Method and device for determining network key vulnerability, electronic equipment and storage medium

Abstract

The application discloses a network analysis method, in particular to a network key vulnerable point determination method and device, electronic equipment and storage medium, the method comprises: calculating the structure index and function index of the target network;Based on the structure index and the function index, a vulnerability function is constructed;With the maximum vulnerability function as the objective function, the objective function is solved based on the genetic algorithm under the preset constraint condition, and the key vulnerable point set of the target network is obtained, which comprises: determining the initial population;Based on the vulnerability function, the fitness value of the initial chromosome is calculated;Based on the fitness value of the initial chromosome, genetic operation is performed on the initial population;In the case of meeting the termination condition, the chromosome with the highest fitness value in the final population obtained by genetic operation is converted into the key vulnerable point set of the target network and output. The method can improve the efficiency and accuracy of determining the key vulnerable point of the network.

Description

Technical Field

[0001] The present invention relates to a network analysis method, and in particular to a method, device, electronic device and storage medium for determining key network vulnerabilities. Background Art

[0002] A combat system of systems (CSoS) is an organic whole comprised of multiple combat systems organized according to specific command relationships, organizational relationships, and operational mechanisms. From a topological perspective, a combat system can be simplified as a complex network model, with nodes including sensors, communication hubs, command centers, and firepower platforms. The information, resource, and energy interactions between nodes form the network's edges. In complex electromagnetic environments, identifying and protecting key nodes within the system is crucial to ensuring the reliability and survivability of the combat network.

[0003] Existing research exploring strategies for enhancing or disrupting combat system effectiveness relies extensively on complex network theory. By constructing metrics such as robustness, resilience, and vulnerability, these metrics analyze the stability, resilience, and potential weaknesses of target networks facing various threats and attack scenarios. Traditional complex network robustness quantification tools, such as vertex / edge connectivity, fault diameter, rigidity, and expansion parameters, while performing well in static, homogeneous networks, are difficult to directly apply to highly dynamic and heterogeneous target networks.

[0004] Compared to robustness, which emphasizes a system's ability to survive adversity, vulnerability research focuses on quantifying the extent of damage to a system when it encounters anomalies or attacks. As a complementary perspective to robustness research, vulnerability research provides an important insight into the security of combat networks. While existing research has made significant progress in structural connectivity, focusing on the characteristics of heterogeneous combat networks, deconstruction strategies from a functional perspective remain insufficient. Existing research primarily focuses on evaluating either network topology or functional characteristics, rarely integrating both to comprehensively analyze the overall effectiveness of a combat system. This results in poorly accurate assessment results. Summary of the Invention

[0005] The technical problem to be solved by the present invention is that most existing technologies focus on single-dimensional evaluation of network topology or functional characteristics, and rarely take both into consideration to comprehensively analyze the overall performance of the network, resulting in poor accuracy of the evaluation results. In order to solve the above problem, the present invention provides a method, device, electronic device and storage medium for determining key network vulnerabilities.

[0006] The present invention includes:

[0007] In a first aspect, an embodiment of the present invention provides a method for determining key network vulnerabilities, including:

[0008] Calculating structural indicators and functional indicators of a target network, wherein the target network includes N nodes, the structural indicators are determined based on the network topology of the target network, and the functional indicators are used to characterize the effectiveness of the target network in performing tasks, where N is a positive integer;

[0009] constructing a vulnerability function based on the structural index and the functional index;

[0010] Taking maximizing the vulnerability function as an objective function, solving the objective function based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network, wherein the set of key vulnerable points includes K nodes, where K is a positive integer less than N;

[0011] The objective function is to maximize the vulnerability function, and the objective function is solved based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network, including:

[0012] Determine the initial population, which includes N p Initial chromosomes, N p is a positive integer and an even number;

[0013] Calculating the fitness value of the initial chromosome based on the fragility function;

[0014] performing a genetic operation on the initial population based on the fitness value of the initial chromosome;

[0015] When the termination condition is met, the chromosome with the highest fitness value in the final population obtained by the genetic operation is converted into a key vulnerable point set output of the target network.

[0016] Optionally, determining the initial population includes:

[0017] Based on the node extraction probability, a sampling operation is performed on the N nodes to obtain 3n p The initial chromosomes, n p is a positive integer, and the extraction probability of the node is positively correlated with the importance of the node;

[0018] Execute N on the N nodes p -3n p Rounds of random sampling operations, get N p -3n p The initial chromosomes.

[0019] Optionally, the sampling operation is performed on the N nodes based on the node extraction probability to obtain 3np The initial chromosomes include:

[0020] For each of the N nodes, determining a first importance of the node based on the degree centrality of the node, determining a second importance of the node based on the betweenness centrality of the node, and determining a third importance of the node based on the clustering coefficient of the node;

[0021] Determining a first extraction probability of the node based on the first importance of the node, determining a second extraction probability of the node based on the second importance of the node, and determining a third extraction probability of the node based on the third importance of the node;

[0022] Based on the first extraction probability of the node, a sampling operation is performed on the N nodes to obtain n p The initial chromosomes are sampled based on the second extraction probability of the nodes to obtain n p The initial chromosomes are sampled based on the third extraction probability of the nodes to obtain n p The initial chromosomes.

[0023] Optionally, performing a genetic operation on the initial population based on the fitness value of the initial chromosome includes:

[0024] Based on the fitness value of the initial chromosome, selecting a plurality of the initial chromosomes from the initial population as parents to enter the mating pool;

[0025] Performing a crossover operation on the initial chromosomes in the mating pool according to a preset crossover strategy and a mutation operation according to a preset mutation strategy until the termination condition is met.

[0026] Optionally, the chromosome comprises a plurality of genes, each of which is coded as 1 or 0;

[0027] The preset crossover strategy includes: when performing a crossover between a first chromosome and a second chromosome, if a gene coded as 1 is exchanged with a gene coded as 0 at a first position, then a gene coded as 0 is exchanged with a gene coded as 1 at a second position, the first chromosome and the second chromosome being any pair of chromosomes, and the first position and the second position being symmetrical;

[0028] and / or;

[0029] The preset mutation strategy includes: if a mutation operation is performed at the third position, and a gene coded as 0 is changed to a gene coded as 1, a gene coded as 1 with a symmetric feature is randomly determined and its code is changed to 0.

[0030] Optionally, performing the crossover operation according to a preset crossover strategy includes:

[0031] Determine the crossover probability P c , initial values ​​of the first counter cn1 and the second counter cn2;

[0032] Execute N p Iterative cross processing, wherein the cross processing includes:

[0033] Generate a first random number r in the interval [0,1]. If r is less than P c , then execute this cross processing, otherwise, execute the next cross processing;

[0034] Generate a random position array to determine the intersection point c; traverse the random position array; if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 0, cn1=cn1+1; if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 1, cn2=cn2+1;

[0035] Determine the number k of gene pairs that need to be exchanged simultaneously, where k is the smaller value of cn1 and cn2, perform symmetric crossover at the corresponding k positions, and then reset cn1=0 and cn2=0.

[0036] Optionally, the mutation operation according to a preset mutation strategy includes:

[0037] Determine the mutation probability P m The initial value of

[0038] For each pair of chromosomes after the crossover operation, a second random number d is generated with a coding range between 0 and 1. <P m When , the mutation operation is performed on the pair of chromosomes, otherwise, the next pair of chromosomes is processed;

[0039] Create two arrays loc0 and loc1 respectively to record the gene positions of all genes coded as 0 and 1 in the chromosome; randomly select a position lj0 from loc0, change the gene code at lj0 from 0 to 1, check whether loc1 is not empty, and randomly select a position lj1 and change its gene code from 1 to 0.

[0040] In a second aspect, an embodiment of the present invention provides a device for determining a key vulnerability point in a network, including:

[0041] a calculation module, configured to calculate structural indicators and functional indicators of a target network, wherein the target network includes N nodes, the structural indicators are determined based on a network topology of the target network, and the functional indicators are used to characterize the effectiveness of the target network in performing a task, where N is a positive integer;

[0042] A construction module, configured to construct a vulnerability function based on the structural indicator and the functional indicator;

[0043] A solution module is configured to solve the objective function based on a genetic algorithm under preset constraints by maximizing the vulnerability function to obtain a set of key vulnerable points of the target network, where the set of key vulnerable points includes K nodes, where K is a positive integer less than N;

[0044] Wherein, the solution module includes:

[0045] A determination unit is used to determine an initial population, wherein the initial population includes N p Initial chromosomes, N p is a positive integer and an even number;

[0046] A calculation unit, configured to calculate the fitness value of the initial chromosome based on the fragility function;

[0047] an execution unit, configured to perform a genetic operation on the initial population based on the fitness value of the initial chromosome;

[0048] The output unit is used to convert the chromosome with the highest fitness value in the final population obtained by genetic operation into a set of key vulnerable points of the target network and output it when the termination condition is met.

[0049] In a third aspect, an embodiment of the present invention provides an electronic device comprising: a memory, a processor, and a program stored in the memory and executable on the processor; the processor is configured to read the program in the memory to implement the steps of the method for determining key network vulnerabilities as described in the first aspect.

[0050] In a fourth aspect, an embodiment of the present invention provides a readable storage medium for storing a program, which, when executed by a processor, implements the steps of the method for determining key network vulnerabilities as described in the first aspect.

[0051] The beneficial effect of the present invention is that, in an embodiment of the present invention, the structural indicators and functional indicators of the target network are first calculated, and the target network can be better described from different perspectives through the structural indicators and functional indicators. The overall performance of the target network is comprehensively analyzed by taking the two into consideration, and the state of the target network can be described more accurately; then, maximizing the vulnerability function is used as the objective function, and the objective function is solved based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network. Solving the objective function through the genetic algorithm improves the efficiency of the algorithm solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Attachment Figure 1 A flowchart of a method for determining key network vulnerabilities provided by an embodiment of the present invention;

[0053] Attachment Figure 2 This is an example diagram of the task system network structure;

[0054] Attachment Figure 3 A schematic diagram of a crossover operation provided by an embodiment of the present invention;

[0055] Attachment Figure 4 A schematic diagram of a mutation operation provided by an embodiment of the present invention;

[0056] Attachment Figure 5a It is a trend chart showing the changes of structural indicators with the number of key vulnerable points;

[0057] Attachment Figure 5b It is a trend chart showing the functional indicators changing with the number of key vulnerable points;

[0058] Attachment Figure 5c The trend graph of the ratio of the number of nodes in the maximum connected subgraph changing with the number of key vulnerable points;

[0059] Attachment Figure 5d A trend chart showing the average number of nodes participating in the kill chain as a function of the number of critical vulnerabilities.

[0060] Attachment Figure 6 This is a graph showing the trend of network damage consequences changing with the number of critical vulnerabilities under different attack modes;

[0061] Attachment Figure 7 A schematic diagram of a device for determining key network vulnerabilities provided by an embodiment of the present invention;

[0062] Attachment Figure 8 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0063] In the embodiments of the present application, the term "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. In the embodiments of the present application, the term "multiple" refers to two or more, and other quantifiers are similar. The terms "first", "second", etc. in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first" and "second" are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more.

[0064] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0065] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0066] First, let’s analyze some of the terms used in this application:

[0067] A genetic algorithm (GA) is a search algorithm used in computational mathematics to solve optimization problems and is a type of evolutionary algorithm. In a GA, the population is a set of chromosomes, each representing a candidate solution. When a candidate solution consists of multiple elements, each chromosome contains multiple genes, each of which is a part of the chromosome and corresponds to an element in the candidate solution.

[0068] Each independent entity in the task system network is represented by a node, and the relationship between nodes is represented by an edge. Based on this, the task system network is described as a complex network G = (V, E). For details, see Figure 1 According to the role of the entity in the task system network, the network nodes are divided into four categories:

[0069] Intelligence Node (Intelligence, I): Intelligence nodes (reconnaissance nodes) are used to collect target and battlefield information. Their main functions are target reconnaissance, intelligence acquisition, and battlefield monitoring.

[0070] Command and Control (C): The command and control node has the functions of information processing and analysis, decision support and control entity.

[0071] Firepower Node (Firepower, F). A firepower node (strike node) is a node that operates to attack and destroy targets and has specific functions such as precision strike, firepower strike, and electronic jamming.

[0072] Target node (Target, T). The target node refers to the goal of the task.

[0073] The set of all nodes is denoted as V = I∪C∪F∪T, and the number of nodes of type I, C, F and T are denoted as n I 、n C 、n F and n T E represents the edge set between nodes, including seven types of edge relationships, as follows: Figure 2 As shown in Table 1:

[0074] Table 1. Task system network edge relationship types

[0075]

[0076] Based on this, the embodiments of the present application provide a method, device, electronic device, and storage medium for determining key network vulnerabilities. Figure 1 , Figure 1 This is a flow chart of a method for determining key network vulnerabilities provided by an embodiment of the present invention. The method specifically includes the following steps:

[0077] Step 101, calculating the structural index and functional index of the target network, wherein the target network includes N nodes, the structural index is determined based on the network topology of the target network, and the functional index is used to characterize the performance of the target network in performing tasks, and N is a positive integer.

[0078] Step 102: constructing a vulnerability function based on the structural index and the functional index;

[0079] Step 103: Taking maximizing the vulnerability function as an objective function, solving the objective function based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network, wherein the set of key vulnerable points includes K nodes, where K is a positive integer less than N.

[0080] Wherein, the step 103 specifically includes:

[0081] Determine the initial population, which includes N pInitial chromosomes, N p is a positive integer and an even number;

[0082] Calculating the fitness value of the initial chromosome based on the fragility function;

[0083] performing a genetic operation on the initial population based on the fitness value of the initial chromosome;

[0084] When the termination condition is met, the chromosome with the highest fitness value in the final population obtained by the genetic operation is converted into a key vulnerable point set output of the target network.

[0085] In this embodiment, the target network is a complex network consisting of N nodes, each with different capabilities. For example, the N nodes of the target network can be divided into four different categories based on their specific functions. The first category of nodes is used to collect information, the second category of nodes is used to process information, the third category of nodes is used to execute target tasks, and the fourth category of nodes is used to execute the target tasks.

[0086] In step 101, the structural index and functional index of the target network are first calculated. The structural index and functional index are described below.

[0087] Given the complexity of network topologies and the diversity of potential threats, the key to constructing target network structure indicators lies in accurately identifying and protecting nodes critical to the overall connectivity of the system. By quantifying and analyzing changes in network connectivity efficiency, we can more scientifically identify key nodes and weak links in the target network, thereby formulating targeted protection measures to ensure that the target network maintains unimpeded information links even under extreme conditions, thereby improving the reliability and survivability of the entire target network.

[0088] Structural indicators primarily focus on the integrity of network topology, such as the connectivity between nodes and the connectivity of the network. Structural damage directly impacts the flow of information and resource allocation. A fully connected network is the most compact and robust. The greater the structural difference between a network and a fully connected network, the looser its structure and the lower its robustness.

[0089] In some embodiments, the connectivity efficiency index of the target network is used as a structural index. The specific calculation method of the connectivity efficiency index is as follows:

[0090] Assume d ij is the node V in the network G i 、V j The length of the shortest path between ij For node V i 、V j The length between them is d ij The number of shortest paths, μ(dij ) is a fully connected network G0 with the same number of nodes N as the network G, with nodes Vi, V j The length between them is not greater than d ij The number of paths, then the node V i 、V j The number of equivalent shortest paths between is:

[0091]

[0092] In formula (1), m ij and μ(d ij ) are all elements a in the adjacency matrix A of the network G ij When there is a direct edge between two nodes, r ij =1; for all node pairs (V i , V j ), if r ij =1, the network is a fully connected network.

[0093] The structural difference between network G and the fully connected network can be quantitatively calculated by the number of equivalent shortest paths between nodes. The connectivity efficiency index that characterizes the effectiveness of the target network structure is defined as:

[0094]

[0095] The number of equivalent shortest paths between any nodes in a fully connected network is 1, so S(G0)=1, which has the strongest invulnerability. The connectivity efficiency of any non-fully connected network is S(G)∈(0,1). The larger S(G) is, the more compact the network structure is and the stronger the invulnerability is.

[0096] Even if the network maintains a certain level of connectivity during the completion of a task, failure of key functional nodes or links can prevent the task from being effectively executed. As a specific example, the target network can be the aforementioned task system network, where the N nodes included are the intelligence nodes, command and control nodes, firepower nodes, and target nodes. For ease of description, the following examples will use the task system network as an example.

[0097] According to the "Observe-Orient-Decision-Act" (OODA) cycle theory, the mission completion process can be described as an action loop consisting of a series of activities: observation, judgment, decision-making, and action. Accordingly, the specific process can be described as a series of activities: the reconnaissance node detects the enemy target and transmits the acquired intelligence to the command and control center; the decision-making entity analyzes and processes the intelligence information and formulates an action plan; and the firepower entity executes the target according to the attack instructions issued by the command and control center. This is defined as a kill chain. A kill chain can be understood as a complete link that must include four types of nodes: "target-reconnaissance-command-attack," with communication links between the nodes. A kill chain can pass through multiple intelligence nodes I and command and control nodes C, but can only pass through one firepower node F. The starting and ending nodes of a kill chain are both target nodes. Table 2 shows seven different kill chains.

[0098] Table 2 Kill chain types in the mission system network

[0099]

[0100] In the target network, the ability to complete tasks depends not only on the number of kill chains, but is also closely linked to the quality of the kill chains, which is directly reflected in efficient information processing capabilities. Specifically, an increase in the number of kill chains not only broadens the scope of executable tasks, but also improves the network's redundancy and resource allocation flexibility, thereby enhancing the network's resilience. At the same time, the information transmission efficiency of the link, as a key indicator of quality, is directly related to the reaction agility and responsiveness of the kill chain. High-quality information processing can significantly improve the accuracy and efficiency of command, ultimately enhancing the overall effectiveness and combat effectiveness of the target network. Therefore, in this embodiment, the number and length of kill chains, the information processing efficiency of C nodes, and the collaborative relationship between nodes are simultaneously considered, and the following steps are used to construct the functional indicators of the target network.

[0101] During mission execution, there is a high demand for information timeliness. The success of an operation depends largely on whether information can be accurately and quickly transmitted. The length of the kill chain, a key measure of operational speed, directly corresponds to increased efficiency as it shortens.

[0102] The standard kill chain T→I→C→F→T passes through an I, a C, and an F, respectively, and has the shortest transmission path 2 (not considering the two paths connected to the target node T). Information flow can be completed in just two steps. Therefore, the information transmission efficiency of the kill chain can be defined as:

[0103]

[0104] Among them, d ijis the path length between the first reconnaissance node i and the attack node j in the k-th kill chain.

[0105] In kill chain k, the command and control node C plays a central role, processing reconnaissance information from multiple I-nodes. As the number of connected I-nodes increases, the amount of information C must process also increases, often slowing down its processing speed. At the same time, C also bears the heavy responsibility of assigning strike missions to F-nodes. Connecting to more F-nodes allows for faster task allocation, accelerating the execution of strike operations. Therefore, when evaluating link efficiency, the information processing capacity of the C-node becomes a crucial factor that cannot be ignored.

[0106] In order to quantify this effect, this embodiment uses node degree as a measurement standard. Specifically, the number of F nodes connected to the C node (num CF ) is defined as the information processing capacity of the C node, which reflects its potential parallel processing capability; and the number of I nodes connected to the C node (num IC ) is defined as the actual information processing capacity of node C, which directly reflects its current information processing burden. Based on these two indicators, the information processing capacity of node C is expressed as:

[0107]

[0108] If there are multiple C nodes in a kill chain, the minimum value is taken.

[0109] Therefore, considering the impact of the information processing capability of node C on efficiency, the corrected link efficiency is defined as:

[0110]

[0111] The capability of the kill chain depends not only on the efficiency of link information transmission, but also on the capability of individual functional nodes and the collaborative relationship between nodes. Assuming that the capability of all nodes is the same, which is 1, that is, CA i =1,i∈I∪C∪F.

[0112] Secondly, consider the impact of edge relationships between different nodes on network capabilities:

[0113] If there is an intelligence sharing relationship (II), the accuracy of information can be improved and the ability of the network to complete tasks can be enhanced. The improvement coefficient CA is defined as I-I ~U(1,1.25);

[0114] If there is a collaborative charge relationship (CC), the decision quality can be improved and the network's ability to complete tasks can be increased. The improvement coefficient CA is defined as C-C ~U(1,1.5);

[0115] If there is an information feedback relationship (CI), the intelligence accuracy can be improved to a certain extent, and the improvement coefficient CA is defined C-I ~U(1,1.25).

[0116] Therefore, the kill chain capability is expressed as:

[0117] Ca k ×Eff k =(CA I-I ×CA C-C ×CA C-I )×Eff k (6)

[0118] As kill chain length increases, its efficiency decreases. When evaluating effectiveness, the adverse effects of longer kill chains must be fully considered and measures implemented to mitigate them. To this end, a length-based weighting strategy is employed for kill chains with a length exceeding two: the longer the kill chain, the smaller the weight assigned. This strategy aims to more accurately reflect the differences in capabilities of kill chains of varying lengths in actual missions by adjusting their weights, thereby providing strong support for optimizing mission plans.

[0119] According to the above content, the functional indicators of the target network are:

[0120]

[0121] in Indicates a standard kill chain with a link length of 2. Represents a kill chain with a link length of l (l ≥ 3).

[0122] After determining the target network's structural and functional indicators, the network's structural vulnerability can be measured based on the structural indicators, and its functional vulnerability can be measured based on the functional indicators. Structural vulnerability considers the issue from a passive perspective, namely, whether the target network can maintain the smooth operation of the entire information link system after the failure of key nodes in its structure. Functional vulnerability considers the issue from a proactive perspective, namely, the target network's ability to complete its mission in the event of the failure of key nodes in the target network.

[0123] In step 102, a vulnerability function is constructed based on the structural indicators and the functional indicators. In order to specifically quantify the degree of loss caused by the event of a node being attacked to the efficiency of the entire target network, this embodiment sets two sets of comparison parameters:

[0124] For the original target network that has not been attacked, its structural index and functional index are expressed as S(G) and R(G) respectively; for the target network after being attacked, its structural index and functional index are expressed as S(G') and R(G') respectively.

[0125] The vulnerability (Network Vulnerability, NV) function is constructed as follows:

[0126]

[0127] Here, α is a proportional parameter that expresses the preference between the two measures of structural vulnerability and functional vulnerability.

[0128] In this embodiment, network vulnerability is taken as the starting point, aiming to find key vulnerable points (i.e., nodes with higher vulnerability) that have a significant impact on the overall performance by analyzing the importance of each node in the target network and their mutual correlation, and obtain the key vulnerable point set of the target network.

[0129] Taking the task system network as an example, the decision variables in the key vulnerability determination problem of the above network are defined as:

[0130]

[0131] In actual tasks, attacks on nodes will bring corresponding attack costs, which may include resource consumption, time cost, risk of being discovered, etc. Assume that the attack cost consumed by each node is c i =d i λ . Where d i It represents the degree of each node, and the parameter λ is used as an adjustment factor to flexibly reflect the cost considerations when attacking the node.

[0132] According to the actual situation, this embodiment sets a clear upper limit of attack cost C max , specifically:

[0133]

[0134] Among them, ρ∈[0,1] is the proportional parameter of the total attack cost.

[0135] For the task system, taking maximizing the vulnerability function as the objective function, we can get:

[0136]

[0137] The preset constraints include:

[0138]

[0139] Formula (12) in the preset constraints is used to limit the total attack cost of attacking key vulnerable points to no more than the attack cost upper limit. Formula (13) is used to limit the number of key vulnerable points, K, by selecting K nodes from N nodes as key vulnerable points. The number of nodes selected, K, represents the "strike intensity." Formula (14) is the feasible domain of the decision variable, which characterizes the selection range of key vulnerable points as intelligence nodes, command nodes, and firepower nodes.

[0140] This problem is essentially a network collapse optimization problem. When applying precise algorithms (such as branch-and-bound and enumeration algorithms), the computational effort and time complexity of solving large or complex problems increase dramatically, making the solution impractical. Furthermore, the objective function value is not directly available or explicitly expressed, but requires a separate computational process, further exacerbating the solution's difficulty.

[0141] In order to solve the above function more quickly and efficiently, this embodiment takes maximizing the vulnerability function as the objective function and solves the objective function based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network. The set of key vulnerable points includes K nodes, where K is a positive integer less than N.

[0142] The specific steps of step 103 can be described as follows:

[0143] S1: Determine the initial population, which includes N p Initial chromosomes, N p is a positive integer and an even number;

[0144] S2: Calculating the fitness value of the initial chromosome based on the fragility function;

[0145] S3: performing genetic operations on the initial population based on the fitness value of the initial chromosome;

[0146] S4: When the termination condition is met, the chromosome with the highest fitness value in the final population obtained by the genetic operation is converted into a key vulnerable point set output of the target network.

[0147] In this embodiment, based on the idea of ​​genetic algorithm, each step is adaptively adjusted according to the above objective function. The implementation method of each step will be described in detail below, taking the target network as the task system network as an example.

[0148] In this embodiment, the adjacency matrix A of the target network G is encoded using a one-dimensional 0-1 vector L. Elements in the adjacency matrix are encoded as 0 or 1. Based on the edge relationship type shown in Table 1, a 1 indicates a connection between two nodes; a 0 indicates a connection between two nodes without any relationship. Therefore, the target network G is represented as a directed network.

[0149] When establishing the adjacency matrix A, it is necessary to establish corresponding sub-matrices for different types of connection relationships, namely intelligence-intelligence matrix (II), intelligence-command matrix (IC), command-command matrix (CC), command-intelligence matrix (CI), command-fire matrix (CF), fire-target matrix (FT), and target-intelligence matrix (TI). Then, the seven sub-matrices are merged to form the relationship matrix A of all nodes. The encoding of the seven types of matrices is similar. Taking the intelligence-command relationship as an example, the matrix W I-C (dimension n I ×n C ) is expressed as:

[0150]

[0151] By traversing the matrix W row by row I-C , and put the elements of each row into the one-dimensional vector L in order I-C In the conversion from matrix to one-dimensional vector, vector L I-C Length is n I ×n C The encoding vector corresponding to the adjacency matrix A is finally expressed as L = [L I-I ,L I-C ,L C-C ,L C-I ,L C-F ,L F-T ,L T-I ].

[0152] After constructing the adjacency matrix A, given the random nature of inter-node connections, a unique situation may arise: some target-type nodes become isolated due to a lack of a complete strike chain (i.e., there is no path from the firepower node, through the command and control node, and ultimately to the target node). This type of problem primarily exists in the target-intelligence matrix (TI).

[0153] In some embodiments, after constructing the target-intelligence matrix, the method further includes traversing all target-type nodes to check whether they are connected to any intelligence nodes. For isolated target nodes, a connection to an existing intelligence node is randomly selected and established, thereby ensuring that every target node in the network maintains at least some connection with the intelligence system, thus preventing nodes from becoming isolated.

[0154] In the specific calculation, all nodes with a value of 1 in each feasible solution of the above model constitute the key vulnerable point set Q. To avoid performing complex operations directly on the adjacency matrix of a complex network, the nodes of the target network are first encoded to identify the nodes to be attacked and their associated lines. The destructive effect of deleting the nodes on the target network can then be calculated, providing the necessary input data for subsequent fitness value evaluation and algorithm iterative optimization process.

[0155] The implementation process of the encoding algorithm is specifically described as follows: Initialize a length of n I +n C +n F A one-dimensional vector X, expressed as X = [x I1 ,x I2 ,..,x C1 ,x C2 ,..x F1 ,x F2 ,..] = [0,0,...,0], traverses the set Q of critical vulnerabilities to be attacked, and sets the corresponding position of each node in Q in vector X to 1, thus completing the encoding of the attack plan. The decoding algorithm operates in reverse, taking vector X as input, parsing the positions of the 1 values, and mapping the results back to the nodes in the target network, forming the set Q of critical vulnerabilities to be attacked. The specific encoding process can be found in the relevant content and is not limited here.

[0156] In step S1, an initial population is first determined, which is used to represent the initial candidate solution set of the objective function. As an optional implementation, the initial population can be constructed by random sampling or other methods, which are not specifically limited here.

[0157] As another optional implementation, the determining the initial population includes:

[0158] Based on the node extraction probability, a sampling operation is performed on the N nodes to obtain 3n p The initial chromosomes, n p is a positive integer, and the extraction probability of the node is positively correlated with the importance of the node;

[0159] Execute N on the N nodes p -3n p Rounds of random sampling operations, get N p -3n p The initial chromosomes.

[0160] In this embodiment, the node extraction probability is used to describe the chance of the node being selected during the sampling process. Based on the node extraction probability, the row sampling operation is performed to obtain 3n pInitial chromosomes constitute the core component of the initial population diversity. Since the importance of a node is positively correlated with the probability of node extraction, the more important nodes in the target network are, the greater the probability of being selected, making the quality of the initial population higher. p -3n p ) chromosomes, and a random sampling strategy is adopted to maintain the diversity and randomness of the population and ensure the extensiveness of the algorithm's exploration space.

[0161] Furthermore, in some other embodiments, the sampling operation is performed on the N nodes based on the node extraction probability to obtain 3n p The initial chromosomes include:

[0162] For each of the N nodes, determining a first importance of the node based on the degree centrality of the node, determining a second importance of the node based on the betweenness centrality of the node, and determining a third importance of the node based on the clustering coefficient of the node;

[0163] Determining a first extraction probability of the node based on the first importance of the node, determining a second extraction probability of the node based on the second importance of the node, and determining a third extraction probability of the node based on the third importance of the node;

[0164] Based on the first extraction probability of the node, a sampling operation is performed on the N nodes to obtain n p The initial chromosomes are sampled based on the second extraction probability of the nodes to obtain n p The initial chromosomes are sampled based on the third extraction probability of the nodes to obtain n p The initial chromosomes.

[0165] In this embodiment, degree centrality, betweenness centrality, and clustering coefficient are used to evaluate the importance of nodes. The above evaluation methods not only ensure the rationality of the initial population, but also ensure the diversity of the evaluation methods, thereby improving the accuracy of the evaluation results.

[0166] In a specific embodiment, K rounds of non-repeated sampling are performed to select K nodes from the target network as key vulnerable points. Each round of sampling is performed independently based on the three evaluation methods (degree centrality, betweenness centrality and clustering coefficient) mentioned above, and each method generates n p Initial chromosomes, generating a total of 3n p initial chromosomes.

[0167] It should be understood that, in a specific implementation, N p Represents the total number of individuals in the population, N p Should be an even number to ensure the smooth progress of subsequent genetic operations (such as crossover operations), where n p It is used to control the ratio of initial chromosomes obtained by different extraction methods, and its value is not limited here. p =100,n p =N p / 4, and construct the initial population accordingly.

[0168] In step S2, the fitness value of the initial chromosome is calculated based on the fragility function. The fitness value is used to judge the quality of the chromosome. Since the objective function is to maximize the fragility function, in some embodiments, the fragility function can be directly used as the calculation function of the fitness value, and at the same time, the calculation result should ensure that the preset constraints are met.

[0169] In other embodiments, a penalty function-based strategy is provided to evaluate the fitness value of chromosomes. This approach can effectively guide the algorithm search process and avoid generating unrealistic solutions. The specific process is as follows:

[0170] First, for each chromosome in the algorithm, calculate its corresponding total attack cost, and then evaluate whether the chromosome meets the cost constraint, that is, the aforementioned preset constraint formula (12). Then, compare the calculated total cost with the attack cost upper limit C max Compare. If the total cost does not exceed C max , then the chromosome is deemed to meet the preset constraints, and its fitness value will be directly calculated based on its performance index without additional adjustment. For individuals that violate the cost constraint, that is, the total cost exceeds C max For individuals that violate the constraint, the original fitness value is directly subtracted, that is, NV = NV-1, to ensure that the fitness value of these violating individuals is significantly lower than that of individuals that meet the constraint. The above embodiment uses a negative feedback mechanism to gradually eliminate high-cost individuals in subsequent iterations, thereby leading to a solution that better meets actual needs.

[0171] In step S3, a genetic operation is performed on the initial population based on the fitness value of the initial chromosome, specifically including a selection operation, a crossover operation, and a mutation operation. In some embodiments, the genetic operation is performed on the initial population based on the fitness value of the initial chromosome, including:

[0172] Based on the fitness value of the initial chromosome, selecting a plurality of the initial chromosomes from the initial population as parents to enter the mating pool;

[0173] Performing a crossover operation on the initial chromosomes in the mating pool according to a preset crossover strategy and a mutation operation according to a preset mutation strategy until the termination condition is met.

[0174] The initial population is ranked and evaluated based on its fitness, followed by an elite selection strategy, whereby individuals with the best fitness are selected as parents to enter the mating pool. This approach preserves high-quality genotypes within the population, laying the foundation for subsequent genetic manipulation.

[0175] As can be seen from the preceding, each chromosome contains multiple genes, each of which is coded as either 1 or 0. A gene coded as 1 indicates that the node corresponding to that gene is a critical vulnerability. During genetic manipulation, the number of critical vulnerability points in each chromosome should be fixed. Therefore, to ensure that the total number of genes coded as "1" remains constant during the genetic process, this embodiment proposes a preset crossover strategy and a preset mutation strategy.

[0176] In some embodiments, the preset crossover strategy includes: when crossing between a first chromosome and a second chromosome, if an exchange of a gene coded as 1 with a gene coded as 0 occurs at the first position, then an exchange of a gene coded as 0 with a gene coded as 1 is performed at the second position, the first chromosome and the second chromosome are any pair of chromosomes, and the first position and the second position are symmetrical.

[0177] Optionally, performing the crossover operation according to a preset crossover strategy includes:

[0178] Determine the crossover probability P c , initial values ​​of the first counter cn1 and the second counter cn2;

[0179] Execute N p Iterative cross processing, wherein the cross processing includes:

[0180] Generate a first random number r in the interval [0,1]. If r is less than P c , then execute this cross processing, otherwise, execute the next cross processing;

[0181] Generate a random position array to determine the intersection point c; traverse the random position array; if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 0, cn1=cn1+1; if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 1, cn2=cn2+1;

[0182] Determine the number k of gene pairs that need to be exchanged simultaneously, where k is the smaller value of cn1 and cn2, perform symmetric crossover at the corresponding k positions, and then reset cn1=0 and cn2=0.

[0183] See Figure 3 As a specific embodiment, the specific implementation process of the cross operation is as follows:

[0184] Initialize the crossover probability P c =0.9, and initialize counters cn1, cn2 and iteration index i to 0.

[0185] Repeat the following steps ac until the termination condition is met:

[0186] a. Let i = i + 1, generate a random number r in the interval [0,1]. If r is less than P c , then perform the crossover operation; otherwise, continue to the next iteration.

[0187] b. Generate an array of random positions, place, to determine the intersection point c. Traverse the array. If the chromosome gene at position c is coded as 1 and the other chromosome gene is coded as 0, cn1 = cn1 + 1; if the chromosome gene at position c is coded as 0 and the other chromosome gene is coded as 1, cn2 = cn2 + 1.

[0188] c. Determine the number k of gene pairs to be exchanged simultaneously, where k is the smaller of cn1 and cn2. Perform a symmetrical crossover at the corresponding k positions, ensuring that the exchange of genes 1 and 0 is reflected in the opposite direction on the other chromosome. Then reset cn1 = 0 and cn2 = 0.

[0189] When i=N p The crossover operation ends when .

[0190] In some embodiments, the preset mutation strategy includes: if a mutation operation is performed at the third position, changing a gene coded as 0 to a gene coded as 1, randomly determining a gene coded as 1 with a symmetric feature and changing the code to 0.

[0191] Optionally, the mutation operation according to a preset mutation strategy includes:

[0192] Determine the mutation probability P m The initial value of

[0193] For each pair of chromosomes after the crossover operation, a second random number d is generated with a coding range between 0 and 1. <P m When , the mutation operation is performed on the pair of chromosomes, otherwise, the next pair of chromosomes is processed;

[0194] Create two arrays loc0 and loc1 respectively to record the gene positions of all genes coded as 0 and 1 in the chromosome; randomly select a position lj0 from loc0, change the gene code at lj0 from 0 to 1, check whether loc1 is not empty, and randomly select a position lj1 and change its gene code from 1 to 0.

[0195] After completing the crossover operation of the chromosome pair, the mutation operation is then performed on these newly generated chromosomes. Figure 4 As a specific embodiment, the specific implementation process of the mutation operation is as follows:

[0196] Initialize mutation probability P m =0.1.

[0197] For each pair of chromosomes after the crossover operation, a random number d is generated between 0 and 1. <P m , perform mutation operation on the chromosome; otherwise, continue to process the next pair of chromosomes.

[0198] Create two arrays, loc0 and loc1, to record the positions of all gene bits in the chromosome that are coded as 0 and 1, respectively. Randomly select a position lj0 from loc0 and change the gene value at lj0 from 0 to 1. To keep the total number of "1"s unchanged, check whether loc1 is non-empty and randomly select a position lj1 (if it has not been used for this purpose before) and change its gene value from 1 to 0 to achieve symmetry adjustment.

[0199] In the above embodiment, for solving the objective function, the selection operation, crossover operation and mutation operation are adaptively set accordingly based on the basic idea of ​​the genetic algorithm. The above method can improve the efficiency and convenience of solving the objective function.

[0200] The following is a description of the beneficial effects of the method of the embodiment of the present application in conjunction with specific experiments. In this experiment, the target network is the above-mentioned task system network, including 22 intelligence nodes, 16 command nodes, 22 fire nodes, and 10 target nodes, i.e., n I =22,n C =16,n F =22,n T =10, the total number of network nodes NodeTNum = 70. In the experiment, the attack cost parameter λ of the individual node is set to 0.2, and the total cost parameter is as follows:

[0201]

[0202] This experiment uses ER random network to initialize the adjacency matrix. In the ER random network initialization, the edges between nodes are randomly generated with a certain probability. The generation probability parameter is set as: f II =0.06, f IC =0.06, f CC =0.06, f CF =0.06, f CI =0.06, f FT =0.10,f TI =0.10. For example, f IC indicates that edges from type I nodes to type C nodes are randomly generated with a probability of 0.06. To reduce the randomness of the experimental results, we independently replicated the network 50 times and averaged the output results of these instances to ensure the robustness and reliability of the experimental conclusions. The number of critical vulnerabilities (in this embodiment, this can refer to the number of attack nodes) K is set to a value range of K = {1, 2, ..., 15}.

[0203] The evaluation indicators used in this embodiment, in addition to the aforementioned structural indicators and functional indicators, also include:

[0204] Maximum connected subgraph node ratio (Ratio):

[0205]

[0206] Where N represents the total number of nodes in the original intact target network, K is the number of nodes attacked, and C is the number of nodes in the largest connected subgraph after the attack. The Ratio is a direct measure of the network's remaining connectivity after the attack. A low ratio indicates severe structural damage to the network, potentially leading to the formation of numerous information islands and severely impacting efficiency.

[0207] Average number of kill chains involved per node (No.kc): This is a functional metric that measures the average number of kill chains formed by each node in the network to execute a task. A high value indicates that nodes in the network are more likely to participate in the task. Even if some nodes fail, other nodes can quickly take over the task, ensuring continuity and effectiveness.

[0208] As shown in the above formula (8), the parameter α represents the decision maker's preference for the two metrics of structural indicators and functional indicators. This section systematically compares the impact of various parameter values ​​on the network attack response effect by adjusting the preference coefficient variable, in order to reveal the mechanism of the preference mechanism in the target network. Specifically, the experimental analysis is conducted for the preference coefficient value α = {0.2, 0.4, 0.6, 0.8}. Figure 5a-5d The trend of the four types of indicator values ​​changing with the number of key vulnerable points K is shown.

[0209] according to Figure 5a-5d The following conclusions can be drawn from the results shown:

[0210] As K increases, Figure 5a and Figure 5c Two structural indicators, Figure 5b and Figure 5d The two functional indicators showed a high degree of similarity in their changing trends.

[0211] On the one hand, the structural metrics S(G') and Ratio are both closely related to the reduction in connected paths in the network, which is a key factor in assessing network resilience. The S(G') metric directly reflects the robustness of the network structure by quantifying the degree of structural deviation from a fully connected state. The Ratio metric, on the other hand, provides a direct measure of the network's ability to maintain connectivity after damage by calculating the ratio of the number of nodes in the largest connected subgraph to the number of remaining undamaged nodes. The high similarity between the two metrics indicates that the structural stability and connectivity of the network show a consistent downward trend after damage.

[0212] Meanwhile, the functional indicator R(G') comprehensively considers the number and length of kill chains, the information processing efficiency of command and control nodes, and the collaborative relationships between nodes. These factors together determine the network's ability to immediately complete its mission after a strike. The trend of R(G') is similar to that of No.kc, indicating that the activeness of nodes participating in the kill chain is an important indicator of network functionality.

[0213] As K increases, Figure 5a and 5c The structural index values ​​gradually decrease (showing a slash shape), while Figure 5b and 5d The functional index value decreases sharply when K=1, 2, 3.

[0214] On the one hand, the structural indicators S(G') and Ratio values ​​gradually decrease with increasing K, indicating that the network's connectivity is gradually decreasing. This is because each attack removes nodes from the network, disrupting the network's topology and reducing the available paths and the size of the connected subgraph. This decreasing trend, which takes the form of a diagonal line, indicates that the decline in network connectivity is continuous and predictable, and is proportional to the increase in K.

[0215] On the other hand, the functional indicators R(G') and No.kc values ​​decrease sharply when K = 1, 2, and 3, indicating that the network's functional state is highly sensitive to the failure of a few key nodes. These key nodes may be hub nodes, command nodes, or nodes with special functions. Their failure can rapidly impact the network's capabilities, information processing efficiency, and synergies. The sharp decrease in the functional indicator values ​​suggests a possible nonlinear relationship between functional decline and structural change. This nonlinear relationship may be caused by the complex dependencies and synergies within the network. For example, the failure of a key node may not only affect its directly connected nodes but also trigger a chain reaction through the breakdown of synergies, leading to a rapid decline in the functionality of the entire network.

[0216] While the weights assigned to each indicator in assessing network vulnerability vary, the degree of network damage they reflect is relatively consistent, further validating the close connection between network structure and function. Despite differing assessment focuses, the objective reality of critical node failures ensures consistency across indicators in reflecting network damage.

[0217] Specifically, the consequences of cyberattacks reach their maximum when the preference coefficient α = 0.4, indicating that at this weight, structural and functional indicators achieve a good balance. When α = 0.8, the indicators Ratio, S(G'), and R(G') all perform poorly, reflecting the limited impact of attacks on the task system network under this preference coefficient. This suggests that when assessing network vulnerability, it is important to consider both the network's structural integrity (to ensure smooth information flow) and its functional effectiveness (to ensure successful mission execution). If the α value is too high (biased towards structural indicators), the network's physical connectivity may be overemphasized, thereby underestimating network vulnerability. For example, even if the network structure maintains high connectivity, the failure of a key functional node may still result in mission failure. Conversely, if the α value is too low (biased towards functional indicators), the network's survivability may be overestimated. Although networks are diverse and flexible, severe structural damage can severely impact information flow and resource allocation.

[0218] In summary, the mission system network vulnerability measurement indicators constructed in this application are reasonable and effective. In particular, among all the preset preference coefficients, α = 0.4 was confirmed to have the strongest destructive power to the mission system network and the best overall response effect. This provides a strong theoretical basis and practical guidance for the optimization design and protection strategy of actual mission system networks. In actual applications, the weights of structural and functional indicators should be reasonably adjusted according to the specific characteristics of the network and mission requirements to achieve a comprehensive and accurate assessment of network vulnerability and the consequences of attacks.

[0219] Furthermore, by setting the preference coefficient α to 0.4, we can further analyze the impact of the attack modes represented by different initialization strategies in the GA algorithm on the consequences of the task system network attack. The following details the five node attack modes used:

[0220] Random attack. This strategy, as a benchmark comparison method, gives each node in the network an equal probability of being selected during the algorithm initialization phase, thereby simulating attack behavior under conditions with no prior knowledge or limited information.

[0221] Degree-prioritized attack. Assuming the adversary has comprehensive knowledge of the network structure, this strategy selects initial attack targets based on node degrees, subject to cost constraints. The degree reflects the number of direct connections a node has within the network; the larger the degree, the greater the probability of being selected as a priority target.

[0222] Similar to the degree-first attack mode, the betweenness-first strategy focuses on the betweenness value of a node during algorithm initialization, that is, the number of times a node appears on all shortest paths in the network.

[0223] Clustering coefficient priority attack. Similar to the degree priority attack mode, this strategy focuses on the clustering coefficient value of the node to select the initial attack target during algorithm initialization.

[0224] maxNV attack. This strategy is the attack mode under the hybrid initialization strategy proposed in this application. It integrates multi-dimensional information such as node degree, betweenness value, clustering coefficient, and randomness to select the initial attack node in a more flexible and comprehensive way.

[0225] Figure 6 The following key conclusions can be drawn from the depiction of the changing trends of network attack consequences under different attack modes as the number of attacked nodes K changes:

[0226] The maxNV attack mode can create a higher network vulnerability (NV) value for the same number of attacked nodes, and its convergence speed is significantly faster than other attack modes. The maxNV attack mode performs well because it considers multiple network characteristics. It may be close to the optimal solution at initialization, or its iteration process is more efficient, allowing it to more accurately identify key nodes in the network.

[0227] Overall, attack patterns based on the clustering coefficient are the least effective, while attack patterns based on degree, betweenness, and random attacks are similar in effectiveness. The clustering coefficient primarily reflects the degree of local clustering of network nodes, but these local connections may not be decisive for the network's global connectivity. Therefore, selecting initial attack nodes based solely on the clustering coefficient may not effectively disrupt the overall network structure, resulting in poor attack effectiveness. Strategies such as degree, betweenness, and random attacks focus more on the global characteristics or randomness of the network, which are often more relevant to the network's overall connectivity and functionality. Therefore, these strategies offer similar attack efficiency, but to some extent, none of them fully consider network characteristics like maxNV.

[0228] As the number of attack nodes increases, the overall destructive effect of all attack modes on the network tends to be consistent. This may be because when the number of attack nodes is large, the network's R(G') gradually approaches 0 (e.g. Figure 5a-5d As shown in Figure 2, the change in the overall objective function is more due to the connectivity efficiency indicator S(G'). As the number of attack nodes increases, the network structure gradually collapses, making the differences between different strategies less significant.

[0229] In summary, the experimental results validate the effectiveness of the maxNV hybrid initialization strategy for attack and provide insights into understanding and designing more robust network systems. For example, by increasing redundant connections, optimizing node layout, or introducing defense mechanisms to improve network resilience, we can enhance the mission system network's ability to resist various types of attacks.

[0230] See Figure 7 The embodiment of the present invention further provides a device 700 for determining a key vulnerability point in a network, comprising:

[0231] A calculation module 701 is configured to calculate a structural index and a functional index of a target network, wherein the target network includes N nodes, the structural index is determined based on the network topology of the target network, and the functional index is used to characterize the performance of the target network in performing a task, where N is a positive integer.

[0232] A construction module 702 is configured to construct a vulnerability function based on the structural index and the functional index;

[0233] A solution module 703 is configured to solve the objective function based on a genetic algorithm under preset constraints, taking maximization of the vulnerability function as an objective function, to obtain a set of key vulnerable points of the target network, where the set of key vulnerable points includes K nodes, where K is a positive integer less than N.

[0234] The solution module 703 includes:

[0235] A determination unit is used to determine an initial population, wherein the initial population includes N p Initial chromosomes, N p is a positive integer and an even number;

[0236] A calculation unit, configured to calculate the fitness value of the initial chromosome based on the fragility function;

[0237] an execution unit, configured to perform a genetic operation on the initial population based on the fitness value of the initial chromosome;

[0238] The output unit is used to convert the chromosome with the highest fitness value in the final population obtained by genetic operation into a set of key vulnerable points of the target network and output it when the termination condition is met.

[0239] Optionally, the determining unit includes:

[0240] The first sampling subunit is used to perform a sampling operation on the N nodes based on the sampling probability of the nodes to obtain 3n p The initial chromosomes, n p is a positive integer, and the extraction probability of the node is positively correlated with the importance of the node;

[0241] The second sampling subunit is used to perform N on the N nodes. p -3n p Rounds of random sampling operations, get N p -3n p The initial chromosomes.

[0242] Optionally, the first sampling subunit is specifically configured to:

[0243] For each of the N nodes, determining a first importance of the node based on the degree centrality of the node, determining a second importance of the node based on the betweenness centrality of the node, and determining a third importance of the node based on the clustering coefficient of the node;

[0244] Determining a first extraction probability of the node based on the first importance of the node, determining a second extraction probability of the node based on the second importance of the node, and determining a third extraction probability of the node based on the third importance of the node;

[0245] Based on the first extraction probability of the node, a sampling operation is performed on the N nodes to obtain n p The initial chromosomes are sampled based on the second extraction probability of the nodes to obtain n p The initial chromosomes are sampled based on the third extraction probability of the nodes to obtain n pThe initial chromosomes.

[0246] Optionally, the execution unit includes:

[0247] A selection subunit is configured to select a plurality of the initial chromosomes from the initial population as parents to enter a mating pool based on the fitness values ​​of the initial chromosomes;

[0248] The execution subunit is used to perform a crossover operation on the initial chromosomes in the mating pool according to a preset crossover strategy and a mutation operation according to a preset mutation strategy until the termination condition is met.

[0249] Optionally, the chromosome comprises a plurality of genes, each of which is coded as 1 or 0;

[0250] The preset crossover strategy includes: when performing a crossover between a first chromosome and a second chromosome, if a gene coded as 1 is exchanged with a gene coded as 0 at a first position, then a gene coded as 0 is exchanged with a gene coded as 1 at a second position, the first chromosome and the second chromosome being any pair of chromosomes, and the first position and the second position being symmetrical;

[0251] and / or;

[0252] The preset mutation strategy includes: if a mutation operation is performed at the third position, and a gene coded as 0 is changed to a gene coded as 1, a gene coded as 1 with a symmetric feature is randomly determined and its code is changed to 0.

[0253] Optionally, performing the crossover operation according to a preset crossover strategy includes:

[0254] Determine the crossover probability P c , initial values ​​of the first counter cn1 and the second counter cn2;

[0255] Execute N p Iterative cross processing, wherein the cross processing includes:

[0256] Generate a first random number r in the interval [0,1]. If r is less than P c , then execute this cross processing, otherwise, execute the next cross processing;

[0257] Generate a random position array to determine the intersection point c; traverse the random position array; if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 0, cn1=cn1+1; if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 1, cn2=cn2+1;

[0258] Determine the number k of gene pairs that need to be exchanged simultaneously, where k is the smaller value of cn1 and cn2, perform symmetric crossover at the corresponding k positions, and then reset cn1=0 and cn2=0.

[0259] Optionally, the mutation operation according to a preset mutation strategy includes:

[0260] Determine the mutation probability P m The initial value of

[0261] For each pair of chromosomes after the crossover operation, a second random number d is generated with a coding range between 0 and 1. <P m When , the mutation operation is performed on the pair of chromosomes, otherwise, the next pair of chromosomes is processed;

[0262] Create two arrays loc0 and loc1 respectively to record the gene positions of all genes coded as 0 and 1 in the chromosome; randomly select a position lj0 from loc0, change the gene code at lj0 from 0 to 1, check whether loc1 is not empty, and randomly select a position lj1 and change its gene code from 1 to 0.

[0263] The apparatus 700 for determining key network vulnerabilities provided in the embodiment of the present application can execute the above method embodiment, and its implementation principles and technical effects are similar, which will not be described in detail in this embodiment.

[0264] It should be noted that the division of units in the embodiments of the present application is schematic and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0265] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0266] like Figure 8 As shown, an embodiment of the present application provides an electronic device 800, including: a memory 802, a processor 801, and a program stored on the memory 802 and executable on the processor 801; the processor 801 is configured to read the program in the memory 802 to implement the steps in the method for determining key network vulnerabilities as described above.

[0267] An embodiment of the present application also provides a readable storage medium, on which a program is stored. When the program is executed by a processor, the various processes of the above-mentioned embodiment of the method for determining key network vulnerabilities are implemented, and the same technical effects can be achieved. To avoid repetition, they are not described here. Among them, the readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (such as compact disk (CD), digital video disc (DVD), Blu-ray disc (BD), high-definition versatile disc (HVD), etc.), and semiconductor memory (such as read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read only memory (EEPROM), non-volatile memory (NAND FLASH), solid state drive (SSD), etc.).

[0268] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0269] Through the description of the above embodiments, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD-ROM), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0270] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

Claims

1. A method for determining key network vulnerabilities, characterized by: include: Calculating structural indicators and functional indicators of a target network, wherein the target network includes N nodes, the structural indicators are determined based on the network topology of the target network, and the functional indicators are used to characterize the effectiveness of the target network in performing tasks, where N is a positive integer; constructing a vulnerability function based on the structural index and the functional index; Taking maximizing the vulnerability function as an objective function, solving the objective function based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network, wherein the set of key vulnerable points includes K nodes, where K is a positive integer less than N; The objective function is to maximize the vulnerability function, and the objective function is solved based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network, including: Determine the initial population, which includes N p Initial chromosomes, N p is a positive integer and an even number; Calculating the fitness value of the initial chromosome based on the fragility function; performing a genetic operation on the initial population based on the fitness value of the initial chromosome; When the termination condition is met, the chromosome with the highest fitness value in the final population obtained by the genetic operation is converted into a set of key vulnerable points of the target network and output; Wherein, determining the initial population includes: Based on the node extraction probability, a sampling operation is performed on the N nodes to obtain 3n p The initial chromosomes, n p is a positive integer, and the extraction probability of the node is positively correlated with the importance of the node; Execute N on the N nodes p -3n p Rounds of random sampling operations, get N p -3n p the initial chromosomes; Wherein, the sampling operation is performed on the N nodes based on the node extraction probability to obtain 3n p The initial chromosomes include: For each of the N nodes, determining a first importance of the node based on the degree centrality of the node, determining a second importance of the node based on the betweenness centrality of the node, and determining a third importance of the node based on the clustering coefficient of the node; Determining a first extraction probability of the node based on the first importance of the node, determining a second extraction probability of the node based on the second importance of the node, and determining a third extraction probability of the node based on the third importance of the node; Based on the first extraction probability of the node, a sampling operation is performed on the N nodes to obtain n p The initial chromosomes are sampled based on the second extraction probability of the nodes to obtain n p The initial chromosomes are sampled based on the third extraction probability of the nodes to obtain n p The initial chromosomes.

2. The method according to claim 1, wherein: The performing of a genetic operation on the initial population based on the fitness value of the initial chromosome comprises: Based on the fitness value of the initial chromosome, selecting a plurality of the initial chromosomes from the initial population as parents to enter the mating pool; Performing a crossover operation on the initial chromosomes in the mating pool according to a preset crossover strategy and a mutation operation according to a preset mutation strategy until the termination condition is met.

3. The method according to claim 2, wherein: A chromosome includes a plurality of genes, each of which is coded as 1 or 0; The preset crossover strategy includes: when performing a crossover between a first chromosome and a second chromosome, if a gene coded as 1 is exchanged with a gene coded as 0 at a first position, then a gene coded as 0 is exchanged with a gene coded as 1 at a second position, the first chromosome and the second chromosome being any pair of chromosomes, and the first position and the second position being symmetrical; and / or; The preset mutation strategy includes: if a mutation operation is performed at the third position, and a gene coded as 0 is changed to a gene coded as 1, a gene coded as 1 with a symmetric feature is randomly determined and its code is changed to 0.

4. The method according to claim 3, wherein: The performing the crossover operation according to the preset crossover strategy includes: Determine the crossover probability P c , initial values ​​of the first counter cn1 and the second counter cn2; Execute N p Iterative cross processing, wherein the cross processing includes: Generate a first random number r in the interval [0,1]. If r is less than P c , then execute this cross processing, otherwise, execute the next cross processing; Generate a random position array to determine the intersection point c; traverse the random position array; if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 0, cn1=cn1+1; if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 1, cn2=cn2+1; Determine the number k of gene pairs that need to be exchanged simultaneously, where k is the smaller value of cn1 and cn2, perform symmetric crossover at the corresponding k positions, and then reset cn1=0 and cn2=0.

5. The method according to claim 3, wherein: The mutation operation according to the preset mutation strategy includes: Determine the mutation probability P m The initial value of For each pair of chromosomes after the crossover operation, a second random number d is generated with a coding range between 0 and 1. <P m When , the mutation operation is performed on the pair of chromosomes, otherwise, the next pair of chromosomes is processed; Create two arrays loc0 and loc1 respectively to record the gene positions of all genes coded as 0 and 1 in the chromosome; randomly select a position lj0 from loc0, change the gene code at lj0 from 0 to 1, check whether loc1 is not empty, and randomly select a position lj1 and change its gene code from 1 to 0.

6. A device for determining key network vulnerabilities, characterized in that: include: a calculation module, configured to calculate structural indicators and functional indicators of a target network, wherein the target network includes N nodes, the structural indicators are determined based on a network topology of the target network, and the functional indicators are used to characterize the effectiveness of the target network in performing a task, where N is a positive integer; A construction module, configured to construct a vulnerability function based on the structural indicator and the functional indicator; A solution module is configured to solve the objective function based on a genetic algorithm under preset constraints by maximizing the vulnerability function to obtain a set of key vulnerable points of the target network, where the set of key vulnerable points includes K nodes, where K is a positive integer less than N; Wherein, the solution module includes: A determination unit is used to determine an initial population, wherein the initial population includes N p Initial chromosomes, N p is a positive integer and an even number; A calculation unit, configured to calculate the fitness value of the initial chromosome based on the fragility function; an execution unit, configured to perform a genetic operation on the initial population based on the fitness value of the initial chromosome; An output unit is used to convert the chromosome with the highest fitness value in the final population obtained by the genetic operation into a set of key vulnerable points of the target network and output it when the termination condition is met; Wherein, the determining unit includes: The first sampling subunit is used to perform a sampling operation on the N nodes based on the sampling probability of the nodes to obtain 3n p The initial chromosomes, n p is a positive integer, and the extraction probability of the node is positively correlated with the importance of the node; The second sampling subunit is used to perform N on the N nodes. p -3n p Rounds of random sampling operations, get N p -3n p the initial chromosomes; Wherein, the first sampling subunit is specifically used for: For each of the N nodes, determining a first importance of the node based on the degree centrality of the node, determining a second importance of the node based on the betweenness centrality of the node, and determining a third importance of the node based on the clustering coefficient of the node; Determining a first extraction probability of the node based on the first importance of the node, determining a second extraction probability of the node based on the second importance of the node, and determining a third extraction probability of the node based on the third importance of the node; Based on the first extraction probability of the node, a sampling operation is performed on the N nodes to obtain n p The initial chromosomes are sampled based on the second extraction probability of the nodes to obtain n p The initial chromosomes are sampled based on the third extraction probability of the nodes to obtain n p The initial chromosomes.

7. An electronic device comprising: A memory, a processor, and a program stored in the memory and executable on the processor; wherein the processor is configured to read the program in the memory to implement the steps of the method for determining a critical vulnerability of a network as claimed in any one of claims 1 to 5.

8. A readable storage medium for storing a program, characterized in that: When the program is executed by a processor, the steps of the method for determining a network critical vulnerability point according to any one of claims 1 to 5 are implemented.

Images