, each second node is connected sequentially according to the task start and end conditions, the output and input interfaces for information transmission between nodes by a single node, and the main paths for information transmission between nodes during the task process, to form a second adversarial network with the time dimension.
7. The performance evaluation method based on kill chain modeling of adversarial systems according to claim 6, characterized in that: In the process of constructing the adversarial network, based on the second adversarial network, in terms of precision, each third node is connected sequentially according to the task start and end conditions, the action order of each third node, and the logical sequence between the third nodes, in the order in which the events of the task process occur, to form the adversarial network with a time dimension.