Network resilience modeling and evaluation method and system for multiple attacks

Abstract

The present invention relates to the field of network security technology, and in particular to a network resilience modeling and evaluation method and system for multiple attacks, which takes a target system network subjected to external attacks as a measured object, determines the performance index of the measured object, and collects performance index data during the operation of the target system network according to the performance index; draws a performance index curve according to the performance index data, and confirms the key parameters in the performance index curve; constructs a piecewise differential equation for different time periods of continuous attacks and performs integral solutions; uses the performance index data to fit the target system network performance function, solves the parameters to be estimated through alternating optimization, and obtains the final target system network performance function, so as to use the final target system network performance function to quantitatively evaluate the impact of attacks in each time period. The present invention can more accurately characterize the elastic performance of the system when it is subjected to external attacks, and provide a more refined improvement strategy for improving the system's elasticity capabilities.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network resilience modeling and evaluation method and system for multiple attacks. Background Art

[0002] With the rapid development of network technology, network security issues have received more and more attention. However, it is difficult for existing network defense measures to ensure that the system is 100% impenetrable. For this reason, the concept of network resilience has been introduced. Network resilience refers to the ability of a system to perceive, resist, recover and adapt to the threats it faces when it is subjected to adverse external conditions. In order to promote the development of network resilience, the analysis and modeling of network resilience is a powerful means to understand the changes in the resilience of the system under adverse conditions such as attacks. Existing network resilience analysis mainly focuses on modeling under single attacks and cannot characterize the performance impact of the system under continuous attacks. However, in actual problems, the system may continue to be attacked from the outside world, and due to the increase in the intelligence and complexity of the system in recent years, its attack surface is also larger and the types of threats it faces are wider. The resilience modeling under a single attack has certain limitations for such situations and cannot better meet the needs of network resilience analysis and modeling for future businesses. Summary of the invention

[0003] To this end, the present invention provides a network resilience modeling and evaluation method and system for multiple attacks, which solves the problem that the existing network resilience analysis cannot characterize the performance impact of multiple network attacks.

[0004] According to the design scheme provided by the present invention, on the one hand, a network resilience modeling and evaluation method for multiple attacks is provided, comprising:

[0005] The target system network that is attacked by the outside world is taken as the object to be tested, the performance index of the object to be tested is determined, and the performance index data of the target system network during operation is collected based on the performance index;

[0006] Draw a performance indicator curve based on the performance indicator data, and confirm key parameters in the performance indicator curve, wherein the key parameters include: the starting time of performance degradation, the middle time of recovery to the baseline level after being attacked, the local minimum value of the curve performance and the time corresponding to the local minimum value;

[0007] Based on key parameters and constraints in the continuous attack scenario, piecewise differential equations for different time periods of continuous attack are constructed, and the piecewise differential equations are integrated and solved to obtain the target system network performance function consisting of the parameters to be estimated and the baseline performance level;

[0008] The target system network performance function is fitted using performance indicator data, and the estimated parameters are solved through alternating optimization until the change in the estimated parameter values ​​obtained from two iterations is less than a given threshold. The final target system network performance function is obtained based on the final estimated parameter values, so as to quantitatively evaluate the impact of attacks in each time period using the final target system network performance function.

[0009] As a network resilience modeling and evaluation method for multiple attacks of the present invention, further, the constraints in the continuous attack scenario include at least: the target network eventually recovers to the baseline performance level after being attacked, each attack causes the target network performance to reach a local minimum, the impacts of different attacks on the target network are independent of each other, the rate of change of target network performance caused by the attack is related to the current target network performance level, and the rate of performance change caused by the target network defense capability is related to the current target network performance loss level.

[0010] As a network resilience modeling and evaluation method for multiple attacks of the present invention, further, based on key parameters and according to the constraints in the continuous attack scenario, piecewise differential equations for different time periods of continuous attacks are constructed, including:

[0011] According to the constraints in the continuous attack scenario, the continuous attack is modeled using the performance function, the joint influence function of external attacks and defense measures, the baseline performance level and the defense measure influence function to obtain a continuous attack model;

[0012] The joint impact function of external attacks and defense measures is decomposed into an external attack impact function and a defense measure impact function; and the external attack impact function is decomposed according to the start time and end time of each attack's impact on performance, to obtain a staged attack impact function of each attack's impact on performance;

[0013] According to the staged attack influence function and using the continuous attack model, the piecewise differential equation is obtained.

[0014] As a network resilience modeling and evaluation method for multiple attacks of the present invention, further, the continuous attack model is expressed as:

[0015] , where P(t) is the performance function, W(t) is the joint impact function of external attacks and system defense measures, P0 is the baseline performance level, and D(t) is the defense measure impact function.

[0016] As a network resilience modeling and evaluation method for multiple attacks of the present invention, further, the piecewise differential equation is integrated and solved, including:

[0017] According to the constraints in the continuous attack scenario, the phased attack impact function and the defense measure impact function are set as assumed state values, where the assumed state value is a constant or a linear equation;

[0018] The assumed state value is introduced into the piecewise differential equation, and the piecewise differential equation is integrally transformed to obtain an analytical solution of the piecewise differential equation, wherein the analytical solution is a target system network performance function composed of parameters to be estimated and a baseline performance level.

[0019] As a network resilience modeling and evaluation method for multiple attacks of the present invention, further, before fitting the target system network performance function using the performance indicator data, it also includes:

[0020] The value range of the end time and start time of the staged attack in the performance curve is determined according to the constraints in the continuous attack scenario and the performance indicator curve, and the initial value of the start time and the initial value of the end time of the staged attack are set within the value range.

[0021] As a network resilience modeling and evaluation method for multiple attacks of the present invention, further, the parameters to be estimated are solved by alternating optimization, including:

[0022] According to the initial values ​​of the start time and the end time of the staged attack, the target system network performance function is numerically fitted using the performance indicator data and the least squares method to obtain the intermediate value of the staged attack impact and the intermediate value of the defense measure impact;

[0023] The intermediate values ​​of the impact of the staged attack and the impact of the defensive measures are used to determine the intermediate values ​​of the start time and the end time of the staged attack, and the numerical fitting process is returned for iterative execution.

[0024] In another aspect, the present invention also provides a network resilience modeling and evaluation system for multiple attacks, comprising: a performance data collection module, a performance curve drawing module, a segmented attack modeling module and a data fitting evaluation module, wherein:

[0025] The performance data collection module is used to take the target system network under external attack as the measured object, determine the performance index of the measured object, and collect the performance index data of the target system network during operation according to the performance index;

[0026] A performance curve drawing module is used to draw a performance indicator curve based on the performance indicator data and confirm key parameters in the performance indicator curve, wherein the key parameters include: the starting time of performance degradation, the intermediate time when the performance is restored to the baseline level after being attacked, the local minimum value of the curve performance and the time corresponding to the local minimum value;

[0027] The segmented attack modeling module is used to construct the segmented differential equations of different time periods of continuous attack based on key parameters and the constraints in the continuous attack scenario, and integrate and solve the segmented differential equations to obtain the target system network performance function composed of the parameters to be estimated and the baseline performance level;

[0028] The data fitting evaluation module is used to fit the target system network performance function using the performance indicator data, and solve the parameters to be estimated through alternating optimization until the change in the parameter values ​​to be estimated obtained between two iterations is less than a given threshold, and obtain the final target system network performance function based on the final obtained parameter values ​​to quantitatively evaluate the impact of attacks in each time period using the final target system network performance function.

[0029] Beneficial effects of the present invention:

[0030] The present invention performs elastic analysis modeling for multiple attacks, which can more accurately characterize the elastic performance of the system when it is attacked from the outside, solve the limitations of single attack modeling, and provide a more refined improvement strategy for the subsequent improvement of the system's elasticity capabilities; the parameter estimation problem is solved by alternating iterative numerical estimation, and the model parameters can be quickly learned from the data. Based on the final multiple-attack elasticity analysis model, the process of the system being attacked from the outside is analyzed, the system's elasticity capabilities are evaluated, and support is provided for improving the system's elasticity. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a schematic diagram of the network resilience modeling and evaluation process for multiple attacks in the embodiment;

[0032] Figure 2 This is a schematic diagram of the performance change of the system in the embodiment when it is attacked twice in succession;

[0033] Figure 3 The schematic diagram of the principle framework of the network resilience modeling and evaluation algorithm for multiple attacks in the embodiment is shown in FIG. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0035] Existing network resilience analysis mainly focuses on the impact of a single attack, that is, the time period from the occurrence to the end of a certain attack, without considering the possible impact of other attacks. In fact, network attacks are relatively complex, and the resilience analysis of a single attack is difficult to characterize the performance of the system when it is attacked by multiple attacks in the same period, and it is impossible to separate the impact caused by different attacks. For this reason, the embodiments of the present invention, see Figure 1 As shown, a network resilience modeling and evaluation method for multiple attacks is provided, including:

[0036] S101, taking the target system network under external attack as the measured object, determining the performance index of the measured object, and collecting the performance index data of the target system network during operation according to the performance index;

[0037] S102, drawing a performance indicator curve according to the performance indicator data, and confirming key parameters in the performance indicator curve, wherein the key parameters include: the starting time of performance degradation, the middle time of recovery to the baseline level after being attacked, the local minimum value of the curve performance and the time corresponding to the local minimum value;

[0038] S103, constructing piecewise differential equations for different time periods of continuous attack based on key parameters and in accordance with constraints in the continuous attack scenario, and integrating and solving the piecewise differential equations to obtain a target system network performance function consisting of the parameters to be estimated and the baseline performance level;

[0039] S104. Fit the target system network performance function using the performance indicator data, solve the parameters to be estimated by alternating optimization, until the change in the parameter values ​​to be estimated obtained between two iterations is less than a given threshold, and obtain the final target system network performance function based on the last obtained parameter values ​​to quantitatively evaluate the impact of the attack in each time period using the final target system network performance function.

[0040] A scenario where the system is subjected to multiple consecutive attacks. The system here can be a communication network, intelligent connected vehicle, cyber-physical system, power network, and other network systems that need to complete specific tasks. Taking intelligent connected vehicles as an example, the attack may be that the attacker causes some hardware or software failures of the intelligent connected vehicle through some attack means. The system will identify the failure through monitoring and clear the failure by starting redundant backup or manual access until the system performance returns to normal. In the scenario of a single attack, it is usually assumed that when the system is attacked, the system performance will drop to the lowest point for a period of time, and then the system performance will gradually recover from the attack and eventually reach a certain stable level.

[0041] For scenarios where the system is subjected to multiple consecutive attacks, it is assumed that the system's performance will degrade within a certain period of time during each attack. Multiple consecutive attack scenarios mainly refer to the situation where the system is subjected to the next attack before the impact of the previous attack is cleared, such as Figure 2As shown in the figure, the first attack occurred at time t1, at which time the system performance began to gradually decline. At time t2, the system performance reached a local minimum, and then the performance began to rebound. During the recovery process of the first attack, that is, at time t3, the system suffered the next attack, and the performance began to decline again until it reached the local minimum at time t4, and finally the system began to gradually recover to the baseline level. In this case, the system suffered two consecutive attacks, and the second attack occurred before the first attack was completely eliminated. The existing resilience modeling method for a single attack cannot characterize the performance curve in this case.

[0042] In this embodiment, the following assumptions need to be met in a given continuous attack scenario:

[0043] (1) After being attacked, the system will eventually recover to the baseline level. This assumption is related to the system mission or goal. Unless a system no longer provides services after being attacked, various measures will be taken to restore the system's service capabilities.

[0044] (2) Each attack will cause the system performance to reach a certain local minimum. In fact, after the first attack occurs, the next attack may occur at any time point after t1. For the convenience of analysis, the present invention only considers the situation where the system recovers from time t2 and then suffers the next attack. In this way, the system performance curve will have a clear local minimum, thereby separating different attack situations. The situation of suffering the next attack within t1-t2 is not within the scope of discussion of the embodiments of this case.

[0045] (3) The impacts of different attacks are independent of each other, that is, there is no correlation between the impacts of two consecutive attacks.

[0046] (4) The rate of change in system performance caused by the attack is related to the current performance level, while the rate of change in system performance caused by the system's inherent defense capabilities is related to the current level of performance loss (the difference between baseline performance and current performance).

[0047] Given the above assumptions, multiple consecutive attacks can be modeled as follows:

[0048]

[0049] Where t is time, P(t) is the performance function of the system, W(t) is the combined impact of external attacks and system defense measures, P0 is the initial performance of the system, that is, the baseline performance level, and D(t) is the impact of defense measures on the system. Among them, for multiple attacks, it mainly affects the performance of W(t). Its modeling is as follows:

[0050]

[0051] Where M(t) is the impact of external attacks. In order to accurately decompose M, it is necessary to determine the start and end time of each attack’s impact on the system performance. Figure 1 It can be seen that the first attack starts at t1 and ends between t2 and t5, and the second attack starts at t2 and t3 and ends at t5. Therefore, it is assumed that the end time of the first attack is t e , the starting time of the second attack is t s , the expression of M(t) is as follows:

[0052]

[0053] Among them, M1(t) and M2(t) are the impact functions of the first attack and the second attack on the system performance respectively.

[0054] Combining this with equation (1), we can obtain the piecewise differential equation:

[0055]

[0056] Assuming that M1(t), M2(t) and D(t) are all constants, the analytical solution can be obtained through integral transformation:

[0057]

[0058] Among them, M1, M2, D, and t s and t e are all parameters to be estimated. Since the parameters M1, M2, D and t s ,t e They are the parameters in the objective function and the constraint conditions respectively, which are difficult to be directly fitted and solved by the collected data. Therefore, in this embodiment, an alternating optimization approach is adopted to solve the parameters. First, given t s ,t e Initial value, and then use the collected system performance data to fit the performance function P(t) to obtain parameters M1, M2, and D. Calculate t according to M1, M2, and D respectively s ,t e The above iterative process is repeatedly performed until the change in parameter values ​​obtained from two iterations is less than a given threshold.

[0059] Among them, the integral solution of the piecewise differential equation can be designed to include:

[0060] According to the constraints in the continuous attack scenario, the phased attack impact function and the defense measure impact function are set as assumed state values, where the assumed state value is a constant or a linear equation;

[0061] The assumed state value is introduced into the piecewise differential equation, and the piecewise differential equation is integrally transformed to obtain an analytical solution of the piecewise differential equation, wherein the analytical solution is a target system network performance function composed of parameters to be estimated and a baseline performance level.

[0062] Specifically, in solving the parameters to be estimated through alternating optimization, the range of values ​​of the end time and start time of the staged attack in the performance curve is determined according to the constraints and performance index curve in the continuous attack scenario, and the initial value of the start time and the initial value of the end time of the staged attack are set within the range. According to the initial value of the start time and the initial value of the end time of the staged attack, the performance index data is used and the least squares method is used to perform numerical fitting on the target system network performance function to obtain the intermediate value of the staged attack impact and the intermediate value of the defense measure impact; the intermediate value of the staged attack impact and the intermediate value of the defense measure impact are used to determine the intermediate value of the start time and the intermediate value of the end time of the staged attack, and the numerical fitting process is returned for iterative execution.

[0063] like Figure 3 In the algorithm framework shown, the object under test is the system under test that is attacked by the outside world. There may be many types of attacks, and the system is under continuous attack. The algorithm framework mainly includes three key modules: data acquisition module, model construction module and numerical calculation module.

[0064] Among them, the data acquisition module: first determine the key performance indicators of the system to be tested, such as the obstacle recognition accuracy of the intelligent connected vehicle automatic driving system, which needs to be determined according to the specific task objectives; after determining the performance indicators, it is necessary to add the statistical point information of the performance indicators to the system to ensure that the performance indicator data can be collected during the operation of the system.

[0065] The model building module draws the performance index curve based on the performance data of the data acquisition module, confirms the starting time of the curve performance decline and the time when it recovers to the normal performance level after being attacked, and at the same time, confirms the local minimum value of the curve and its corresponding time. Figure 2For example, the starting time of the curve performance decline is t1, the time when the system recovers to the normal performance level after being attacked is t5, and the time corresponding to the local minimum of the curve is t2 and t4. According to the impact of the attack in different time periods, a piecewise definition function is established, such as the above formula (3). It should be noted that formula (3) gives the situation of two consecutive attacks. In fact, this formula can be extended to more than 2 times. It is only necessary to redefine formula (3) to determine the time range of different attacks. Secondly, combine formula (1) and formula (3) to construct piecewise differential equations (4)-(6). Give the assumptions that M1, M2, and D meet as needed, such as M1, M2, and D are constants, linear functions, etc. On this basis, the differential equations (4)-(6) are integrated and solved. Formulas (7)-(9) give the analytical solutions when M1, M2, and D are constants.

[0066] In the numerical calculation module, according to the performance curve and assumptions, t s ,t e The approximate range of , and then give its initial value within the range. Figure 2 As shown, t s Located between t2 and t3, t e Between t3 and t5, we can give its initial value within its range, such as taking the midpoint of its range. Use the collected system performance data to fit the performance function P(t) and obtain parameters M1, M2, and D. Calculate t based on M1, M2, and D. s ,t e The above iterative process is repeatedly performed until the change in parameter values ​​obtained from two iterations is less than a given threshold. The numerical fitting method can use a commonly used fitting method such as least squares.

[0067] Finally, the system performance curve function P(t) and the related attack impacts M1 and M2 can be obtained. At this point, the resilience modeling analysis of the system under continuous attacks has been completed, and the impact of each attack can be quantitatively evaluated, providing better support for subsequent system optimization.

[0068] Furthermore, based on the above method, an embodiment of the present invention also provides a network resilience modeling and evaluation system for multiple attacks, comprising: a performance data collection module, a performance curve drawing module, a segmented attack modeling module and a data fitting evaluation module, wherein:

[0069] The performance data collection module is used to take the target system network under external attack as the measured object, determine the performance index of the measured object, and collect the performance index data of the target system network during operation according to the performance index;

[0070] A performance curve drawing module is used to draw a performance indicator curve based on the performance indicator data and confirm key parameters in the performance indicator curve, wherein the key parameters include: the starting time of performance degradation, the intermediate time when the performance is restored to the baseline level after being attacked, the local minimum value of the curve performance and the time corresponding to the local minimum value;

[0071] The segmented attack modeling module is used to construct the segmented differential equations of different time periods of continuous attack based on key parameters and the constraints in the continuous attack scenario, and integrate and solve the segmented differential equations to obtain the target system network performance function composed of the parameters to be estimated and the baseline performance level;

[0072] The data fitting evaluation module is used to fit the target system network performance function using the performance indicator data, and solve the parameters to be estimated through alternating optimization until the change in the parameter values ​​to be estimated obtained between two iterations is less than a given threshold, and obtain the final target system network performance function based on the final obtained parameter values ​​to quantitatively evaluate the impact of attacks in each time period using the final target system network performance function.

[0073] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0074] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0075] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0076] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0077] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A network resilience modeling and evaluation method for multi-step attacks, characterized in that: It is used to quantitatively evaluate the attack scenario where the target system is attacked again after the performance of the previous attack begins to recover, including: The target system network that is attacked by the outside world is taken as the object to be tested, the performance index of the object to be tested is determined, and the performance index data of the target system network during operation is collected based on the performance index; Draw a performance indicator curve based on the performance indicator data, and confirm key parameters in the performance indicator curve, wherein the key parameters include: the starting time of performance degradation, the middle time of recovery to the baseline level after being attacked, the local minimum value of the curve performance and the time corresponding to the local minimum value; Based on key parameters and constraints in the continuous attack scenario, piecewise differential equations for different time periods of continuous attack are constructed, and the piecewise differential equations are integrated and solved to obtain the target system network performance function consisting of the parameters to be estimated and the baseline performance level; The target system network performance function is fitted using performance indicator data, and the estimated parameters are solved through alternating optimization until the change in the estimated parameter values ​​obtained from two iterations is less than a given threshold. The final target system network performance function is obtained based on the final estimated parameter values, so as to quantitatively evaluate the impact of attacks in each time period using the final target system network performance function.

2. The network resilience modeling and evaluation method for multi-step attacks according to claim 1 is characterized in that: The constraints in the continuous attack scenario include at least: the target network eventually recovers to the baseline performance level after being attacked, each attack causes the target network performance to reach a local minimum, the impacts of different attacks on the target network are independent of each other, the rate of change of target network performance caused by the attack is related to the current target network performance level, and the rate of performance change caused by the target network defense capability is related to the current target network performance loss level.

3. The network resilience modeling and evaluation method for multi-step attacks according to claim 1 or 2, characterized in that: Based on key parameters and constraints in the continuous attack scenario, piecewise differential equations for different time periods of continuous attack are constructed, including: According to the constraints in the continuous attack scenario, the continuous attack is modeled using the performance function, the joint influence function of external attacks and defense measures, the baseline performance level and the defense measure influence function to obtain a continuous attack model; The joint impact function of external attacks and defense measures is decomposed into an external attack impact function and a defense measure impact function; and the external attack impact function is decomposed according to the start time and end time of each attack's impact on performance, to obtain a staged attack impact function of each attack's impact on performance; According to the staged attack influence function and using the continuous attack model, the piecewise differential equation is obtained.

4. The network resilience modeling and evaluation method for multi-step attacks according to claim 3 is characterized in that: The continuous attack model is expressed as: Among them, P(t) is the performance function, W(t) is the joint impact function of external attacks and system defense measures, P0 is the baseline performance level, and D(t) is the defense measure impact function.

5. The network resilience modeling and evaluation method for multi-step attacks according to claim 3 is characterized in that: Integrate and solve piecewise differential equations, including: According to the constraints in the continuous attack scenario, the phased attack impact function and the defense measure impact function are set as assumed state values, where the assumed state value is a constant or a linear equation; The assumed state value is introduced into the piecewise differential equation, and the piecewise differential equation is integrally transformed to obtain an analytical solution of the piecewise differential equation, wherein the analytical solution is a target system network performance function composed of parameters to be estimated and a baseline performance level.

6. The network resilience modeling and evaluation method for multi-step attacks according to claim 1 is characterized in that: Before fitting the target system network performance function using performance indicator data, it also includes: The value range of the end time and start time of the staged attack in the performance curve is determined according to the constraints in the continuous attack scenario and the performance indicator curve, and the initial value of the start time and the initial value of the end time of the staged attack are set within the value range.

7. The network resilience modeling and evaluation method for multi-step attacks according to claim 6 is characterized in that: Solving the parameters to be estimated by alternating optimization includes: According to the initial values ​​of the start time and the end time of the staged attack, the target system network performance function is numerically fitted using the performance indicator data and the least squares method to obtain the intermediate value of the staged attack impact and the intermediate value of the defense measure impact; The intermediate values ​​of the impact of the staged attack and the impact of the defensive measures are used to determine the intermediate values ​​of the start time and the end time of the staged attack, and the numerical fitting process is returned for iterative execution.

8. A network resilience modeling and evaluation system for multi-step attacks, characterized in that: It is used for quantitative evaluation of attack scenarios where the target system is attacked again after the performance of the previous attack begins to recover. It includes: performance data collection module, performance curve drawing module, segmented attack modeling module and data fitting evaluation module, among which: The performance data collection module is used to take the target system network under external attack as the measured object, determine the performance index of the measured object, and collect the performance index data of the target system network during operation according to the performance index; A performance curve drawing module is used to draw a performance indicator curve based on the performance indicator data and confirm key parameters in the performance indicator curve, wherein the key parameters include: the starting time of performance degradation, the intermediate time when the performance is restored to the baseline level after being attacked, the local minimum value of the curve performance and the time corresponding to the local minimum value; The segmented attack modeling module is used to construct the segmented differential equations of different time periods of continuous attack based on key parameters and the constraints in the continuous attack scenario, and integrate and solve the segmented differential equations to obtain the target system network performance function composed of the parameters to be estimated and the baseline performance level; The data fitting evaluation module is used to fit the target system network performance function using the performance indicator data, and solve the parameters to be estimated through alternating optimization until the change in the parameter values ​​to be estimated obtained between two iterations is less than a given threshold, and obtain the final target system network performance function based on the final obtained parameter values ​​to quantitatively evaluate the impact of attacks in each time period using the final target system network performance function.

Images