Network simulation evaluation method and device, storage medium and computer equipment

Abstract

The embodiment of the invention provides a network simulation evaluation method and device, a storage medium and computer equipment, and the method comprises the steps: obtaining a simulation model obtained for network system simulation, and the simulation model comprises different simulation levels; determining to select a simulation index from each simulation hierarchy; determining a simulation evaluation value of each simulation index according to the index attribute characteristic of each simulation index; and performing index aggregation on the simulation evaluation value of each simulation index to obtain a total simulation evaluation value. Compared with the prior art that simulation evaluation is carried out from the similarity of the whole system level, and the evaluation accuracy is poor, different hierarchies can be simulated during simulation, different simulation indexes are set for different hierarchies, the simulation evaluation values of different simulation indexes are comprehensively evaluated, the final total simulation evaluation value is obtained, and the evaluation accuracy is improved. And evaluation accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technologies, and in particular, to a network simulation evaluation method, device, storage medium, and computer device. Background Art

[0002] In recent years, with the rapid development of the information age, the network information systems in all walks of life have become increasingly large and complex. The security analysis of these systems mainly determines the security of the original system by building a simulation of the original system and conducting security experiments on the simulation system. In this case, the credibility evaluation of the simulation system (i.e., simulation evaluation) becomes very important.

[0003] In related technologies, the credibility evaluation method often evaluates based on the similarity between the original system and the simulation system. However, this evaluation method only evaluates from the similarity at the whole system level, and the evaluation accuracy is poor. Therefore, related technologies urgently need to propose a network simulation evaluation method to solve the above technical problems. Summary of the Invention

[0004] The main purpose of the present application is to provide a network simulation evaluation method, device, storage medium, and computer device, which can simulate different levels during simulation, set different simulation indicators for different levels, and then comprehensively evaluate the simulation evaluation values of different simulation indicators to obtain the final total simulation evaluation value, thereby improving the evaluation accuracy.

[0005] In a first aspect, an embodiment of the present application provides a network simulation evaluation method, including: Obtaining a simulation model obtained by simulating a network system, where the simulation model includes different simulation levels; Determining to select simulation indicators from each of the simulation levels; Determining the simulation evaluation value of each simulation indicator according to the index attribute characteristics of each simulation indicator; Performing index aggregation on the simulation evaluation values of each simulation indicator to obtain a total simulation evaluation value.

[0006] In a second aspect, an embodiment of the present application provides a network simulation evaluation device, including: An obtaining unit, configured to obtain a simulation model obtained by simulating a network system, where the simulation model includes different simulation levels; A first determination unit, configured to determine to select simulation indicators from each of the simulation levels; A second determination unit, configured to determine the simulation evaluation value of each simulation indicator according to the index attribute characteristics of each simulation indicator; An aggregation unit, configured to perform index aggregation on the simulation evaluation values of each simulation indicator to obtain a total simulation evaluation value.

[0007] In a third aspect, an embodiment of the present application provides a storage medium. The computer-readable storage medium stores multiple instructions, and these instructions are suitable for being loaded by a processor to execute the network simulation evaluation method as described in any one of the above.

[0008] In a fourth aspect, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the network simulation evaluation method as described in any one of the above is implemented.

[0009] In an embodiment of the present application, by obtaining a simulation model obtained through simulation of a network system, the simulation model includes different simulation levels; determining simulation indicators selected from each of the simulation levels; determining a simulation evaluation value for each simulation indicator according to the index attribute characteristics of each simulation indicator; and aggregating the simulation evaluation values of each simulation indicator to obtain a total simulation evaluation value. Compared with the related art where the simulation evaluation is performed based on the similarity at the entire system level and the evaluation accuracy is poor, different levels can be simulated during simulation, different simulation indicators can be set for different levels, and then the simulation evaluation values of different simulation indicators can be comprehensively evaluated to obtain the final total simulation evaluation value, thereby improving the evaluation accuracy.

[0010] Other features and advantages of the present disclosure will be described in the subsequent description, and some of them will become obvious from the description or be understood by implementing the present disclosure. The objectives and other advantages of the present disclosure can be achieved and obtained through the structures specifically pointed out in the description, the claims, and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of this specification. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0012] Figure 1 It is a schematic flowchart of the network simulation evaluation method provided by an embodiment of the present application.

[0013] Figure 2 It is a schematic structural diagram of the network simulation evaluation device provided by an embodiment of the present application.

[0014] Figure 3 It is a schematic structural diagram of the computer device provided by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0015] To enable those skilled in the art to better understand the solution of this application, the following will clearly and completely describe the technical solutions in the embodiments of this application in conjunction with the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are only a part of the embodiments of this application, rather than all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative efforts belong to the scope of protection of this application.

[0016] It should be noted that in some processes described in the specification, claims, and the above-mentioned drawings, there are multiple steps that appear in a specific order. However, it should be clearly understood that these steps can be executed not in the order in which they appear in this document or in parallel. The step numbers are only used to distinguish different steps, and the numbers themselves do not represent any execution order. In addition, descriptions such as "first", "second", or "target" in this document are used to distinguish similar objects and do not necessarily describe a specific order or sequence.

[0017] Before further elaborating on the embodiments of the present disclosure, the nouns and terms involved in the embodiments of the present disclosure are described. The nouns and terms involved in the embodiments of the present disclosure are applicable to the following explanations: Simulation, also known as emulation, refers to a technical means of imitating the behavior, performance, and characteristics of a real system or process in a specific environment by establishing a model. In different fields, simulation has different forms of expression and application methods: Definition and core concept: The core of simulation is model construction. By abstracting and simplifying real objects, in the form of mathematical models, physical models, or computer models, etc., complex real systems are transformed into an operable and analyzable form. Based on these models, the operation process of the system is simulated under set conditions, so as to study and predict the behavior and performance of the system, and help people understand and optimize the real system.

[0018] The Open System Interconnection Reference Model, namely the OSI model, is formulated by the International Organization for Standardization (ISO) and is a standard model that divides the computer network architecture into seven layers according to functions. From bottom to top, they are: Physical layer: It is the bottom layer of network communication, responsible for handling transmissions on physical media, covering transmission media such as cables, optical fibers, and wireless. It directly interacts with the physical transmission medium, stipulating electrical characteristics, mechanical characteristics, functional characteristics, and process characteristics, such as network interface standards, signal level standards, etc. Its role is to achieve physical connections between devices and transmit the original bit stream.

[0019] Data Link Layer: Based on the bitstream transmission provided by the Physical Layer, it is responsible for forming data into frames for transmission and handling error detection and correction, flow control, etc. The Ethernet protocol is a typical representative. It defines the MAC (Media Access Control) address, which is used to uniquely identify devices in a local area network, enabling reliable transmission of data frames and ensuring the correct transmission of data between adjacent nodes.

[0020] Network Layer: Its main function is to perform routing selection and packet forwarding, transmitting data from the source node to the destination node through the best path. The IP protocol is the core. It assigns IP addresses to devices in the network, and routers make data forwarding decisions based on IP addresses and routing algorithms to achieve communication between different networks.

[0021] Transport Layer: It provides end-to-end reliable or unreliable communication services for application programs. TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are two main protocols. TCP provides a reliable connection-oriented service, establishing a connection through a three-way handshake and performing data verification and retransmission to ensure accurate data transmission; UDP provides an unreliable connectionless service, with high transmission efficiency but does not guarantee data integrity, and is suitable for scenarios with high real-time requirements and relatively low requirements for data accuracy, such as video stream and audio stream transmission.

[0022] Session Layer: It is responsible for establishing, managing, and terminating session connections between presentation layer entities, and handling issues such as session establishment, demolition, and synchronization. For example, in applications such as remote login and file transfer, the Session Layer controls the session process between application programs on different devices to achieve orderly exchange of data.

[0023] Presentation Layer: It is responsible for handling data representation and conversion to ensure that different systems can correctly understand and process data. Operations such as data encryption and decryption, data compression and decompression, and character encoding conversion are carried out at this layer. For example, converting binary data inside a computer into a format suitable for network transmission, or converting received data into a format that an application program can process.

[0024] Application Layer: It is the layer that users directly contact, providing network application interfaces and services for users. Common ones include HTTP (HyperText Transfer Protocol) for web browsing, SMTP (Simple Mail Transfer Protocol) for sending emails, FTP (File Transfer Protocol) for file transfer, etc. Application layer protocols determine how users interact with the network to meet various network application requirements.

[0025] The OSI model provides a clear framework for the design and development of network protocols, enabling interoperability between devices and software from different manufacturers and promoting the standardization and development of computer networks. In practical applications, although there are few cases where the OSI model is implemented strictly layer by layer, its layering concept is of great guiding significance for understanding the principles of network communication and constructing complex network systems.

[0026] However, existing credibility assessment methods often evaluate based on the similarity between the original system and the simulation system. However, this assessment method only evaluates from the similarity at the whole system level, resulting in poor assessment accuracy.

[0027] In order to solve the above problems, embodiments of the present application obtain a simulation model obtained by simulating a network system, where the simulation model includes different simulation levels; determine simulation indicators selected from each of the simulation levels; determine the simulation evaluation value of each simulation indicator according to the index attribute characteristics of each simulation indicator; and perform index aggregation on the simulation evaluation values of each simulation indicator to obtain a total simulation evaluation value. Compared with the related art where the simulation evaluation is performed from the similarity at the whole system level and the evaluation accuracy is poor, different levels can be simulated during simulation, different simulation indicators can be set for different levels, and thus the simulation evaluation values of different simulation indicators can be comprehensively evaluated to obtain the final total simulation evaluation value, improving the evaluation accuracy.

[0028] The network simulation evaluation method of the embodiments of the present disclosure can be implemented on a computer device.

[0029] In this embodiment, a description will be made from the perspective of a network simulation evaluation device, which can be specifically integrated in a computer device with a storage unit and installed with a microprocessor and having computing capabilities.

[0030] Please refer to Figure 1 , Figure 1 , which is a schematic flowchart of the network simulation evaluation method provided by the embodiments of the present application. The network simulation evaluation method includes: In step 201, obtain a simulation model obtained by simulating a network system, where the simulation model includes different simulation levels.

[0031] Among them, in the embodiments of the present application, the simulation model simulated for the network system is similar to the OSI model, that is, the simulation model similar to the OSI model includes different simulation levels. Specifically, the simulation model includes a behavior layer simulation level, an application layer simulation level, a network layer simulation level, and a system layer simulation level. Among them, the behavior layer simulation level is mainly used to simulate user operation behaviors and traffic behaviors; the application layer simulation level is mainly used to simulate software deployment, parameter configuration, and application data; the network layer simulation level is mainly used for device simulation, link and protocol simulation, and network structure simulation; the system layer simulation level is mainly used for Quick Emulator (QEMU) simulation and Kernel-based Virtual Machine (KVM) simulation.

[0032] In step 202, determine the simulation metrics selected from each of the simulation levels.

[0033] Among them, in order to determine the credibility of the simulation, in the embodiments of the present application, at least one simulation metric is selected from each simulation level, and the simulation credibility between each simulation level and the real network system is determined through the simulation metrics.

[0034] Specifically, for the behavior layer simulation level, traffic behavior can be selected as the simulation metric of the behavior layer simulation level; for the application layer simulation level, software and node vulnerabilities can be selected as the simulation metrics of the application layer simulation level; for the network layer simulation level, the node simulation scale (granularity), network performance (bandwidth, delay, and packet loss rate), device performance (Central Processing Unit (CPU) and Random Access Memory (RAM)), and network topology can be selected as the simulation metrics of the network layer simulation level; for the system layer simulation level, the metrics of the Kernel-based Virtual Machine (KVM) (such as CPU instruction cycles, memory access latency, I / O throughput, and interrupt response time) can be selected.

[0035] In step 203, determine the simulation evaluation value of each simulation metric according to the metric attribute characteristics of each simulation metric.

[0036] Among them, for the metric attribute characteristics of different simulation metrics, corresponding simulation evaluation value calculation methods are set. Therefore, it is necessary to determine the corresponding simulation evaluation values according to the metric attribute characteristics of different simulation metrics.

[0037] In some embodiments, the determining the simulation evaluation value of each simulation metric according to the metric attribute characteristics of each simulation metric includes: (1) When there is a first simulation index with the index attribute feature being a single index value, obtain the first simulation index value of the first simulation index and the first actual index value of the first simulation index; (2) Determine the ratio of the first simulation index value to the first actual index value to obtain the simulation evaluation value of the first simulation index.

[0038] Among them, for the case where there is only a single index value in the simulation index, that is, the first simulation index with the index attribute feature being a single index value, the ratio method can be used to determine the simulation evaluation value of this simulation index. That is, obtain the first simulation index value of the first simulation index in the simulation model and the first actual index value in the actual network. By calculating the ratio of the first simulation index value to the first actual index value, the simulation proportion can be known, and this simulation proportion is used as the simulation evaluation value of the first simulation index.

[0039] For example, for the simulation index of simulation scale, which has only a single index value, the corresponding simulation evaluation value can be calculated with reference to the following formula: ; Where, is the first simulation index value of the scale of the simulation model, is the first actual index value of the scale of the real model, is the simulation evaluation value of the simulation scale of the simulation model.

[0040] Thus, for the simulation index with the index attribute feature being a single index value, the ratio method is used to determine the simulation evaluation value, and the calculation process is simple and clear, easy to understand and operate. This method does not require complex calculations and models, can quickly obtain the evaluation result of the simulation index, and reduces the difficulty and cost of evaluation. When calculating the simulation evaluation value, the value of the simulation index in the simulation model and the actual value in the actual network are obtained, and the ratio of the two is used to reflect the closeness between the simulation and the actual situation. Such an evaluation method can more accurately measure the effectiveness and credibility of the simulation model because it takes the actual situation as a reference standard, making the evaluation result more meaningful in practice.

[0041] In some embodiments, the method further includes: (1) When there is a second simulation index with the index attribute feature being multiple sub - indices, obtain the second simulation index value and the corresponding second actual index value of each sub - index in the second simulation index; (2) Determine the ratio of the second simulation index value of each sub - index to the corresponding second actual index value to obtain the sub - simulation evaluation value of each sub - index; (3) Obtain the sum value of the sub - simulation evaluation values of multiple sub - indices to obtain the total sub - simulation evaluation value; (4)Determine the ratio of the total sub-simulation evaluation value to the number of sub-indicators of the sub-indicator to obtain the simulation evaluation value of the second simulation indicator.

[0042] Among them, for the second simulation indicator with multiple sub-indicators in the simulation indicator, the second simulation indicator value and the corresponding second actual indicator value of each sub-indicator can be obtained. By calculating the ratio of the second simulation indicator value of each sub-indicator to the corresponding second actual indicator value, the sub-simulation evaluation value of each sub-indicator can be obtained; finally, calculate the sum value of the sub-simulation evaluation values of multiple sub-indicators to obtain the total sub-simulation evaluation value; obtain the ratio of the total sub-simulation evaluation value to the number of sub-indicators of the sub-indicator to obtain the simulation evaluation value of the second simulation indicator. The above method is the average calculation method, and different weights can also be set according to the importance of each sub-indicator for weighted average calculation, which is not limited here.

[0043] For example, for the simulation indicator of network performance, which includes three sub-indicators: network bandwidth, network latency, and network packet loss rate. Therefore, the calculation method of the simulation evaluation value of network performance can refer to the following formula: ; Among them, is the sub-simulation evaluation value of the sub-indicator of network bandwidth, is the sub-simulation evaluation value of the sub-indicator of network latency, is the sub-simulation evaluation value of the sub-indicator of network packet loss rate, is the total sub-simulation evaluation value, is the simulation evaluation value of network performance, that is .

[0044] Thus, for the simulation indicator with multiple sub-indicators (such as network performance including network bandwidth, network latency, network packet loss rate, etc.), this method can comprehensively consider all aspects of this complex indicator by calculating the simulation evaluation value of each sub-indicator separately and then synthesizing the overall simulation evaluation value, avoiding the situation of only focusing on a single sub-indicator and ignoring other important factors, so as to more accurately reflect the actual situation of the simulation indicator and the performance of the simulation model. It not only provides an average calculation method to determine the simulation evaluation value, but also mentions that different weights can be set according to the importance of each sub-indicator for weighted average calculation, which makes this method highly flexible and adaptable. In different application scenarios and requirements, the appropriate calculation method can be selected according to the actual situation. For example, in some scenarios with extremely high requirements for network latency, the weight of the network latency sub-indicator can be appropriately increased to more accurately evaluate the performance of the simulation model in this aspect and meet specific evaluation requirements.

[0045] In some embodiments, the method further includes: (1) When there is a third simulation indicator whose indicator attribute characteristic is a network topology, obtaining a clustering coefficient of each simulated network node in the network topology and a distance distribution vector of each simulated network node; (2) determining the high-order information distribution of each of the simulated network nodes based on the clustering coefficient of each of the simulated network nodes and the corresponding distance distribution vector; (3) determining the simulation network node divergence according to the high-order information distribution of each of the simulation network nodes; (4) Determine a simulation evaluation value of the third simulation indicator based on the simulated network node divergence and the real network node divergence.

[0046] Among them, for the third simulation indicator whose simulation indicator is network topology, the clustering coefficient of each simulated network node in the network topology is first obtained, and the expression is: ; Among them, the network is uniformly marked as , node set and edge set Respectively expressed as , ,in, and Respectively represent the network The number of nodes and edges in the network. The affiliation relationship between nodes and edges, building the adjacency matrix Specifically, when the node and nodes When there is a connection, The value of is 1; otherwise it is 0. In addition, the neighbor set of the node in the network is constructed ,in For Node The neighbor set of For Node The number of neighbors. For the network Remove nodes from And the corresponding edge node The distance among neighbors is Therefore, Defined as removing nodes After that, the distance between its neighbors is The ratio of node pairs, that is, the ratio of node of -order clustering coefficient, according to By changing the value, any order of clustering coefficient can be defined.

[0047] Specifically, define the distance distribution of nodes. That is, a distance distribution matrix between network nodes is represented by Each node The distance distribution vector of is where represents the proportion of nodes at a distance of from node while represents the proportion of nodes that have no path to node is the network diameter.

[0048] The high-order clustering coefficient distribution and distance distribution of node respectively consider the degree of aggregation among the neighbors of node and the distance between node and other nodes in the network. Combine these two distributions to define the network similarity algorithm. First, because , the distance distribution can be changed into a -dimensional vector by padding zeros, and then define the high-order information distribution of the network, and The dimension of is where can adjust the proportion of and in . The larger is, the more the distribution pays attention to the high-order clustering coefficient information. If tends to 0, it means more attention is paid to the distance information.

[0049] Given a network and its high-order information distribution , define the network node dispersion (NND) according to the Jensen-Shannon divergence: ; where represents the Jensen-Shannon divergence of the distribution of N nodes, and its expression is: ; where is the specific value of the th column of the high-order information distribution is the average value of the th dimension of the distribution of N nodes, and its expression is: ; ​​The network NND measures the degree of heterogeneity in the connectivity of network nodes. The larger its value, the greater the heterogeneity in node connectivity in the network, and vice versa.

[0050] Finally, the simulation evaluation value of the third simulation index is to calculate the similarity between networks. Specifically, for a given network (simulation network node divergence) and its corresponding reference network topology (true network node divergence), the following formula can be used to calculate their structural similarity: ; where is the similarity between the simulation network node divergence and the true network node divergence, that is, the simulation evaluation value of the third simulation index.

[0051] Thus, by obtaining the clustering coefficient and distance distribution vector of each simulation network node, the aggregation degree among node neighbors and the distance between a node and other nodes can be comprehensively considered. This approach comprehensively describes the characteristics of network nodes, avoiding the one-sidedness of only focusing on a single characteristic, and making the evaluation of the network topology more accurate and comprehensive. Based on the clustering coefficient and distance distribution vector, a high-order information distribution is defined, and by adjusting the parameter to flexibly adjust the weights of high-order clustering coefficient information and distance information. This method can highlight the importance of different characteristics according to actual needs and better adapt to different network scenarios. For example, in scenarios with high requirements for network connectivity, can be appropriately increased to pay more attention to high-order clustering coefficient information to better evaluate the network connectivity. Using Jensen-Shannon divergence to define the network node divergence (NND) can effectively measure the degree of heterogeneity in the connectivity of network nodes. Through the NND value, the differences in node connectivity in the network can be clearly understood, providing an important quantitative indicator for the analysis and optimization of the network structure. For example, in network design, the NND value can be used to determine whether there are problems with node connectivity in the network, and then the network structure can be adjusted and optimized. By calculating the similarity between the simulation network node divergence and the true network node divergence to determine the simulation evaluation value of the third simulation index, the structural similarity between the simulation network and the true network can be accurately evaluated. This is of great significance for verifying the effectiveness and reliability of the simulation model, enabling the simulation results to more accurately reflect the characteristics of the true network and providing a more reliable basis for decisions based on the simulation model.

[0052] In some embodiments, the method further includes: (1) When there is a fourth simulation index with the index attribute feature being network vulnerabilities, obtain the average number of simulated vulnerabilities and the average number of real vulnerabilities of the network vulnerabilities, and obtain the average level of simulated vulnerabilities and the average level of real vulnerabilities; (2) Obtain the ratio of the average number of simulated vulnerabilities to the average number of real vulnerabilities to get the first proportion; (3) Obtain the ratio of the average level of simulated vulnerabilities to the average level of real vulnerabilities to get the second proportion; (4) Determine the product of the first proportion and the second proportion to obtain the simulation evaluation value of the fourth simulation index.

[0053] Among them, for the fourth simulation index with the index attribute feature being network vulnerabilities, if only considering the number and security level alone are not comprehensive methods. Vulnerabilities with a large number may not necessarily have a high security level, and vice versa. Therefore, for general situations, it can be comprehensively considered. The calculation process of using the ratio method to consider these two indicators is as follows: ; Among them, represents the average value of the number of vulnerabilities in the simulated network, that is, the average number of simulated vulnerabilities, represents the set of vulnerabilities in the simulated network. By taking the absolute value and then averaging, the average number of vulnerabilities in the simulated network can be obtained, which reflects the overall scale of vulnerabilities in the simulated network. represents the average value of the number of vulnerabilities in the actual network, that is, the average number of real vulnerabilities. represents the set of vulnerabilities in the actual network. Similarly, by taking the absolute value and then averaging, the average number of vulnerabilities in the actual network is obtained as a benchmark for comparison with the simulated network. represents the average value of the security levels of vulnerabilities in the simulated network, that is, the average level of simulated vulnerabilities. represents the security level of the th vulnerability in the simulated network. By averaging the security levels of all vulnerabilities, the average severity of vulnerabilities in the simulated network can be reflected. represents the average value of the security levels of vulnerabilities in the actual network, that is, the average level of real vulnerabilities. represents the security level of the i-th vulnerability in the actual network. After averaging, the average severity of vulnerabilities in the actual network is obtained as a reference for evaluating the severity of vulnerabilities in the simulated network is the first proportion, is the second proportion. Calculate the product of the first proportion and the second proportion to obtain the simulation evaluation value of the fourth simulation index. Among them, the number of vulnerabilities and the level of vulnerabilities can be obtained through third-party testing tools.

[0054] Thus, by multiplying the ratio of the number of vulnerabilities by the ratio of the vulnerability security levels, factors in terms of both the number of vulnerabilities and the severity of vulnerabilities in the simulation network and the actual network are comprehensively considered, and a comprehensive indicator "vulnerability" is obtained to comprehensively evaluate the similarity or difference degree between the simulation network and the actual network in terms of vulnerabilities, so as to more accurately reflect the simulation effect of the simulation network in terms of network vulnerabilities.

[0055] In step 204, the simulation evaluation values of each simulation indicator are aggregated to obtain the total simulation evaluation value.

[0056] Among them, after obtaining the simulation evaluation values of the simulation indicators included in each simulation level, the simulation evaluation values of each simulation indicator are aggregated to calculate the total simulation evaluation value representing the simulation network.

[0057] In some embodiments, the aggregating the simulation evaluation values of each simulation indicator to obtain the total simulation evaluation value includes: (1) When there are at least two simulation indicators in the first simulation level, the simulation evaluation values of the simulation indicators in the first simulation level are aggregated to obtain the layer simulation evaluation value of the first simulation level; (2) The layer simulation evaluation value of the first simulation level and the simulation evaluation values of the simulation indicators in the second simulation level are aggregated to obtain the total simulation evaluation value, and the second simulation level is the simulation level other than the first simulation level in the simulation model.

[0058] Among them, for the first simulation level with at least two simulation indicators, it is necessary to aggregate the simulation evaluation values of multiple simulation indicators in the first simulation level in advance to determine the layer simulation evaluation value representing the first simulation level, and finally aggregate the layer simulation evaluation value of the first simulation level and the simulation evaluation values of the simulation indicators in the second simulation level to obtain the total simulation evaluation value. Here, the second simulation level is the simulation level with only one simulation indicator.

[0059] Specifically, the analytic hierarchy process is used to aggregate various indicators, specifically: 1. Conduct the analytic hierarchy process within each level to obtain the results of each level. If the object only focuses on a certain simulation level, it can stop at this moment. 2. Repeat the analytic hierarchy process between each layer to obtain the final result.

[0060] For example, the OSI-like model has a total of four layers. If too many simulation indicators are selected at a certain layer, such as 10 simulation indicators, the analytic hierarchy process can be used once within this layer to aggregate the 10 simulation indicators into one or two layer simulation evaluation values to represent this simulation level, and then the analytic hierarchy process is used again between the four layers to aggregate all the first-level indicators into one indicator representing credibility.

[0061] Therefore, when the simulation model has multiple levels and each level contains multiple simulation indicators, this indicator aggregation method can effectively handle complex hierarchical structures. For the case where there are at least two simulation indicators in the first simulation level, first aggregate the indicators within this level to obtain the layer simulation evaluation value of this level, and then aggregate it with the simulation indicator evaluation values of other levels, enabling the evaluation of the entire simulation model to be carried out comprehensively and orderly, meeting the evaluation requirements of complex models. By using the analytic hierarchy process within each level to obtain the results of each level, the characteristics of each level can be highlighted. For example, when selecting multiple simulation indicators at a certain layer of the class OSI model, first perform indicator aggregation within this layer to obtain the layer simulation evaluation value that can represent this layer, so that the characteristics of this level can be accurately reflected. For the case of only focusing on a certain simulation level, the evaluation result of this level can be directly obtained, meeting different evaluation focuses and making the evaluation more flexible and targeted. The analytic hierarchy process can aggregate indicators more accurately by considering the relative importance between indicators. Performing the analytic hierarchy process within and between levels respectively synthesizes the information of different levels and indicators, avoiding the one-sidedness that may be brought by methods such as simple averaging. Aggregating multiple simulation indicators into an evaluation value that can represent the level, and then further aggregating to obtain the total simulation evaluation value, enables the evaluation result to better reflect the real situation of the simulation model, improving the accuracy and reliability of the evaluation.

[0062] In some embodiments, aggregating the simulation evaluation values of the simulation indicators in the first simulation level to obtain the layer simulation evaluation value of the first simulation level includes: (1.1) Obtain the importance scale matrix between the simulation indicators in each of the first simulation levels; (1.2) Determine the product of each row in the importance scale matrix to obtain the first calculation result of each simulation indicator; (1.3) Perform the square root calculation of the number of the simulation indicators on the first calculation result of each simulation indicator to obtain the second calculation result of each simulation indicator; (1.4) Perform normalization processing on the second calculation result of each simulation indicator to obtain the factor weight of each simulation indicator; (1.5) Based on the factor weight of each simulation indicator, perform weighted summation on the simulation evaluation values of each simulation indicator to obtain the layer simulation evaluation value of the first simulation level.

[0063] Among them, the indicator aggregation process between the simulation evaluation values corresponding to multiple simulation levels is the same as the indicator aggregation process of the multiple simulation indicators included in the first simulation level. Therefore, the specific indicator aggregation method is described by taking the indicator aggregation process of the multiple simulation indicators included in the first simulation level as an example.

[0064] Specifically, a scale matrix of the importance degree among simulation indicators is constructed in the form of rows and columns for the multiple simulation indicators included in the first simulation level. Determine the product of each row in the scale matrix of importance degree to obtain the first calculation result of each said simulation indicator; perform a square root calculation of the number of the said simulation indicators on the first calculation result of each said simulation indicator to obtain the second calculation result of each simulation indicator; perform a normalization process on the second calculation result of each simulation indicator to obtain the factor weight of each simulation indicator; based on the factor weight of each simulation indicator, perform a weighted sum on the simulation evaluation values of each simulation indicator to obtain the layer simulation evaluation value of the first simulation level. It can be understood that the layer simulation indicators obtained after the aggregation of the multiple simulation indicators corresponding to the first simulation level are not limited to one, but can also be two, three, etc., which is not limited here.

[0065] The following takes the selection of network performance, device performance, topology from the network layer simulation level of the simulation network, vulnerability threat selected from the behavior layer simulation level, and granularity selected from the application layer simulation level, a total of 5 simulation indicators, to illustrate the indicator aggregation process of the simulation indicators. Please refer to Table 1, which gives the 5 simulation indicators of granularity, network performance, device performance, topology, and vulnerability threat, as well as the importance degree among different simulation indicators.

[0066] Table 1

[0067] By arranging the 5 simulation indicators of granularity, network performance, device performance, topology, and vulnerability threat in the form of rows and columns according to the importance degree (which can be obtained by manual scoring), the scale matrix of importance degree as shown in Table 1 is obtained. Calculate the product of each row to obtain the first calculation result set , where is the first calculation result of granularity, is the first calculation result of network performance, is the first calculation result of device performance, is the first calculation result of topology, is the first calculation result of vulnerability threat. n = 5, then calculate the 5th root of each first calculation result to obtain the second calculation results of the simulation indicators as . Finally, perform a normalization process on the second calculation result of each simulation indicator to obtain the factor weight set as weights = , where 0.127 is the weight factor of granularity, is the weight factor of network performance, is the weight factor of device performance, is the weight factor of topology, That is the weight factor of the vulnerability threat. By means of weighted summation, the index aggregation result of the five simulation indexes of granularity, network performance, device performance, topology, and vulnerability threat can be obtained, which is also the total simulation evaluation value of the simulation network.

[0068] Therefore, by constructing the importance scale matrix, the relative importance among various simulation indexes can be quantified. For example, in the given example, it can be clearly seen from the matrix the importance relationship among different simulation indexes (such as granularity, network performance, etc.). This helps to deeply understand the status of each index in the overall evaluation and avoid the deviation of the evaluation result caused by the subjective misjudgment of the importance of the index. After a series of calculation steps, such as calculating the product of each row, taking the square root, and normalizing, the factor weights of each simulation index are finally obtained. These weights can accurately reflect the importance of each index. When performing weighted summation subsequently, it ensures that important indexes occupy an appropriate proportion in the layer simulation evaluation value, so that the evaluation result can better reflect the actual situation. In actual simulation evaluation, a single index often cannot comprehensively reflect the performance of the system. This method comprehensively considers multiple simulation indexes and avoids the one-sidedness of evaluating only based on individual indexes. For example, when considering network simulation, combining multiple indexes such as granularity, network performance, and device performance can more comprehensively evaluate the overall situation of the network. By performing weighted summation on multiple indexes, the fluctuations of each index can be balanced to a certain extent, and the influence of abnormal values of individual indexes on the final evaluation result can be reduced. This makes the layer simulation evaluation value more stable and reliable and provides a more solid basis for decision-making.

[0069] Similarly, after obtaining the index aggregation result of the simulation evaluation values of the multiple simulation indexes included in the first simulation layer, it can be used as the layer simulation evaluation value corresponding to the first simulation layer. In this way, the first simulation layer only includes one simulation evaluation value, and the second simulation layer also only includes one simulation evaluation value. By using the same index aggregation method as the simulation evaluation values of the multiple simulation indexes included in the first simulation layer to perform index aggregation on the simulation evaluation values corresponding to each simulation layer (the first simulation layer and the second simulation layer), the final total simulation evaluation value representing the simulation network can be obtained.

[0070] As described above, in the embodiment of the present application, a simulation model obtained by simulating a network system is acquired, and the simulation model includes different simulation levels; simulation metrics are determined to be selected from each of the simulation levels; according to the metric attribute characteristics of each simulation metric, the simulation evaluation value of each simulation metric is determined; and the simulation evaluation values of each simulation metric are aggregated to obtain the total simulation evaluation value. Compared with the related art where the simulation evaluation is performed based on the similarity at the entire system level and the evaluation accuracy is poor, different levels can be simulated during simulation, different simulation metrics can be set for different levels, and thus the simulation evaluation values of different simulation metrics can be comprehensively evaluated to obtain the final total simulation evaluation value, improving the evaluation accuracy.

[0071] For a simulation metric with a single metric value as the metric attribute characteristic, the ratio method is used to determine the simulation evaluation value, and the calculation process is simple and clear, easy to understand and operate. This method does not require complex calculations and models, can quickly obtain the evaluation result of the simulation metric, and reduces the difficulty and cost of evaluation. When calculating the simulation evaluation value, the value of the simulation metric in the simulation model and the actual value in the actual network are acquired, and the closeness between the simulation and the actual is reflected by the ratio of the two. Such an evaluation method can more accurately measure the effectiveness and credibility of the simulation model; for a simulation metric with multiple sub - metrics (such as network performance including network bandwidth, network delay, packet loss rate, etc.), this method calculates the simulation evaluation value of each sub - metric separately and then comprehensively obtains the overall simulation evaluation value, which can comprehensively consider all aspects of this complex metric, avoiding the situation of ignoring other important factors due to only focusing on a single sub - metric, and thus more accurately reflecting the actual situation of the simulation metric and the performance of the simulation model. It not only provides an average calculation method to determine the simulation evaluation value, but also mentions that different weights can be set according to the importance of each sub - metric for weighted average calculation, which makes this method highly flexible and adaptable. In different application scenarios and requirements, the appropriate calculation method can be selected according to the actual situation. By acquiring the clustering coefficient and distance distribution vector of each simulation network node, the aggregation degree between node neighbors and the distance between the node and other nodes can be comprehensively considered. This way comprehensively describes the characteristics of network nodes, avoids the one - sidedness of only focusing on a single characteristic, and makes the evaluation of the network topology more accurate and comprehensive. Based on the clustering coefficient and distance distribution vector, a high - order information distribution is defined, and by adjusting the parameter to flexibly adjust the weights of the high - order clustering coefficient information and distance information. This method can highlight the importance of different characteristics according to actual needs and better adapt to different network scenarios. For example, in a scenario with high requirements for network connectivity, , it pays more attention to the information of high-order clustering coefficient to better evaluate the connectivity of the network. The Jensen-Shannon divergence is used to define the Network Node Divergence (NND), which can effectively measure the size of the connectivity heterogeneity of network nodes. Through the NND value, the differences in node connectivity in the network can be clearly understood, providing an important quantitative indicator for the analysis and optimization of the network structure. For example, in network design, the NND value can be used to determine whether there are problems with node connectivity in the network, and then the network structure can be adjusted and optimized. By calculating the similarity between the simulation network node divergence and the real network node divergence to determine the simulation evaluation value of the third simulation index, the similarity in structure between the simulation network and the real network can be accurately evaluated. This is of great significance for verifying the effectiveness and reliability of the simulation model, enabling the simulation results to more accurately reflect the characteristics of the real network and providing a more reliable basis for decisions based on the simulation model. By multiplying the ratio of the number of vulnerabilities by the ratio of the vulnerability security levels, factors in both the number of vulnerabilities and the severity of vulnerabilities in the simulation network and the actual network are comprehensively considered, resulting in a comprehensive indicator, vulnerability, to comprehensively evaluate the similarity or difference between the simulation network and the actual network in terms of vulnerabilities, thus more accurately reflecting the simulation effect of the simulation network in terms of network vulnerabilities. When the simulation model has multiple levels and each level contains multiple simulation indicators, this indicator aggregation method can effectively handle complex hierarchical structures. For the case where there are at least two simulation indicators in the first simulation level, the indicators within this level are first aggregated to obtain the layer simulation evaluation value, and then aggregated with the simulation indicator evaluation values of other levels, enabling the evaluation of the entire simulation model to be comprehensive and well-organized, meeting the evaluation requirements of complex models. By using the Analytic Hierarchy Process within each level to obtain the results of each level, the characteristics of each level can be highlighted. For example, when multiple simulation indicators are selected at a certain layer of the class OSI model, the indicators within this layer are first aggregated to obtain the layer simulation evaluation value that can represent this layer, enabling the characteristics of this layer to be accurately reflected. For the case of only focusing on a certain simulation level, the evaluation result of this level can be directly obtained, meeting different evaluation focuses and making the evaluation more flexible and targeted. The Analytic Hierarchy Process can more accurately aggregate indicators by considering the relative importance between indicators. By conducting the Analytic Hierarchy Process within and between levels respectively, information from different levels and indicators is integrated, avoiding the one-sidedness that may be brought by methods such as simple averaging. Aggregating multiple simulation indicators into an evaluation value that can represent the level, and then further aggregating to obtain the total simulation evaluation value, enables the evaluation result to better reflect the real situation of the simulation model, improving the accuracy and reliability of the evaluation. By constructing an importance scale matrix, the relative importance between various simulation indicators can be quantified. For example, in the given example, the relationship of the importance between different simulation indicators (such as granularity, network performance, etc.) can be clearly seen from the matrix.This helps to deeply understand the status of each indicator in the overall evaluation and avoid deviations in the evaluation results caused by subjective misjudgments of the importance of indicators. Through a series of calculation steps, such as calculating the product of each row, taking the square root, and normalizing, the factor weights of each simulation indicator are finally obtained. These weights can accurately reflect the importance of each indicator. When performing weighted summation later, it ensures that important indicators occupy an appropriate proportion in the layer simulation evaluation value, so that the evaluation results can better reflect the actual situation. In actual simulation evaluations, a single indicator often cannot comprehensively reflect the performance of the system. This method comprehensively considers multiple simulation indicators and avoids the one-sidedness of evaluating only based on individual indicators. For example, when considering network simulation, combining multiple indicators such as granularity, network performance, and device performance can more comprehensively evaluate the overall situation of the network. By performing weighted summation on multiple indicators, the fluctuations of each indicator can be balanced to a certain extent, and the influence of abnormal values of individual indicators on the final evaluation results can be reduced. This makes the layer simulation evaluation value more stable and reliable, providing a more solid basis for decision-making.

[0072] For the specific implementation of each of the above steps, reference can be made to the previous embodiments, which will not be elaborated here.

[0073] To facilitate better implementation of the network simulation evaluation method provided by the embodiments of the present application, the embodiments of the present application also provide a device based on the above network simulation evaluation method. The meanings of the nouns are the same as those in the above network simulation evaluation method, and the specific implementation details can refer to the descriptions in the method embodiments.

[0074] Please refer to Figure 2 , Figure 2 which is a schematic structural diagram of the network simulation evaluation device provided by the embodiments of the present application. The network simulation evaluation device is applied to a computer device. The network simulation evaluation device may include an acquisition unit 601, a first determination unit 602, a second determination unit 603, and an aggregation unit 604, etc.

[0075] The acquisition unit 601 is configured to acquire a simulation model obtained by simulating a network system, and the simulation model includes different simulation levels; The first determination unit 602 is configured to determine simulation indicators selected from each of the simulation levels; The second determination unit 603 is configured to determine a simulation evaluation value of each simulation indicator according to the index attribute characteristics of each simulation indicator; The aggregation unit 604 is configured to perform index aggregation on the simulation evaluation values of each simulation indicator to obtain a total simulation evaluation value.

[0076] In some embodiments, the second determination unit 603 includes: The first acquisition subunit is configured to, when there is a first simulation index with an index attribute feature of a single index value, acquire the first simulation index value of the first simulation index and the first actual index value of the first simulation index; The first determination subunit is configured to determine the ratio of the first simulation index value to the first actual index value to obtain the simulation evaluation value of the first simulation index.

[0077] In some embodiments, the second determination unit 603 further includes: The second acquisition subunit is configured to, when there is a second simulation index with an index attribute feature of having multiple sub-indices, acquire the second simulation index value and the corresponding second actual index value of each sub-index in the second simulation index; The second determination subunit is configured to determine the ratio of the second simulation index value of each sub-index to the corresponding second actual index value to obtain the sub-simulation evaluation value of each sub-index; The third acquisition subunit is configured to acquire the sum value of the sub-simulation evaluation values of the multiple sub-indices to obtain the total sub-simulation evaluation value; The third determination subunit is configured to determine the ratio of the total sub-simulation evaluation value to the number of sub-indices of the sub-indices to obtain the simulation evaluation value of the second simulation index.

[0078] In some embodiments, the second determination unit 603 further includes: The fourth acquisition subunit is configured to, when there is a third simulation index with an index attribute feature of a network topology, acquire the clustering coefficient of each simulation network node in the network topology and the distance distribution vector of each simulation network node; The fourth determination subunit is configured to determine the high-order information distribution of each simulation network node based on the clustering coefficient of each simulation network node and the corresponding distance distribution vector; The fifth determination subunit is configured to determine the simulation network node divergence according to the high-order information distribution of each simulation network node; The sixth determination subunit is configured to determine the simulation evaluation value of the third simulation index based on the simulation network node divergence and the real network node divergence.

[0079] In some embodiments, the second determination unit 603 further includes: The fifth acquisition subunit is configured to, when there is a fourth simulation index with an index attribute feature of network vulnerabilities, acquire the average number of simulation vulnerabilities and the average number of real vulnerabilities of the network vulnerabilities, and acquire the average level of simulation vulnerabilities and the average level of real vulnerabilities; The sixth acquisition subunit is configured to acquire the ratio of the average number of simulation vulnerabilities to the average number of real vulnerabilities to obtain the first ratio; A seventh acquisition subunit, configured to acquire a ratio of the average level of the simulated vulnerabilities to the average level of the real vulnerabilities, so as to obtain a second proportion; A seventh determination subunit, configured to determine a product of the first proportion and the second proportion, so as to obtain a simulation evaluation value of the fourth simulation metric.

[0080] In some embodiments, the aggregation unit 604 includes: A first metric aggregation subunit, configured to perform metric aggregation on simulation evaluation values of simulation metrics in the first simulation level when there are at least two simulation metrics in the first simulation level, so as to obtain a layer simulation evaluation value of the first simulation level; A second metric aggregation subunit, configured to perform metric aggregation on the layer simulation evaluation value of the first simulation level and simulation evaluation values of simulation metrics in a second simulation level, so as to obtain a total simulation evaluation value, where the second simulation level is a simulation level other than the first simulation level in the simulation model.

[0081] In some embodiments, the first metric aggregation subunit is configured to: Acquire an importance scale matrix between simulation metrics in each of the first simulation levels; Determine a product of each row in the importance scale matrix, so as to obtain a first calculation result of each simulation metric; Perform a square root calculation of the number of the simulation metrics on the first calculation result of each simulation metric, so as to obtain a second calculation result of each simulation metric; Perform normalization processing on the second calculation result of each simulation metric, so as to obtain a factor weight of each simulation metric; Based on the factor weights of each simulation metric, perform weighted summation on the simulation evaluation values of each simulation metric, so as to obtain a layer simulation evaluation value of the first simulation level.

[0082] For the specific implementation of each of the above units, reference may be made to the previous embodiments, which will not be elaborated herein.

[0083] As can be seen from the above, in the embodiment of the present application, an acquisition unit 601 acquires a simulation model obtained by simulating a network system, and the simulation model includes different simulation levels; a first determination unit 602 determines to select simulation indicators from each of the simulation levels; a second determination unit 603 determines a simulation evaluation value for each of the simulation indicators according to the index attribute characteristics of each of the simulation indicators; an aggregation unit 604 performs index aggregation on the simulation evaluation values of each simulation indicator to obtain a total simulation evaluation value. Compared with the related art, in which the simulation evaluation is performed based on the similarity at the entire system level and the evaluation accuracy is poor, different levels can be simulated during simulation, different simulation indicators can be set for different levels, and then the simulation evaluation values of different simulation indicators can be comprehensively evaluated to obtain the final total simulation evaluation value, thereby improving the evaluation accuracy.

[0084] For the specific implementation of each of the above units, reference may be made to the previous embodiments, which will not be elaborated herein.

[0085] Refer to Figure 3 , Figure 3 FIG. 1000 is a block diagram of a part of a computer device for implementing the embodiment of the present disclosure. The computer device 1000 may vary greatly due to configuration or performance differences, and may include one or more central processing units (CPUs) 622 (for example, one or more processors) and a memory 632, and one or more storage media 630 (for example, one or more mass storage devices) for storing application programs 642 or data 644. Among them, the memory 632 and the storage media 630 may be transient storage or persistent storage. The program stored in the storage media 630 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server 600. Further, the central processing unit 622 may be configured to communicate with the storage media 630 and execute a series of instruction operations in the storage media 630 on the server 600.

[0086] The computer device 1000 may further include one or more power supplies 626, one or more wired or wireless network interfaces 650, one or more input / output interfaces 658, and / or one or more operating systems 641, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, and so on.

[0087] The central processing unit 622 in the computer device 1000 may be used to execute the network simulation evaluation method of the embodiment of the present disclosure, for example: Acquire a simulation model obtained by simulating a network system, and the simulation model includes different simulation levels; Determine the simulation metrics selected from each of the said simulation levels; Determine the simulation evaluation value of each of the said simulation metrics according to the metric attribute characteristics of each of the said simulation metrics; Perform metric aggregation on the simulation evaluation values of each simulation metric to obtain the total simulation evaluation value.

[0088] By obtaining a simulation model obtained through network system simulation, the simulation model includes different simulation levels; determine the simulation metrics selected from each of the said simulation levels; determine the simulation evaluation value of each of the said simulation metrics according to the metric attribute characteristics of each of the said simulation metrics; perform metric aggregation on the simulation evaluation values of each simulation metric to obtain the total simulation evaluation value. Compared with the related art, in which the simulation evaluation is carried out from the similarity at the entire system level and the evaluation accuracy is poor, different levels can be simulated during simulation, different simulation metrics can be set for different levels, so as to comprehensively evaluate the simulation evaluation values of different simulation metrics and obtain the final total simulation evaluation value, improving the evaluation accuracy.

[0089] The embodiments of the present disclosure also provide a computer-readable storage medium, which is used to store program codes, and the program codes are used to execute the network simulation evaluation method of each of the foregoing embodiments.

[0090] The embodiments of the present disclosure also provide a computer program product, which includes a computer program. The processor of the computer device reads and executes the computer program, so that the computer device executes to implement the above-mentioned network simulation evaluation method. For example: Obtain a simulation model obtained through network system simulation, the simulation model includes different simulation levels; Determine the simulation metrics selected from each of the said simulation levels; Determine the simulation evaluation value of each of the said simulation metrics according to the metric attribute characteristics of each of the said simulation metrics; Perform metric aggregation on the simulation evaluation values of each simulation metric to obtain the total simulation evaluation value.

[0091] By obtaining a simulation model obtained through network system simulation, the simulation model includes different simulation levels; determine the simulation metrics selected from each of the said simulation levels; determine the simulation evaluation value of each of the said simulation metrics according to the metric attribute characteristics of each of the said simulation metrics; perform metric aggregation on the simulation evaluation values of each simulation metric to obtain the total simulation evaluation value. Compared with the related art, in which the simulation evaluation is carried out from the similarity at the entire system level and the evaluation accuracy is poor, different levels can be simulated during simulation, different simulation metrics can be set for different levels, so as to comprehensively evaluate the simulation evaluation values of different simulation metrics and obtain the final total simulation evaluation value, improving the evaluation accuracy.

[0092] In addition, the terms "comprise" and "include" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or apparatus that comprises a series of steps or units need not be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or apparatuses.

[0093] It should be understood that in this application, "at least one (item)" means one or more, and "a plurality" means two or more. "And / or" is used to describe the association relationship of associated objects and indicates that three relationships may exist. For example, "A and / or B" may mean: only A exists, only B exists, and both A and B exist at the same time. Among them, A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one (piece) of the following" or similar expressions refer to any combination of these items, including any combination of single item (piece) or plural items (pieces). For example, at least one (piece) of a, b or c may mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0094] It should be understood that in the description of the embodiments of this application, the meaning of "a plurality (or multiple items)" is more than two. Understandings such as "greater than", "less than", "exceeding", etc. do not include the present number, and understandings such as "above", "below", "within", etc. include the present number.

[0095] In several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection to each other can be through some interfaces, and the indirect coupling or communication connection of devices or units can be in electrical, mechanical or other forms.

[0096] The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they can be located in one place, or they can be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0097] In addition, in each embodiment of the present application, each functional unit can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

[0098] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in each embodiment of the present application. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical discs that can store program codes.

[0099] It should also be understood that the various embodiments provided in the embodiments of the present application can be combined arbitrarily to achieve different technical effects.

[0100] In the embodiments of the present application, the term "module" or "unit" refers to a computer program with a predetermined function or a part of a computer program, which works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as a processing circuit or a memory), or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of the overall module or unit that includes the function of that module or unit.

[0101] The above is a specific description of the embodiments of the present application, but the present application is not limited to the above embodiments. Those skilled in the art can make various equivalent deformations or substitutions without departing from the spirit of the present application, and these equivalent deformations or substitutions are all included within the scope defined by the claims of the present application.

Claims

1. A network simulation evaluation method, characterized in that, Including: Obtain a simulation model obtained by simulating a network system, where the simulation model includes different simulation levels; Determine the simulation metrics selected from each of the simulation levels; Determine the simulation evaluation value of each simulation metric according to the metric attribute characteristics of each simulation metric; Perform metric aggregation on the simulation evaluation values of each simulation metric to obtain a total simulation evaluation value.

2. The network simulation evaluation method according to claim 1, wherein The determining the simulation evaluation value of each simulation metric according to the metric attribute characteristics of each simulation metric includes: When there is a first simulation metric with a metric attribute characteristic of a single metric value, obtain the first simulation metric value of the first simulation metric and the first actual metric value of the first simulation metric; Determine the ratio of the first simulation metric value to the first actual metric value to obtain the simulation evaluation value of the first simulation metric.

3. The network simulation evaluation method according to claim 2, wherein The method further includes: When there is a second simulation metric with a metric attribute characteristic of having multiple sub - metrics, obtain the second simulation metric value and the corresponding second actual metric value of each sub - metric in the second simulation metric; Determine the ratio of the second simulation metric value of each sub - metric to the corresponding second actual metric value to obtain the sub - simulation evaluation value of each sub - metric; Obtain the sum value of the sub - simulation evaluation values of multiple sub - metrics to obtain a total sub - simulation evaluation value; Determine the ratio of the total sub - simulation evaluation value to the number of sub - metrics of the sub - metrics to obtain the simulation evaluation value of the second simulation metric.

4. The network simulation evaluation method according to claim 2, wherein The method further includes: When there is a third simulation metric with a metric attribute characteristic of network topology, obtain the clustering coefficient of each simulation network node in the network topology and the distance distribution vector of each simulation network node; Based on the clustering coefficient of each simulation network node and the corresponding distance distribution vector, determine the high - order information distribution of each simulation network node; Determine the simulation network node divergence according to the high - order information distribution of each simulation network node; Based on the simulation network node divergence and the real network node divergence, determine the simulation evaluation value of the third simulation metric.

5. The network simulation evaluation method according to claim 2, wherein The method further includes: When there is a fourth simulation metric with a metric attribute characteristic of network vulnerability, obtain the average number of simulation vulnerabilities and the average number of real vulnerabilities of the network vulnerability, and obtain the average level of simulation vulnerabilities and the average level of real vulnerabilities; Obtain the ratio of the average number of simulation vulnerabilities to the average number of real vulnerabilities to obtain a first ratio; Obtain the ratio of the average level of simulation vulnerabilities to the average level of real vulnerabilities to obtain a second ratio; Determine the product of the first ratio and the second ratio to obtain the simulation evaluation value of the fourth simulation metric.

6. The network simulation evaluation method according to claim 1, characterized in that The performing metric aggregation on the simulation evaluation values of each simulation metric to obtain a total simulation evaluation value includes: When there are at least two simulation metrics in the first simulation level, perform metric aggregation on the simulation evaluation values of the simulation metrics in the first simulation level to obtain the layer simulation evaluation value of the first simulation level; Aggregate the simulation evaluation values of the layer simulation of the first simulation level and the simulation evaluation values of the simulation indicators of the second simulation level to obtain the total simulation evaluation value, where the second simulation level is the simulation level other than the first simulation level in the simulation model.

7. The network simulation evaluation method according to claim 6, wherein The aggregating the simulation evaluation values of the simulation indicators in the first simulation level to obtain the layer simulation evaluation value of the first simulation level includes: Obtain the importance scale matrix between the simulation indicators in each of the first simulation levels; Determine the product of each row in the importance scale matrix to obtain the first calculation result of each simulation indicator; Perform a square root calculation of the number of the simulation indicators on the first calculation result of each simulation indicator to obtain the second calculation result of each simulation indicator; Perform normalization processing on the second calculation result of each simulation indicator to obtain the factor weight of each simulation indicator; Based on the factor weight of each simulation indicator, perform weighted summation on the simulation evaluation values of each simulation indicator to obtain the layer simulation evaluation value of the first simulation level.

8. A network simulation evaluation device, characterized in that, Including: An acquisition unit, configured to acquire a simulation model obtained by simulating a network system, where the simulation model includes different simulation levels; A first determination unit, configured to determine to select simulation indicators from each of the simulation levels; A second determination unit, configured to determine the simulation evaluation value of each simulation indicator according to the index attribute characteristics of each simulation indicator; An aggregation unit, configured to perform index aggregation on the simulation evaluation values of each simulation indicator to obtain the total simulation evaluation value.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores multiple instructions, and the instructions are suitable for being loaded by a processor to execute the network simulation evaluation method according to any one of claims 1 to 7.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the network simulation evaluation method according to any one of claims 1 to 7.

Images