Quantitative analysis method for four core capabilities of network elasticity

Abstract

The invention relates to the technical field of network elasticity evaluation, in particular to a quantitative analysis method for four core capabilities of network elasticity, which comprises the following steps: building a system to be analyzed, constructing a threat model, attacking the system to be analyzed, and further collecting performance values shown by key functions at each moment in a preset time period; summarizing performance values shown by a certain key function at each moment, and drawing a function change scatter diagram, the horizontal axis of the function change scatter diagram being time, and the longitudinal axis being the performance value shown by the certain key function; and carrying out image analysis on the function change scatter diagram, and determining the resistance capability, the recovery capability, the perception capability and the adaptive capability of the to-be-analyzed system. The method not only has the advantages of being objective, accurate and comparable, but also can analyze the network elasticity capability shown in the four stages when the system function is attacked, so that the elasticity capability of the system can be analyzed more deeply.

Description

Technical Field

[0001] The present invention relates to the technical field of network resilience assessment, and in particular to a quantitative analysis method of four core capabilities of network resilience. Background Art

[0002] Existing network resilience testing methods are mainly divided into two categories, namely qualitative analysis and quantitative analysis. Among them, qualitative analysis refers to a method in which experts conduct subjective evaluation based on relevant evaluation indicators. This method is relatively easy to implement and does not require high measurement tools, but this method is highly subjective, that is, the accuracy of the test results may be affected by the subjective factors of experts and lack comparability. However, the same system has different evaluation indicators in different environments or at different times, and comparative analysis is required. Compared with qualitative analysis, quantitative analysis focuses on quantifying data through methods such as numerical and statistical analysis to facilitate measurement and comparison, and has strong objectivity. The test results are completely determined by the data displayed by the system, and no subjective evaluation by experts is required.

[0003] However, the current quantitative analysis method can only obtain the final network resilience value, and cannot reflect the core capabilities of the system in the four stages, namely, perception, resistance, recovery and adaptation. The lack of evaluation of network resilience at different stages will lead to misunderstanding of the overall resilience of the network, limit the ability to respond to dynamic changes, and may cause deficiencies in resource allocation, strategy formulation and risk management. Therefore, in order to fully understand and improve network resilience, it is essential to conduct quantitative evaluation at each stage. Summary of the invention

[0004] In order to solve the above-mentioned technical problem of the lack of evaluation of network resilience at different stages, the present invention aims to provide a quantitative analysis method of the four core capabilities of network resilience. The technical solutions adopted are as follows:

[0005] An embodiment of the present invention provides a quantitative analysis method of four core capabilities of network resilience, the method comprising the following steps:

[0006] Build the system to be analyzed, construct a threat model and attack the system to be analyzed, and then collect the performance values ​​of each key function at each moment in a preset time period;

[0007] Summarize the performance values ​​of a key function at each moment, and draw a function change scatter plot corresponding to the key function, where the horizontal axis of the function change scatter plot is time and the vertical axis is the performance value of the key function;

[0008] Performing image analysis on the function change scatter plot to determine the resistance, recovery, perception and adaptability corresponding to the key function of the system to be analyzed;

[0009] A comprehensive analysis is conducted on the resistance, recovery, perception and adaptability corresponding to each key function of the system to be analyzed to obtain the resistance, recovery, perception and adaptability of the system to be analyzed.

[0010] Furthermore, the image analysis of the function change scatter plot is performed to determine the resistance, recovery, perception and adaptability corresponding to the key function of the system to be analyzed, including:

[0011] Determine the resistance and recovery capabilities corresponding to the key function of the system to be analyzed according to the performance value changes of the data points in the function change scatter plot;

[0012] Analyze the degree of the attack discovered in advance by the system to be analyzed according to the function change scatter plot, and determine the perception capability corresponding to the key function of the system to be analyzed;

[0013] The recovery status of the key function of the system to be analyzed is analyzed according to the function change scatter diagram, and the adaptability corresponding to the key function of the system to be analyzed is determined.

[0014] Further, determining the resistance and recovery capabilities corresponding to the key function of the system to be analyzed according to the performance value changes of the data points in the function change scatter diagram includes:

[0015] Constructing an expression of resistance capability according to the performance value trend and the performance value decline rate in the functional change scatter diagram;

[0016] Constructing an expression of recovery capability according to the performance value trend and performance value recovery rate in the function change scatter plot;

[0017] Based on the function change scatter plot, combined with the expression of the resistance capability and the expression of the recovery capability, the resistance capability and the recovery capability corresponding to the key function of the system to be analyzed are determined.

[0018] Furthermore, the expression of the resistance is: F(t) = e -(1-W)t+C1 +m; where F(t) represents the performance value of the data point at time t, t represents the time of the data point, e represents the natural constant, W represents the resistance, C1 represents the first constant, and m represents the minimum performance value in the scatter plot of functional changes;

[0019] The expression of the recovery ability is: F(t) = -e -Rt+C2 +n; wherein R represents recovery capability, C2 represents the second constant, and n represents the stability energy value in the function change scatter diagram, and the stability energy value is used to represent the stability level of the key function of the system to be analyzed after recovery.

[0020] Furthermore, the function change scatter plot is combined with the expression of the resistance capability and the expression of the recovery capability to determine the resistance capability and the recovery capability corresponding to the key function of the system to be analyzed, including:

[0021] The least squares method is used to jointly optimize the curve corresponding to the expression of the resistance capability and the curve corresponding to the expression of the recovery capability, so as to determine the resistance capability and recovery capability corresponding to the key function of the system to be analyzed; wherein the data used for the joint optimization is the performance value of the key function of the system to be analyzed at each moment in the function change scatter diagram.

[0022] Furthermore, analyzing the degree of the attack detected in advance by the system to be analyzed according to the function change scatter plot and determining the perception capability corresponding to the key function of the system to be analyzed includes:

[0023] In the function change scatter plot, determine the time point when the attack is discovered and the target time point when the performance value decreases, and take the difference between the target time point when the performance value obviously decreases and the time point when the attack is discovered in advance as the advance prediction time. The target time point is the time corresponding to the first time when the performance value decreases by a magnitude greater than the normal performance value.

[0024] Determine the time point when the attack starts, and take the difference between the target time point when the performance value obviously decreases and the time point when the attack starts as the attack hiding time;

[0025] The ratio of the advance prediction time to the attack hiding time is used as the perception capability corresponding to the key function of the system to be analyzed.

[0026] Further, analyzing the recovery status of the key function of the system to be analyzed according to the function change scatter diagram to determine the adaptability corresponding to the key function of the system to be analyzed includes:

[0027] Based on the function change scatter plot, the stable performance value after the function level is restored is determined, the baseline level value corresponding to the key function of the system to be analyzed is obtained, and the difference between the stable performance value and the baseline level value is used as the adaptability of the key function of the system to be analyzed.

[0028] The present invention has the following beneficial effects:

[0029] In order to overcome the problem that current quantitative analysis methods cannot reflect the core capabilities of the system in four stages, and to fully understand and improve network resilience, the present invention proposes a quantitative analysis method for the four core capabilities of network resilience, which determines the resistance, recovery, perception and adaptability of the system to be analyzed by drawing a scatter plot of functional changes and performing image analysis on the scatter plot of functional changes. The present invention not only has the advantages of being objective, accurate and comparable, but can also analyze the network resilience capabilities of the system in four stages when it is attacked, so as to facilitate a deeper analysis of the resilience capabilities of the system, and at the same time help improve the responsiveness to dynamic changes in the system, thereby helping to achieve resource allocation, strategy formulation and risk management. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 This is an example diagram of a function curve diagram in a quantitative analysis method of four core capabilities of network resilience according to an embodiment of the present invention;

[0032] Figure 2 This is a flowchart of a quantitative analysis method for four core capabilities of network resilience according to an embodiment of the present invention;

[0033] Figure 3 This is an example diagram of a function change ladder diagram in a quantitative analysis method of four core capabilities of network resilience according to an embodiment of the present invention;

[0034] Figure 4 This is a flowchart for implementing step S3 in a quantitative analysis method of four core capabilities of network resilience according to an embodiment of the present invention;

[0035] Figure 5 This is an example diagram of a fitting curve in a joint optimization process in a quantitative analysis method of four core capabilities of network resilience according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation methods, structures, features and effects of the technical solutions proposed by the present invention are described in detail below in conjunction with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0037] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0038] The commonly used and representative method in quantitative analysis is the area under the curve method, and its specific implementation steps are as follows:

[0039] 1) Prepare the environment, build a system simulation platform, and construct a threat model.

[0040] 2) Start the attack, use the threat model to simulate the attack on the system, and collect indicator data related to the functional level of the system during the attack period.

[0041] 3) Data collation: Plot the collected data into a curve showing the system function changing over time. An example of a function curve is shown in the figure below: Figure 1 shown.

[0042] 4) Network elasticity analysis: By calculating the area under the function curve and performing normalization, the network elasticity value of the system can be obtained.

[0043] Since the area under the curve method lacks the analysis of network resilience at different attack stages when evaluating the network resilience of the system, in order to analyze the resilience capability of the system from a more in-depth perspective and take more effective measures to improve the network resilience of the system, this embodiment proposes a quantitative analysis method for the four core capabilities of network resilience based on the area under the curve method, such as Figure 2 As shown, the following steps are included:

[0044] S1, build the system to be analyzed, construct the threat model and attack the system to be analyzed, and then collect the performance values ​​of each key function at each moment in the preset time period.

[0045] In this embodiment, for the system to be analyzed, the intelligent connected vehicle system is taken as an example to perform network resilience analysis on the intelligent connected vehicle system. Specifically, a vehicle simulation platform is built, which has all the functions of a real vehicle and can read the operation data of the relevant vehicle through relevant tools; on the vehicle simulation platform, a threat model is constructed and the intelligent connected vehicle system is attacked to affect the various functions of the intelligent connected vehicle, such as reducing a certain functional level of the intelligent connected vehicle, which function can be the remote control function in the T-Box (Telematics BOX, telematics processor) module; the performance values ​​of the relevant functional levels of the intelligent connected vehicle over time are collected from a period of time before the attack until the attack ends or the functional level tends to be stable.

[0046] Among them, in the intelligent connected vehicle system, the security of the remote control function is of vital importance, especially in the face of potential network attacks. In order to evaluate the changes in the remote control function when under attack, the following performance values ​​can be used as a reference: control response time, the time it takes for the vehicle to respond to the remote control command. When under attack, the response time may increase, reflecting the system's latency and load; control command success rate, the proportion of successfully executed remote control commands to all commands. When under attack, the success rate may decrease, indicating that the system is interfered with or control is restricted; connection stability, the quality of the connection between the remote control system and the vehicle. When under attack, the connection may be unstable, resulting in frequent disconnection or reconnection; abnormal behavior detection, the abnormal or unauthorized control attempts identified and recorded by the system. During an attack, the number of abnormal behaviors may increase significantly.

[0047] It is worth noting that when simulating an attack, it is necessary to ensure that the attack intensity remains constant in each set of experiments; the preset time period for collecting data can be the sum of the 5 minutes before the start of the attack and the time period corresponding to the entire attack process. The size of the preset time period can be set by the implementer based on the actual situation without specific limitation.

[0048] So far, this embodiment has obtained basic data for subsequent data processing, that is, a set of performance values ​​exhibited by different functions when simulating an attack on the system to be analyzed.

[0049] S2, summarize the performance values ​​of a key function at each moment, and draw a scatter plot of the function changes corresponding to the key function.

[0050] After obtaining the data set during the simulated attack, in order to subsequently analyze the network resilience capabilities of the analyzed system at different stages, it is necessary to take the performance value of a certain key function as an example, and organize the data of the performance value of the key function at each moment, so as to observe and analyze the degree to which the key function is affected by the attack. This embodiment takes the connection stability of the remote control function as an example to conduct subsequent evaluations of the four core capabilities of network resilience.

[0051] In this embodiment, data collation is achieved by analyzing the changes in functions over time. Specifically, the connection stability at each moment is summarized, and a function change scatter plot or a function change ladder plot corresponding to the connection stability of the remote control function is drawn. The horizontal axis of the function change scatter plot is time, and the vertical axis is the connection stability of the remote control function, that is, the performance value. An example of a function change ladder plot is shown in FIG. Figure 3 As shown. Among them, the process of drawing a scatter plot is a prior art and is not within the scope of protection of the present invention, and will not be elaborated in detail here. It should be noted that the actual measured indicator data is not continuously distributed in time, so the scatter plot drawn here is more convenient for subsequent fitting of the model curve.

[0052] So far, this embodiment has obtained a functional change scatter plot for subsequent image analysis.

[0053] S3, perform image analysis on the function change scatter plot to determine the resistance, recovery, perception and adaptability corresponding to the key function of the system to be analyzed.

[0054] In this embodiment, by performing image analysis on the function change scatter plot, the network resilience capabilities of the key function in the four stages of perception, resistance, recovery and adaptation, namely, perception capability, resistance capability, recovery capability and adaptation capability, can be analyzed.

[0055] The above step S3 can be Figure 4 The steps shown achieve:

[0056] S31, determining the resistance and recovery capabilities corresponding to the key function of the system to be analyzed according to the performance value changes of the data points in the function change scatter diagram.

[0057] In this embodiment, the expression of the defense capability is defined based on the rate of change of the performance value decrease when the system is attacked in real situations; and the expression of the recovery capability is defined based on the rate of change of the performance value recovery when the system is attacked in real situations.

[0058] The above step S31 can be implemented through steps S311 to S312 (not shown in the figure):

[0059] S311, construct an expression of resistance capability based on the performance value trend and performance value decline rate in the function change scatter plot.

[0060] First, combining the performance values ​​at each moment, the differential equation of resilience is constructed as shown in formula (1):

[0061] In the formula, F represents the performance value of the data point, t represents the time of the data point, W represents the resistance, and S D (t) represents the functional drop space at the tth moment, and d represents the calculus.

[0062] In the differential equation of resistance capability, the resistance capability W ranges from 0 to 1, and 1-W represents the part of malicious influence that the system cannot effectively resist. When the system's resistance capability W is larger, (1-W) is smaller, indicating that the part of malicious influence that the system cannot resist is reduced, resulting in a smaller rate of functional decline, that is, the system's resistance capability is stronger.

[0063] Secondly, determine the functional drop space at the tth moment, as shown in formula (2):

[0064] S D (t) = F(t) - m(2) where F(t) represents the performance value of the data point at the tth moment, and m represents the minimum performance value in the function change scatter plot.

[0065] Finally, the expression of resilience is the solution to the differential equation, as shown in formula (3):

[0066] Where F(t) represents the performance value of the data point at time t, t represents the time of the data point, e represents the natural constant, W represents the resistance, C1 represents the first constant, and m represents the minimum performance value in the functional change scatter plot.

[0067] It should be noted that the attack intensity is not enough to cause a significant change in the key function level of the system to be analyzed, that is, in the time interval from the beginning to the end of the attack, the function curve does not show any downward trend. At this time, the defense capability corresponding to the key function of the system to be analyzed can be directly assigned to 1; on the contrary, if the attack intensity is too large, the performance value of the key function of the system to be analyzed will show a cliff-like decline, that is, when the attack starts, the performance value of the key function will immediately drop to an unacceptable level, and will no longer change or recover. At this time, the defense capability corresponding to the key function of the system to be analyzed can be directly assigned to 0.

[0068] S312, constructing an expression of recovery capability according to the performance value trend and the performance value recovery rate in the function change scatter plot.

[0069] First, combining the performance value at each moment, the differential equation of recovery capability is constructed as shown in formula (4):

[0070] In the formula, R represents the recovery capacity, S R (t) represents the functional recovery space at the tth moment.

[0071] Secondly, determine the functional recovery space at the tth moment, as shown in formula (5):

[0072] S R (t) = nF(t) (5) where n represents the stable energy value in the functional change scatter plot.

[0073] Finally, the expression of recovery capacity is the solution of the differential equation, as shown in formula (6):

[0074] F(t)=-e -Rt+C2 +n(6); where R represents the recovery capacity, C2 represents the second constant, and n represents the stability energy value in the function change scatter plot. The stability energy value is used to represent the stability level of the system after the function is restored.

[0075] In formula (3) and formula (6), the first constant and the second constant are arbitrary constants in the general solution of the differential equation and have no actual physical meaning. However, the first constant and the second constant will affect the final fitting effect in the subsequent fitting process; m represents the lowest performance value of the key function of the system to be analyzed, that is, the minimum performance value in the function change scatter plot; n represents the stable level of the system performance after recovery, that is, the vertical coordinate of the data point in the scatter plot where the system performance finally tends to be stable.

[0076] S313, based on the function change scatter plot, combined with the expression of resistance capability and the expression of recovery capability, determine the resistance capability and recovery capability corresponding to the key function of the system to be analyzed.

[0077] Specifically, the least squares method is used to jointly optimize the curve corresponding to the expression of the resistance capability and the curve corresponding to the expression of the recovery capability, so as to determine the resistance capability and recovery capability corresponding to the key function of the system to be analyzed; wherein, the data used for the joint optimization is the performance value of the data point at each moment in the function change scatter diagram. The implementation process of the least squares method is prior art and is not within the scope of protection of the present invention, and will not be elaborated here.

[0078] In this embodiment, after constructing the mathematical model of resistance and recovery, it can be seen from observing formula (3) and formula (6) that the two equations have four unknowns, namely resistance, recovery, the first constant and the second constant. In order to determine the size of the four unknowns, the least squares method is used to jointly optimize curve (3) and curve (6). The data used in the joint optimization process is the real data measured when the system is attacked. By continuously adjusting the size of the four unknowns, the curve and the observed data are made to reach the best fit. At this time, the resistance and recovery corresponding to the key function of the system to be analyzed can be determined. Among them, the example diagram of the fitting curve in the joint optimization process is as follows: Figure 5 As shown, the horizontal axis of the fitting curve represents time, and the vertical axis represents the connection stability of the remote control function, that is, the performance value exhibited by the key function; the observation data specifically refers to the function change scatter plot; the joint optimization process of the two curves using the least squares method is a prior art, which is not within the scope of protection of the present invention and will not be elaborated here.

[0079] S32, analyzing the degree of the system to be analyzed in detecting the attack in advance according to the function change scatter plot, and determining the perception capability corresponding to the key function of the system to be analyzed.

[0080] In this embodiment, the perception capability refers to the ability of the key function of the system to be analyzed to perceive the attack in advance. The perception capability can be expressed by the ratio between the advance prediction time and the attack hiding time. The larger the ratio of the advance prediction time to the attack hiding time, the faster the system to be analyzed can discover the hidden attack and take perception measures in advance.

[0081] The above step S32 can be implemented through steps S321 to S323 (not shown in the figure):

[0082] S321, in the function change scatter plot, determine the time point at which the attack is discovered and the target time point at which the performance value decreases, and use the difference between the target time point at which the performance value obviously decreases and the time point at which the attack is discovered in advance as the advance prediction time.

[0083] Among them, the advance prediction time specifically refers to the time from the discovery of the attack in advance to the beginning of a significant decline in functionality. The significant decline in functionality here can be determined by obtaining normal performance values. The size of the normal performance value can be set by the implementer according to the actual situation and is not specifically limited. When the performance value drops for the first time by a magnitude greater than the normal performance value, it means that the corresponding moment is the target time point at which the performance value drops significantly, and the time point at which the attack is discovered can be determined by the system to be analyzed.

[0084] S322, determining the time point at which the attack starts, and taking the difference between the target time point at which the performance value obviously decreases and the time point at which the attack starts as the attack hiding time.

[0085] Among them, the attack hiding time specifically refers to the time from the start of the attack to the beginning of a significant decline in functionality.

[0086] S323, taking the ratio of the advance prediction time to the attack hiding time as the perception capability corresponding to the key function of the system to be analyzed.

[0087] As an example, the calculation formula of the perception capability of the system to be analyzed can be:

[0088] In the formula, A represents the perception ability of the system to be analyzed, t1 represents the target time point when the indicator obviously decreases, and t f Indicates the time point when the attack is discovered in advance, t1-t f Indicates the predicted time in advance, t * It indicates the time when the attack starts, and t1-t0 indicates the attack hiding time.

[0089] It should be noted that, under normal circumstances, any type of attack has a certain hiding period after it is launched, so the attack hiding time in the denominator of the perception ability cannot be zero. fThe larger it is, and the smaller the attack hiding time t1-t0 is, the greater the degree to which the system to be analyzed can detect the attack in advance, and the greater the perception ability A of the system to be analyzed.

[0090] S33, analyzing the recovery status of the key function of the system to be analyzed according to the function change scatter diagram, and determining the adaptability corresponding to the key function of the system to be analyzed.

[0091] In this embodiment, the adaptability can be understood as the degree of recovery of the key function of the system to be analyzed, which can be analyzed by the difference between the stable performance value after the functional level is restored and the baseline level value corresponding to the key function of the system to be analyzed. The greater the adaptability, the stronger the network resilience of the key function of the system to be analyzed during the adaptation stage.

[0092] Specifically, by observing the scatter plot of functional changes, the stable performance value after the functional level is restored can be determined; through the size of the indicator data before the attack, the baseline level value corresponding to the key function of the system to be analyzed can be determined, that is, the indicator before the attack is used as the baseline level value; the difference between the stable performance value and the system baseline level value is used as the adaptability of the system to be analyzed.

[0093] As an example, the calculation formula for the adaptability corresponding to the key function of the system to be analyzed may be:

[0094] In the formula, ε represents the adaptability of the key function of the system to be analyzed, n represents the stability energy value in the function change scatter diagram, and F N Indicates the baseline level value.

[0095] In the calculation formula of adaptability, when the performance value of the key function of the system to be analyzed tends to be stable after being attacked, the stable performance value can be determined. The closer the stable performance value is to the baseline level value, the stronger the functional adaptability of the system to be analyzed is, and the greater the adaptability is. Under normal circumstances, the stable performance value after the functional level is restored will be less than the baseline level value, so the value range of adaptability can be between 0 and 1.

[0096] So far, this embodiment has obtained the network resilience indicators corresponding to different stages after a key function of the system to be analyzed is attacked, namely, the resistance capability, recovery capability, perception capability and adaptability.

[0097] S4, conduct a comprehensive analysis of the resistance, recovery, perception and adaptability corresponding to each key function of the system to be analyzed, and obtain the resistance, recovery, perception and adaptability of the system to be analyzed.

[0098] In this embodiment, referring to the determination process of the resistance, recovery, perception and adaptability corresponding to the above-mentioned key function, the resistance, recovery, perception and adaptability corresponding to each key function of the system to be analyzed can be obtained. The same core capability of different key functions is weighted summed to obtain the resistance, recovery, perception and adaptability of the system to be analyzed. Among them, the implementation process of weighted summation is prior art and is not within the protection scope of the present invention, and will not be elaborated here.

[0099] So far, this embodiment has obtained the network resilience indicators corresponding to the system to be analyzed at different stages after being attacked, namely, the resistance capability, recovery capability, perception capability and adaptability.

[0100] In summary, the quantitative analysis method of the four core capabilities of network resilience proposed in this embodiment has the advantages of objectivity, accuracy and comparability. It can also analyze the network resilience capabilities of the system in four stages when it is attacked. It helps to analyze the resilience capabilities of the system from a more in-depth perspective so as to take more effective measures to improve the network resilience of the system.

[0101] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A quantitative analysis method for the four core capabilities of network resilience, characterized by: The following steps are involved: Build the system to be analyzed, construct a threat model and attack the system to be analyzed, and then collect the performance values ​​of each key function at each moment in a preset time period; Summarize the performance values ​​of a key function at each moment, and draw a function change scatter plot corresponding to the key function, where the horizontal axis of the function change scatter plot is time and the vertical axis is the performance value of the key function; Performing image analysis on the function change scatter plot to determine the resistance, recovery, perception and adaptability corresponding to the key function of the system to be analyzed; A comprehensive analysis is conducted on the resistance, recovery, perception and adaptability corresponding to each key function of the system to be analyzed to obtain the resistance, recovery, perception and adaptability of the system to be analyzed.

2. The quantitative analysis method of the four core capabilities of network resilience according to claim 1 is characterized in that: The image analysis of the function change scatter plot is performed to determine the resistance, recovery, perception and adaptability corresponding to the key function of the system to be analyzed, including: Determine the resistance and recovery capabilities corresponding to the key function of the system to be analyzed according to the performance value changes of the data points in the function change scatter plot; Analyze the degree of the attack discovered in advance by the system to be analyzed according to the function change scatter plot, and determine the perception capability corresponding to the key function of the system to be analyzed; The recovery status of the key function of the system to be analyzed is analyzed according to the function change scatter diagram, and the adaptability corresponding to the key function of the system to be analyzed is determined.

3. The quantitative analysis method of the four core capabilities of network resilience according to claim 2 is characterized in that: Determining the resistance and recovery capabilities corresponding to the key function of the system to be analyzed according to the performance value changes of the data points in the function change scatter diagram includes: Constructing an expression of resistance capability according to the performance value trend and the performance value decline rate in the functional change scatter diagram; Constructing an expression of recovery capability according to the performance value trend and performance value recovery rate in the function change scatter plot; Based on the function change scatter plot, combined with the expression of the resistance capability and the expression of the recovery capability, the resistance capability and the recovery capability corresponding to the key function of the system to be analyzed are determined.

4. The quantitative analysis method of the four core capabilities of network resilience according to claim 3 is characterized in that: The expression of the resistance is: F(t) = e -(W-1)t+C1 +m; where F(t) represents the performance value of the data point at time t, t represents the time of the data point, e represents the natural constant, W represents the resistance, C1 represents the first constant, and m represents the minimum performance value in the scatter plot of functional changes; The expression of the recovery ability is: F(t) = -e -Rt+C2 +n; wherein R represents recovery capability, C2 represents the second constant, and n represents the stability energy value in the function change scatter diagram, and the stability energy value is used to represent the stability level of the key function of the system to be analyzed after recovery.

5. The quantitative analysis method of the four core capabilities of network resilience according to claim 4 is characterized in that: The step of determining the resistance capability and the recovery capability corresponding to the key function of the system to be analyzed based on the function change scatter plot and combining the resistance capability expression and the recovery capability expression includes: The least squares method is used to jointly optimize the curve corresponding to the expression of the resistance capability and the curve corresponding to the expression of the recovery capability, so as to determine the resistance capability and recovery capability corresponding to the key function of the system to be analyzed; wherein the data used for the joint optimization is the performance value of the key function of the system to be analyzed at each moment in the function change scatter diagram.

6. The quantitative analysis method of the four core capabilities of network resilience according to claim 2 is characterized in that: Analyzing the degree of the attack discovered in advance by the system to be analyzed according to the function change scatter plot, and determining the perception capability corresponding to the key function of the system to be analyzed, includes: In the function change scatter plot, determine the time point when the attack is discovered and the target time point when the performance value decreases, and take the difference between the target time point when the performance value obviously decreases and the time point when the attack is discovered in advance as the advance prediction time. The target time point is the time corresponding to the first time when the performance value decreases by a magnitude greater than the normal performance value. Determine the time point when the attack starts, and take the difference between the target time point when the performance value obviously decreases and the time point when the attack starts as the attack hiding time; The ratio of the advance prediction time to the attack hiding time is used as the perception capability corresponding to the key function of the system to be analyzed.

7. The quantitative analysis method of the four core capabilities of network resilience according to claim 2 is characterized in that: Analyzing the recovery status of the key function of the system to be analyzed according to the function change scatter diagram to determine the adaptability corresponding to the key function of the system to be analyzed includes: Based on the function change scatter plot, the stable performance value after the function level is restored is determined, the baseline level value corresponding to the key function of the system to be analyzed is obtained, and the difference between the stable performance value and the baseline level value is used as the adaptability of the key function of the system to be analyzed.

Images