Network red-blue confrontation performance evaluation method for actual combat

Abstract

The invention relates to an actual combat-oriented network red-blue confrontation efficiency evaluation method, and belongs to the field of network confrontation. A red party attack efficiency index system formed according to three stages of network red party attack comprises an information investigation A1 index, a network penetration A2 index and an attack damage A3 index, and a blue party defense efficiency index system is provided according to six stages of network blue party defense. Comprising the steps of presetting a protection D1 index, a monitoring early warning D2 index, a strategy reinforcement D3 index, a tracing source D4 index, a countering killing D5 index and a destroy-resistant recovery D6 index. Through detailed discussion and description of specific implementation problems such as index system construction, an index calculation method, data preprocessing and comprehensive calculation, a feasible evaluation model and framework are provided for the network attack and defense efficiency, and reference is provided for attack and defense efficiency evaluation in network security construction.

Description

Technical Field

[0001] The present invention belongs to the field of network confrontation, and in particular relates to a method for evaluating the effectiveness of network red-blue confrontation oriented to actual combat. Background Art

[0002] The network red-blue confrontation drill is an important task of information construction, and is of great significance to improving network security defense capabilities and protecting the security of network information resources. The network attack and defense confrontation aims to hone the network blue team's capabilities, check for loopholes in network defense, provide data support for decision makers, optimize network defense strategies, and improve network attack and defense capabilities. The network attack and defense effectiveness evaluation model is based on expert experience, designs a scientific, objective and measurable indicator system, and quantitatively analyzes and evaluates the red and blue capabilities through comprehensive scoring, which plays a key role in the review of the red and blue confrontation process, experience accumulation, and capability iteration. However, the red and blue confrontation situation changes rapidly, and it is not easy to design an objective and measurable indicator system and form a model. At present, there is little research in related fields at home and abroad.

[0003] Based on the actual combat environment and from the perspective of actual attack and defense, the present invention designs an overall red-blue confrontation effectiveness evaluation model and proposes an operational evaluation framework to provide specific implementation ideas for network attack and defense confrontation effectiveness evaluation. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] The technical problem to be solved by the present invention is how to provide a method for evaluating the effectiveness of a red-blue network confrontation in actual combat, so as to solve the problem of evaluating the effectiveness of a red-blue network confrontation.

[0006] (II) Technical solution

[0007] In order to solve the above technical problems, the present invention proposes a method for evaluating the effectiveness of network red-blue confrontation for actual combat, which includes:

[0008] Based on the three stages of the network red team attack, the red team attack effectiveness indicator system is formed, including:

[0009] Information reconnaissance A1 indicator: used to evaluate the effectiveness of the Red Team's information reconnaissance of the Blue Team. The indicator value is obtained by calculating the accuracy, hit rate, and vulnerability ratio of each sub-item;

[0010] Network penetration A2 index: used to evaluate the Red Team's network penetration capability. The index value is obtained by calculating the controlled proportion and execution degree of each sub-item.

[0011] Attack and Destruction A3 Index: It is used to evaluate the Red Team's ability to attack and destroy the Blue Team's network confidentiality, integrity, and availability. It is a result presentation of the Red Team's capabilities. The index value is obtained by calculating the victim ratio and hit rate of each sub-item.

[0012] Based on the six stages of network blue team defense, the blue team defense effectiveness indicator system is formed, including:

[0013] Pre-installed protection D1 index: used to evaluate the preset protection level of the blue team. The index value is obtained by calculating the blocking accuracy rate, hit rate, missed blocking rate, wrong blocking rate, repair rate, reinforcement rate, and installation rate.

[0014] Monitoring and early warning D2 indicator: used to evaluate the blue team's ability to discover and intercept attack traffic. The indicator value is obtained by calculating the alarm or interception accuracy, hit rate, missed alarm rate, false alarm rate, and discovery efficiency of the attack traffic.

[0015] Strategy reinforcement D3 index: used to evaluate the blue team's response ability to adjust the network defense force after being attacked by the red team, detecting the detection behavior or suffering substantial damage. The index value is obtained by calculating the blocking accuracy rate, hit rate, missed blocking rate, and false blocking rate;

[0016] Tracking and tracing D4 indicator: used to evaluate the blue team's ability to track and trace the enemy's jump board and attack source after discovering or being attacked by the red team. The indicator value is obtained by calculating the accuracy, hit rate, and efficiency.

[0017] Counterattack and Kill D5 Index: It is used to evaluate the Blue Team's ability to counterattack and control the enemy after discovering or being attacked by the Red Team. The index value is obtained by calculating the accuracy rate, hit rate, control ratio, and efficiency.

[0018] Destruction and recovery D6 index: used to evaluate the ability of the blue team to quickly restore its business operations after being destroyed and paralyzed by the blue team. The index value is obtained by calculating the recovery success rate and efficiency.

[0019] Based on the red team's attack effectiveness index system and the blue team's defense effectiveness index system, the red-blue confrontation effectiveness evaluation method is designed, including: index calculation, data preprocessing, index weight design, weighted calculation and comprehensive evaluation;

[0020] S1. Index calculation:

[0021] After collecting data on the network environment, calculate various indicators of the red team's attack effectiveness index system and the blue team's defense effectiveness index system;

[0022] S2. Data preprocessing:

[0023] The idea of ​​a baseline is adopted. First, a baseline value is designed for each indicator according to the indicator system. Then, the positive and negative deviations between the actual indicator value and the baseline value are calculated, and the deviation value is used as the sub-item score of the comprehensive evaluation.

[0024] S3. Index weight design:

[0025] Two layers of weights are introduced. The first layer of weights is the weight of the attack and defense stage, which is used to quantify the impact of different stages on the red-blue confrontation. The second layer of weights is the weight of small indicators, which is used to quantify the influence of each specific indicator within the stage.

[0026] S4. Weighted calculation and comprehensive evaluation:

[0027] According to the various index values ​​and index weights of the pre-processed red team attack effectiveness index system and the blue team defense effectiveness index system, weighted calculation of sub-item scores and comprehensive scores is carried out to make an overall evaluation of the red and blue sides.

[0028] (III) Beneficial effects

[0029] The present invention proposes a network red-blue confrontation effectiveness evaluation method for actual combat. From the perspectives of actual attack and defense, measurable indicators, and priority of command and control, the present invention proposes a network attack and defense confrontation effectiveness evaluation model for actual combat. By discussing and describing in detail the specific implementation issues such as indicator system construction, indicator calculation method, data preprocessing, and comprehensive calculation, a feasible evaluation model and framework for network attack and defense effectiveness is provided, which provides a reference and reference for the implementation of attack and defense effectiveness evaluation in network security construction. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 The Red Team attack effectiveness evaluation index system of the present invention;

[0031] Figure 2 The blue team defense effectiveness evaluation index system of the present invention;

[0032] Figure 3 It is a schematic diagram of the red-blue confrontation effectiveness evaluation model of the present invention. DETAILED DESCRIPTION

[0033] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0034] The network red-blue confrontation is a simulated confrontation activity in the current Internet environment, which aims to hone the network defense blue side's security operation and maintenance, monitoring and analysis and other security protection capabilities. The purpose of the performance evaluation is to comprehensively evaluate the red and blue sides, find problems, check for omissions, and iterate capabilities in attack and defense. Based on the actual combat environment, the present invention proposes a network attack and defense confrontation effectiveness evaluation model for actual combat, including a set of observable red and blue attack and defense effectiveness evaluation index systems, index calculation methods and comprehensive evaluation methods, providing a feasible actual combat evaluation framework for network attack and defense confrontation exercises.

[0035] 1. Performance Evaluation Process Analysis

[0036] Effectiveness evaluation provides results for the red-blue confrontation. The actual evaluation process runs through the entire confrontation. Its main processes include:

[0037] (1) Network objectives and network environment preparation

[0038] The essence of the red-blue confrontation assessment is to evaluate the attack or defense capabilities and strength of the red side of the network, and the red-blue capabilities are characterized by network targets and the corresponding network environment. Therefore, the first step in conducting an effectiveness assessment is to define the scope and clarify the network environment, network boundaries and network targets involved in the confrontation, so as to collect data on the corresponding indicators within the target range and evaluate and quantify the capabilities. At the same time, in the network environment, the interference of irrelevant background traffic should be eliminated as much as possible to maintain the purity of the network.

[0039] (2) Construct a measurable evaluation indicator system

[0040] A scientific and effective evaluation index system is the basic guarantee for evaluating the effectiveness of the red-blue confrontation. However, some seemingly key indicators are difficult to measure. For example, to evaluate the red team's attack efficiency, a more accurate measurement method is to calculate the time it takes to capture the blue team's device permissions, but the data for this indicator is difficult to collect accurately. Therefore, the construction of indicators cannot be like castles in the air, but should be close to actual combat. This requires that the established indicators must be observable and at the same time not interfere with actual combat as much as possible.

[0041] (3) Design and use performance evaluation models

[0042] The evaluation of the red-blue confrontation effectiveness can be reflected through multi-dimensional indicators. However, different indicators have different dimensions, and the importance (weight) of different indicators to the effectiveness is also different. Therefore, it is necessary to design a scientific evaluation model to perform pre-processing such as de-dimensionalization and normalization of the indicator data and weighted analysis to obtain comprehensive and objective evaluation results.

[0043] (4) Pre-set indicator data monitoring collector

[0044] After the evaluation index system is established, in order to implement it in actual combat, it is necessary to pre-install collectors in the network to obtain real and effective indicator data for model analysis.

[0045] (5) Real-time monitoring and recording of red and blue indicator data during the confrontation process

[0046] In order to ensure the accuracy of performance evaluation, the collection of indicator data should meet the requirements of near real-time. Therefore, the confrontation process should be monitored in real time as much as possible to obtain accurate indicator data.

[0047] (6) Collect data and input it into the evaluation model to obtain results

[0048] After completing the indicator data monitoring work during the confrontation process, the collected indicator data is input into the model to obtain the analysis results.

[0049] (7) Analyze the performance evaluation results and draw evaluation conclusions

[0050] The evaluation model obtains evaluation scores through different monitoring indicator data plans in different dimensions, and obtains comprehensive scores through certain weighted calculations. This is a quantitative evaluation result. The actual performance evaluation should also combine the performance of indicators in different dimensions and conduct qualitative analysis based on expert experience to draw evaluation conclusions.

[0051] 2. Construction of evaluation index system

[0052] The establishment of an indicator system is the basic work of performance evaluation and the foundation of the evaluation model. In different task scenarios, the selection of evaluation indicators and the establishment of the system vary, but generally follow the following principles:

[0053] (1) Objectivity

[0054] Indicators should objectively reflect the state changes of the confrontation process and should not be changed arbitrarily according to subjective will.

[0055] (2) Testability

[0056] Indicators should be objective and measurable, and can be obtained by collecting data with the help of various collectors and post-calculating and processing them.

[0057] (3) Independence

[0058] For performance evaluation under the same dimension, indicators should be independent and mutually exclusive, that is, different indicators should reflect different performance characteristics and there should be no duplication.

[0059] (4) Availability

[0060] The indicators should be able to truly reflect the effectiveness characteristics of the red-blue confrontation, be typical and general, and be able to implement effective vertical and horizontal comparisons between the red and blue sides and during the confrontation process.

[0061] (5) Completeness

[0062] For performance evaluation under the same dimension, the set of indicators covered should be able to fully reflect the characteristics of the dimension, and any indicator that will affect the characteristics of the dimension should be included in the indicator system.

[0063] The red-blue confrontation is essentially an attack and defense against the confidentiality, integrity, and availability of the network. Based on these three characteristics of the network, the network red team generally implements three attack steps: information reconnaissance, network penetration, and attack destruction; accordingly, the network blue team's defense work can be divided into six stages: pre-set protection, monitoring and early warning, strategy reinforcement, tracking and tracing, counter-killing, and anti-destruction and recovery. Currently, many studies on network attack and defense evaluation mainly focus on attack effectiveness evaluation, but for network defense, more attention should be paid to the blue team's defense effectiveness evaluation. Therefore, the present invention studies the effectiveness of both red and blue teams.

[0064] Based on the three stages of the network red team attack, the red team attack effectiveness indicator system is formed as follows:

[0065] (1) Information reconnaissance A1 indicator is mainly used to evaluate the effectiveness of the Red Team’s information reconnaissance of the Blue Team’s network, IP, port, service, vulnerability, weak password, etc. The indicator value is obtained by calculating the accuracy, hit rate, vulnerability ratio and other dimensions of each sub-item.

[0066] (2) Network penetration A2 index is mainly used to evaluate the Red Team's network penetration capabilities, including permission acquisition, command execution, file upload, download, control and lateral spread. The index value is obtained by calculating the controlled proportion and execution degree of each sub-item.

[0067] (3) Attack and Destruction A3 is mainly used to evaluate the Red Team’s ability to attack and destroy the Blue Team’s network confidentiality, integrity, and availability. It is a result-based presentation of the Red Team’s capabilities, mainly including confidentiality theft, data deletion, application control, infrastructure breach, and equipment downtime. The indicator value is obtained by calculating the victimization ratio and hit rate of each sub-item.

[0068] Corresponding to the evaluation of the red team's attack capability, the present invention proposes a set of blue team defense effectiveness index systems based on the six stages of network blue team defense. Different from purely evaluating the red team's attack capability, in an actual network environment, the blue team's capabilities should not only be evaluated in terms of its defense capabilities, but also in terms of whether it has affected the necessary business operations during the deployment of security measures and emergency response. The essence of network blue team defense is to ensure the safe and smooth development of network-related accusation services, and to avoid being destroyed, interfered with, or espionage by the enemy. If related actions are affected during the security deployment process, a negative evaluation should be given and included in the overall evaluation of the blue team's defense capabilities. Therefore, the blue team evaluation index system proposed by the present invention is as follows:

[0069] (1) Pre-installed protection D1 index is mainly used to evaluate the pre-installed protection level of the blue team in terms of IP, port, service, vulnerability repair, authentication enhancement, terminal protection, network protection, etc. The index value is obtained by calculating the blocking accuracy rate, hit rate, missed blocking rate, false blocking rate, repair rate, reinforcement rate, installation rate, etc.

[0070] (2) Monitoring and early warning D2 indicators are mainly used to evaluate the blue team's ability to detect and block attack traffic. The indicator value is obtained by calculating the alarm or blocking accuracy rate, hit rate, missed alarm rate, false alarm rate, and detection efficiency of the attack traffic.

[0071] (3) Strategy reinforcement D3 indicators are mainly used to evaluate the response capability of the blue team to adjust the defense force of the network IP, port, service, and equipment after being attacked by the red team, detecting the detection behavior or suffering substantial damage. This stage is mainly to check and fill in the gaps of the pre-set protection D1 during the implementation of the attack and defense confrontation. Similar to the D1 stage, the indicator value is obtained by calculating the blocking accuracy rate, hit rate, missed blocking rate, and false blocking rate.

[0072] (4) Tracking and tracing D4 indicators are mainly used to evaluate the Blue team's ability to track and trace the enemy's jump board and attack source after discovering or being attacked by the Red team. The indicator value is obtained by calculating the accuracy, hit rate, efficiency and other aspects.

[0073] (5) Counterattack and Kill D5 index is mainly used to evaluate the Blue team's ability to counterattack and control the enemy after discovering or being attacked by the Red team. The index value is obtained by calculating the accuracy rate, hit rate, control ratio, efficiency, etc.

[0074] (6) The D6 indicator is mainly used to evaluate the ability of the blue team to quickly restore its business operations after being destroyed and paralyzed by the red team. The indicator value is obtained by calculating the recovery success rate and efficiency.

[0075] 3. Design of performance evaluation method

[0076] Based on the red team's attack effectiveness index system and the blue team's defense effectiveness index system, the red-blue confrontation effectiveness evaluation model mainly includes five parts: index calculation, data preprocessing, index weight design, index sub-item calculation, and comprehensive score calculation. The input of the model is the monitoring values ​​of the index system, and the output is the sub-item evaluation and comprehensive evaluation scores. The expert evaluation team combines the sub-item scores and comprehensive scores to make an overall evaluation of the red and blue teams, such as Figure 3 shown.

[0077] S1. Evaluation index calculation method

[0078] Based on the evaluation index system, the evaluation team collects the indicators of the network environment and inputs them into the model for calculation. The present invention systematically defines symbols and calculates formulas for various indicators, among which a large number of symbol abbreviations refer to the confusion matrix in the classification algorithm, as shown in Table 1. Among them, the commonly used evaluation index calculation method is:

[0079] Accuracy

[0080] Hit Rate

[0081] False negative rate

[0082] False Positive Rate

[0083] Table 1 Confusion matrix

[0084]

[0085] The specific calculation methods of the blue and red indicators are shown in Table 2 and Table 3 respectively.

[0086] Table 2 Calculation method of Red team attack effectiveness index

[0087]

[0088]

[0089]

[0090] Table 3 Calculation method of blue side defense effectiveness evaluation index

[0091]

[0092]

[0093]

[0094]

[0095]

[0096] S2. Index data preprocessing

[0097] Since different indicator types have different dimensions, data preprocessing is required when conducting comprehensive evaluation so as to comprehensively calculate all indicator data. This invention adopts the idea of ​​baseline. First, a baseline value is designed for each indicator according to the indicator system. Then, the positive and negative deviations between the actual indicator value and the baseline value are calculated. The deviation value is used as the sub-item score of the comprehensive evaluation. The calculation method is:

[0098]

[0099] Among them, v' i represents the calculated value of the i-th indicator after de-dimensioning, v i represents the actual observed value of the indicator, v i-baseline Indicates the index benchmark value, v i-max Indicates the maximum value that the indicator can measure, v i-minIt indicates the minimum measurable value of the indicator. The benchmark value of each indicator in the indicator system needs to be formulated according to the combat mission and the actual network environment.

[0100] S3. Index weight design

[0101] After the indicator is dimensionless, the calculated indicator value has only numerical significance. The importance of each indicator varies according to different combat missions and network environments. Therefore, weights need to be added to quantify the importance of indicators when conducting comprehensive evaluations. The present invention introduces two layers of weights. The first layer of weights is the weight of the attack and defense stage, which is used to quantify the impact of different stages on the red-blue confrontation; the second layer of weights is the weight of small indicators, which is used to quantify the influence of each specific indicator within the stage.

[0102] S4. Weighted calculation and comprehensive evaluation

[0103] According to the various index values ​​and index weights of the pre-processed red team attack effectiveness index system and the blue team defense effectiveness index system, weighted calculation of sub-item scores and comprehensive scores is carried out to make an overall evaluation of the red and blue sides.

[0104] The comprehensive scoring method is as follows:

[0105]

[0106] Among them, S represents the comprehensive score, N stage Indicates the total number of attack and defense phases of the blue or red side, W j represents the weight value of the blue or red team in the jth stage, n j-indicator represents the total number of indicators in the jth stage, w (j,i) represents the weight value of the i-th indicator in the j-th stage, v' (j,i) It represents the dimensionless calculated value of the ith indicator in the jth stage.

[0107] For weight setting, the sum of weights of each layer should be 1, that is, the following conditions are met:

[0108]

[0109] The comprehensive scoring model of the Red team, after the weight setting is completed, runs through the entire confrontation process; while for the comprehensive scoring model of the Blue team, its first-level weight should change dynamically as the Red-Blue confrontation activities progress. For example, in the initial stage of the confrontation, the Red team has not yet started the offensive. At this time, only the indicators of the preset protection D1 stage are meaningful to the Blue team. Monitoring and early warning D2, strategy reinforcement D3, tracking and tracing D4, counter-killing D5 and anti-destruction and recovery D6 are meaningless, so the weight setting should be W = (1, 0, 0, 0, 0, 0); when the Red team initiates reconnaissance and detection, the Blue team's stage weight can be set to W = (0.6, 0.4, 0, 0, 0, 0); when the Red team successfully seizes control of the equipment, the Blue team's stage weight can be set to W = (0.3, 0.2, 0.2, 0.2, 0.1, 0); when the Red team destroys the equipment, the Blue team's stage weight can be set to W = (0.2, 0.2, 0.2, 0.2, 0.1, 0.1).

[0110] This paper proposes a network attack and defense effectiveness evaluation model for actual combat from the perspectives of actual attack and defense, measurable indicators, and business assurance priority. By discussing and describing in detail the specific implementation issues such as indicator system construction, indicator calculation method, data preprocessing, and comprehensive calculation, it provides a feasible evaluation model and framework for network attack and defense effectiveness, and provides a reference and reference for the implementation of attack and defense effectiveness evaluation in network security construction.

[0111] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for evaluating the effectiveness of network red-blue confrontation in actual combat, characterized in that: The method includes: Based on the three stages of the network red team attack, the red team attack effectiveness indicator system is formed, including: Information reconnaissance A1 indicator: used to evaluate the effectiveness of the Red Team's information reconnaissance of the Blue Team. The indicator value is obtained by calculating the accuracy, hit rate, and vulnerability ratio of each sub-item; Network penetration A2 index: used to evaluate the Red Team's network penetration capability. The index value is obtained by calculating the controlled proportion and execution degree of each sub-item. Attack and Destruction A3 Index: It is used to evaluate the Red Team's ability to attack and destroy the Blue Team's network confidentiality, integrity, and availability. It is a result presentation of the Red Team's capabilities. The index value is obtained by calculating the victim ratio and hit rate of each sub-item. Based on the six stages of network blue team defense, the blue team defense effectiveness indicator system is formed, including: Pre-installed protection D1 index: used to evaluate the preset protection level of the blue team. The index value is obtained by calculating the blocking accuracy rate, hit rate, missed blocking rate, wrong blocking rate, repair rate, reinforcement rate, and installation rate. Monitoring and early warning D2 indicator: used to evaluate the blue team's ability to discover and intercept attack traffic. The indicator value is obtained by calculating the alarm or interception accuracy, hit rate, missed alarm rate, false alarm rate, and discovery efficiency of the attack traffic. Strategy reinforcement D3 index: used to evaluate the blue team's response ability to adjust the network defense force after being attacked by the red team, detecting the detection behavior or suffering substantial damage. The index value is obtained by calculating the blocking accuracy rate, hit rate, missed blocking rate, and false blocking rate; Tracking and tracing D4 indicator: used to evaluate the blue team's ability to track and trace the enemy's jump board and attack source after discovering or being attacked by the red team. The indicator value is obtained by calculating the accuracy, hit rate, and efficiency. Counterattack and Kill D5 Index: It is used to evaluate the Blue Team's ability to counterattack and control the enemy after discovering or being attacked by the Red Team. The index value is obtained by calculating the accuracy rate, hit rate, control ratio, and efficiency. Destruction and recovery D6 index: used to evaluate the ability of the blue team to quickly restore its business operations after being destroyed and paralyzed by the blue team. The index value is obtained by calculating the recovery success rate and efficiency. Based on the red team's attack effectiveness index system and the blue team's defense effectiveness index system, the red-blue confrontation effectiveness evaluation method is designed, including: index calculation, data preprocessing, index weight design, weighted calculation and comprehensive evaluation; S1. Index calculation: After collecting data on the network environment, calculate various indicators of the red team's attack effectiveness index system and the blue team's defense effectiveness index system; S2. Data preprocessing: The idea of ​​a baseline is adopted. First, a baseline value is designed for each indicator according to the indicator system. Then, the positive and negative deviations between the actual indicator value and the baseline value are calculated, and the deviation value is used as the sub-item score of the comprehensive evaluation. S3. Index weight design: Two layers of weights are introduced. The first layer of weights is the weight of the attack and defense stage, which is used to quantify the impact of different stages on the red-blue confrontation. The second layer of weights is the weight of small indicators, which is used to quantify the influence of each specific indicator within the stage. S4. Weighted calculation and comprehensive evaluation: According to the various index values ​​and index weights of the pre-processed red team attack effectiveness index system and the blue team defense effectiveness index system, weighted calculation of sub-item scores and comprehensive scores is carried out to make an overall evaluation of the red and blue sides.

2. The actual combat-oriented network red-blue confrontation effectiveness evaluation method according to claim 1 is characterized in that: In S1, the calculation method of the red team's attack effectiveness index is:

3. The actual combat-oriented network red-blue confrontation effectiveness evaluation method according to claim 2 is characterized in that: In S1, the calculation method of the blue side's defense effectiveness index is:

4. The actual combat-oriented network red-blue confrontation effectiveness evaluation method according to claim 3 is characterized in that: The calculation method in S2 is: Among them, v' i represents the calculated value of the i-th indicator after de-dimensioning, v i represents the actual observed value of the indicator, v i-baseline Indicates the index benchmark value, v i-max Indicates the maximum value that the indicator can measure, v i-min Indicates the minimum measurable value of the indicator.

5. The actual combat-oriented network red-blue confrontation effectiveness evaluation method according to claim 4 is characterized in that: The benchmark values ​​of each indicator are formulated according to combat missions and actual network environments.

6. The actual combat-oriented network red-blue confrontation effectiveness evaluation method according to claim 3 is characterized in that: In S4, the comprehensive scoring method is as follows: Among them, S represents the comprehensive score, N stage Indicates the total number of attack and defense phases of the blue or red side, W j represents the weight value of the blue or red team in the jth stage, n j-indicator represents the total number of indicators in the jth stage, w (j,i) represents the weight value of the i-th indicator in the j-th stage, v' (j,i) It represents the dimensionless calculated value of the ith indicator in the jth stage.

7. The actual combat-oriented network red-blue confrontation effectiveness evaluation method according to claim 6 is characterized in that: For weight setting, the sum of weights of each layer should be 1, that is, the following conditions are met:

8. The actual combat-oriented network red-blue confrontation effectiveness evaluation method according to claim 6 is characterized in that: When comprehensively scoring the red team, the weight setting is completed and applies throughout the entire confrontation process.

9. The actual combat-oriented network red-blue confrontation effectiveness evaluation method according to claim 6 is characterized in that: When comprehensively scoring the blue team, the first-level weight changes dynamically as the red-blue confrontation progresses.

10. The actual combat-oriented network red-blue confrontation effectiveness evaluation method according to claim 9, characterized in that: In the initial stage of the confrontation, the Red team has not yet started the offensive. At this time, only the indicators of the preset protection D1 stage are meaningful to the Blue team. Monitoring and early warning D2, strategy reinforcement D3, tracking and tracing D4, counter-killing D5 and anti-destruction and recovery D6 are meaningless. Therefore, the weight setting should be W=(1,0,0,0,0,0); when the Red team initiates reconnaissance and detection, the Blue team's stage weight is set to W=(0.6,0.4,0,0,0,0); when the Red team successfully seizes the equipment, the Blue team's stage weight is set to W=(0.3,0.2,0.2,0.2,0.1,0); when the Red team destroys the equipment, the Blue team's stage weight is set to W=(0.2,0.2,0.2,0.2,0.1,0.1).

Images