Network simulation evaluation method, device, storage medium and computer equipment

Abstract

The embodiment of the present application provides a network simulation evaluation method, apparatus, storage medium and computer equipment, including: obtaining a simulation model obtained for network system simulation, wherein the simulation model includes different simulation levels; determining to select simulation indicators from each simulation level; determining the simulation evaluation value of each simulation indicator according to the indicator attribute characteristics of each simulation indicator; and performing indicator aggregation on the simulation evaluation value of each simulation indicator to obtain a total simulation evaluation value. Compared with the related art, which performs simulation evaluation based on the similarity of the entire system level and has poor evaluation accuracy, different levels can be simulated during simulation, and different simulation indicators can be set for different levels, thereby comprehensively evaluating the simulation evaluation values ​​of different simulation indicators to obtain a final total simulation evaluation value, thereby improving evaluation accuracy.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network simulation evaluation method, apparatus, storage medium, and computer equipment. Background Art

[0002] In recent years, with the rapid development of the information age, network information systems in various industries have become increasingly large and complex. Security analysis of these systems is mainly carried out by simulating the original system and conducting security experiments on the simulated system to determine the security of the original system. In this case, the credibility assessment of the simulation system (i.e., simulation assessment) becomes very important.

[0003] In related technologies, the credibility assessment method is often based on the similarity between the original system and the simulated system. However, this assessment method only assesses the similarity at the entire system level, and the assessment accuracy is poor. Therefore, related technologies urgently need to propose a network simulation assessment method to solve the above technical problems. Summary of the Invention

[0004] The main purpose of this application is to provide a network simulation evaluation method, device, storage medium and computer equipment, which can simulate different levels during simulation and set different simulation indicators for different levels, so as to comprehensively evaluate the simulation evaluation values ​​of different simulation indicators, obtain the final total simulation evaluation value, and improve the evaluation accuracy.

[0005] In a first aspect, an embodiment of the present application provides a network simulation evaluation method, comprising:

[0006] Acquire a simulation model obtained by simulating a network system, wherein the simulation model includes different simulation levels;

[0007] Determining to select simulation indicators from each of the simulation levels;

[0008] Determining a simulation evaluation value of each simulation indicator according to the indicator attribute characteristics of each simulation indicator;

[0009] The simulation evaluation value of each simulation indicator is aggregated to obtain the total simulation evaluation value.

[0010] In a second aspect, an embodiment of the present application provides a network simulation evaluation device, comprising:

[0011] an acquiring unit, configured to acquire a simulation model obtained by simulating a network system, wherein the simulation model includes different simulation levels;

[0012] A first determining unit, configured to determine to select simulation indicators from each of the simulation levels;

[0013] A second determining unit, configured to determine a simulation evaluation value of each simulation indicator according to an indicator attribute feature of each simulation indicator;

[0014] The aggregation unit is used to aggregate the simulation evaluation value of each simulation indicator to obtain the total simulation evaluation value.

[0015] In a third aspect, an embodiment of the present application provides a storage medium, wherein the computer-readable storage medium stores a plurality of instructions, which are suitable for loading by a processor to execute any of the network simulation evaluation methods above.

[0016] In a fourth aspect, an embodiment of the present application provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above network simulation evaluation methods when executing the computer program.

[0017] In an embodiment of the present application, a simulation model obtained for simulating a network system is obtained, wherein the simulation model includes different simulation levels; a simulation indicator is selected from each simulation level; a simulation evaluation value of each simulation indicator is determined based on the indicator attribute characteristics of each simulation indicator; and the simulation evaluation value of each simulation indicator is aggregated to obtain a total simulation evaluation value. Compared to the related art, which uses the similarity of the entire system level to perform simulation evaluation, resulting in poor evaluation accuracy, different levels can be simulated during simulation, and different simulation indicators can be set for different levels, thereby comprehensively evaluating the simulation evaluation values ​​of different simulation indicators to obtain a final total simulation evaluation value, thereby improving evaluation accuracy.

[0018] Other features and advantages of the present disclosure will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present disclosure. The purposes and other advantages of the present disclosure can be realized and obtained by the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 A flowchart of a network simulation evaluation method provided in an embodiment of the present application.

[0021] Figure 2A schematic diagram of the structure of a network simulation evaluation device provided in an embodiment of the present application.

[0022] Figure 3 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solutions of this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of this application.

[0024] It should be noted that some processes described in the specification, claims, and figures above include multiple steps that appear in a specific order. However, it should be understood that these steps may be executed in a different order than the order in which they appear herein or in parallel. The step numbers are used solely to distinguish between the different steps and do not themselves represent any order of execution. Furthermore, terms such as "first," "second," or "target" are used herein to distinguish similar objects and are not necessarily used to describe a specific order or precedence.

[0025] Before further explaining the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are explained. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations:

[0026] Simulation, also known as simulation, refers to a technical means of mimicking the behavior, performance, and characteristics of a real system or process in a specific environment by building a model. In different fields, simulation has different forms and applications:

[0027] Definition and Core Concepts: The core of simulation is model building. By abstracting and simplifying real-world objects, mathematical, physical, or computer models are used to transform complex real-world systems into operational and analyzable forms. Based on these models, the system's operation is simulated under specified conditions to study and predict system behavior and performance, helping people understand and optimize real-world systems.

[0028] The Open System Interconnection Reference Model (OSI) is a standard model developed by the International Organization for Standardization (ISO) that divides computer network architecture into seven layers based on their functions. From bottom to top, they are:

[0029] The physical layer is the lowest layer of network communications, responsible for handling transmission over physical media, including cables, optical fibers, and wireless networks. It directly interacts with the physical transmission medium, defining electrical, mechanical, functional, and process characteristics, such as cable interface standards and signal level standards. Its purpose is to achieve physical connections between devices and transmit raw bit streams.

[0030] Data Link Layer: Building on the bit stream transmission provided by the physical layer, this layer is responsible for framing data for transmission and handling error detection and correction, flow control, and other aspects. The Ethernet protocol is a typical example, defining MAC (Media Access Control) addresses, which uniquely identify devices within a local area network, enabling reliable transmission of data frames and ensuring the correct transfer of data between adjacent nodes.

[0031] Network layer: Its primary functions are routing and packet forwarding, transferring data from the source node to the destination node via the optimal path. The IP protocol is the core layer, assigning IP addresses to devices on the network. Routers use IP addresses and routing algorithms to make data forwarding decisions, enabling communication between different networks.

[0032] The transport layer provides end-to-end reliable or unreliable communication services for applications. TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are the two main protocols. TCP provides a reliable, connection-oriented service, establishing a connection through a three-way handshake and performing data verification and retransmission to ensure accurate data transmission. UDP provides an unreliable, connectionless service with high transmission efficiency but no guarantee of data integrity. It is suitable for scenarios with high real-time requirements and relatively low data accuracy requirements, such as video and audio streaming.

[0033] Session layer: Responsible for establishing, managing, and terminating session connections between presentation layer entities, handling issues such as session establishment, teardown, and synchronization. For example, in applications such as remote login and file transfer, the session layer controls the conversation process between applications on different devices and enables orderly data exchange.

[0034] The presentation layer handles data representation and conversion, ensuring that data can be correctly understood and processed across different systems. Operations such as data encryption and decryption, data compression and decompression, and character encoding conversion are all performed at this layer. For example, this layer converts binary data within a computer into a format suitable for network transmission, or converts received data into a format that can be processed by an application.

[0035] The application layer is the layer that users interact with directly, providing network application interfaces and services. Common protocols include HTTP (Hypertext Transfer Protocol) for web browsing, SMTP (Simple Mail Transfer Protocol) for email, and FTP (File Transfer Protocol) for file transfers. Application layer protocols determine how users interact with the network and meet various network application requirements.

[0036] The OSI model provides a clear framework for the design and development of network protocols, enabling interoperability between devices and software from different vendors and promoting the standardization and development of computer networks. In practice, while strict adherence to each layer of the OSI model is rare, its layered approach is crucial for understanding the principles of network communication and building complex network systems.

[0037] However, existing credibility assessment methods are often based on the similarity between the original system and the simulated system. However, this assessment method only assesses the similarity at the entire system level, and the assessment accuracy is poor.

[0038] In order to solve the above problems, the embodiment of the present application obtains a simulation model obtained for network system simulation, wherein the simulation model includes different simulation levels; determines to select simulation indicators from each simulation level; determines the simulation evaluation value of each simulation indicator according to the indicator attribute characteristics of each simulation indicator; and performs indicator aggregation on the simulation evaluation value of each simulation indicator to obtain a total simulation evaluation value. Compared with the related art, which performs simulation evaluation based on the similarity of the entire system level and has poor evaluation accuracy, different levels can be simulated during simulation, and different simulation indicators can be set for different levels, thereby comprehensively evaluating the simulation evaluation values ​​of different simulation indicators to obtain a final total simulation evaluation value, thereby improving evaluation accuracy.

[0039] The network simulation evaluation method according to the embodiment of the present disclosure can be implemented on a computer device.

[0040] In this embodiment, the description will be made from the perspective of a network simulation evaluation device, which can be specifically integrated into a computer device having a storage unit and a microprocessor installed therein and having computing capabilities.

[0041] See also Figure 1 , Figure 1 This is a flow chart of a network simulation evaluation method provided in an embodiment of the present application. The network simulation evaluation method includes:

[0042] In step 201 , a simulation model obtained by simulating a network system is obtained, where the simulation model includes different simulation levels.

[0043] Among them, the simulation model for simulating the network system in the embodiment of the present application is similar to the OSI model, that is, the simulation model is similar to the OSI model and includes different simulation layers. Specifically, the simulation model includes a behavioral layer simulation layer, an application layer simulation layer, a network layer simulation layer, and a system layer simulation layer. The behavioral layer simulation layer is mainly used to simulate user operation behavior and traffic behavior; the application layer simulation layer is mainly used to simulate software deployment, parameter configuration, and application data; the network layer simulation layer is mainly used for device simulation, link and protocol simulation, and network structure simulation; the system layer simulation layer is mainly used for Quick Emulator (QEMU) simulation and kernel-based Virtual Machine (KVM) simulation.

[0044] In step 202, simulation indicators selected from each of the simulation levels are determined.

[0045] In order to determine the credibility of the simulation, the embodiment of the present application selects at least one simulation indicator from each simulation level, and determines the simulation credibility between each simulation level and the real network system through the simulation indicator.

[0046] Specifically, for the behavioral layer simulation level, traffic behavior can be selected as the simulation indicator of the behavioral layer simulation level; for the application layer simulation level, software and node vulnerabilities can be selected as the simulation indicators of the application layer simulation level; for the network layer simulation level, node simulation scale (granularity), network performance (bandwidth, latency and packet loss rate), device performance (Central Processing Unit (CPU) and Random Access Memory (RAM)), and network topology can be selected as the simulation indicators of the network layer simulation level; for the system layer simulation level, kernel-based virtual machine (KVM) indicators (such as CPU instruction cycles, memory access latency, I / O throughput, interrupt response time) can be selected.

[0047] In step 203, a simulation evaluation value of each simulation indicator is determined according to the indicator attribute characteristics of each simulation indicator.

[0048] Among them, corresponding simulation evaluation value calculation methods are set for the indicator attribute characteristics of different simulation indicators, so the corresponding simulation evaluation values ​​need to be determined according to the indicator attribute characteristics of different simulation indicators.

[0049] In some implementations, determining the simulation evaluation value of each simulation indicator according to the indicator attribute characteristics of each simulation indicator includes:

[0050] (1) When there is a first simulation indicator whose indicator attribute characteristic is a single indicator value, obtaining a first simulation indicator value of the first simulation indicator and a first actual indicator value of the first simulation indicator;

[0051] (2) Determine a ratio of the first simulation index value to the first actual index value to obtain a simulation evaluation value of the first simulation index.

[0052] In the case where only a single indicator value exists in the simulation indicator, that is, a first simulation indicator whose indicator attribute characteristic is a single indicator value, a ratio method can be used to determine the simulation evaluation value of the simulation indicator. That is, the first simulation indicator value of the first simulation indicator in the simulation model and the first actual indicator value in the actual network are obtained. By calculating the ratio of the first simulation indicator value to the first actual indicator value, the simulation ratio can be determined, and the simulation ratio is used as the simulation evaluation value of the first simulation indicator.

[0053] For example, if the simulation indicator is simulation scale, which only has a single indicator value, the corresponding simulation evaluation value can be calculated by referring to the following formula:

[0054] ;

[0055] in, That is the first simulation index value of the scale of the simulation model, This is the first actual indicator value of the scale of the real model, It is the simulation evaluation value of the simulation scale of the simulation model.

[0056] Therefore, for simulation indicators characterized by a single value, a ratio method is used to determine the simulation evaluation value. The calculation process is concise and clear, making it easy to understand and operate. This method eliminates the need for complex calculations and models, enabling rapid evaluation of simulation indicators, reducing the difficulty and cost of evaluation. When calculating the simulation evaluation value, the value of the simulation indicator in the simulation model and the actual value in the actual network are obtained, and the ratio of the two is used to reflect the degree of closeness between the simulation and the actual situation. This evaluation method can more accurately measure the effectiveness and credibility of the simulation model because it considers the actual situation as a reference standard, making the evaluation results more meaningful.

[0057] In some embodiments, the method further comprises:

[0058] (1) When there is a second simulation indicator having an indicator attribute characteristic of having multiple sub-indicators, obtaining a second simulation indicator value and a corresponding second actual indicator value for each of the sub-indicators in the second simulation indicator;

[0059] (2) determining the ratio of the second simulation index value of each sub-indicator to the corresponding second actual index value to obtain a sub-simulation evaluation value of each sub-indicator;

[0060] (3) Obtaining the sum of the sub-simulation evaluation values ​​of the plurality of sub-indicators to obtain a total sub-simulation evaluation value;

[0061] (4) Determine the ratio of the total sub-simulation evaluation value to the number of sub-indicators of the sub-indicator to obtain the simulation evaluation value of the second simulation indicator.

[0062] Among them, for the second simulation indicator with multiple sub-indicators in the simulation indicator, the second simulation indicator value of each sub-indicator and the corresponding second actual indicator value can be obtained. By calculating the ratio of the second simulation indicator value of each sub-indicator to the corresponding second actual indicator value, the sub-simulation evaluation value of each sub-indicator can be obtained; finally, the sum of the sub-simulation evaluation values ​​of the multiple sub-indicators is calculated to obtain the total sub-simulation evaluation value; the ratio of the total sub-simulation evaluation value to the number of sub-indicators of the sub-indicator is obtained to obtain the simulation evaluation value of the second simulation indicator. The above method is an average calculation method, and different weights can be set according to the importance of each sub-indicator to perform weighted average calculation, which is not limited here.

[0063] For example, if the simulation indicator is network performance, it includes three sub-indicators: network bandwidth, network delay, and network packet loss rate. Therefore, the simulation evaluation value of network performance can be calculated according to the following formula:

[0064] ;

[0065] in, That is, the sub-simulation evaluation value of the sub-indicator being the network bandwidth, That is, the sub-simulation evaluation value of the sub-indicator being the network delay, That is, the sub-simulation evaluation value of the network packet loss rate as the sub-indicator, is the total sub-simulation evaluation value, is the simulation evaluation value of network performance, that is .

[0066] Therefore, for simulation metrics with multiple sub-indicators (such as network performance including network bandwidth, network latency, and network packet loss rate), this method calculates the simulation evaluation value for each sub-indicator separately and then synthesizes it to derive an overall simulation evaluation value. This method comprehensively considers all aspects of the complex metric, avoiding the situation where other important factors are neglected due to focusing on a single sub-indicator. This more accurately reflects the actual situation of the simulation metric and the performance of the simulation model. It provides both an average calculation method to determine the simulation evaluation value and the ability to assign different weights to each sub-indicator based on its importance, making this method highly flexible and adaptable. The appropriate calculation method can be selected based on the actual situation in different application scenarios and requirements. For example, in certain scenarios with extremely high network latency requirements, the weight of the network latency sub-indicator can be appropriately increased to more accurately evaluate the simulation model's performance in this area and meet specific evaluation requirements.

[0067] In some embodiments, the method further comprises:

[0068] (1) When there is a third simulation indicator whose indicator attribute characteristic is a network topology, obtaining a clustering coefficient of each simulated network node in the network topology and a distance distribution vector of each simulated network node;

[0069] (2) determining the high-order information distribution of each of the simulated network nodes based on the clustering coefficient of each of the simulated network nodes and the corresponding distance distribution vector;

[0070] (3) determining the divergence of the simulated network nodes according to the high-order information distribution of each of the simulated network nodes;

[0071] (4) Determine a simulation evaluation value of the third simulation indicator based on the simulated network node divergence and the real network node divergence.

[0072] Among them, for the third simulation indicator whose simulation indicator is network topology, the clustering coefficient of each simulated network node in the network topology is first obtained, and the expression is:

[0073] ;

[0074] Among them, the network is uniformly marked as , node set and edge sets Respectively expressed as , ,in, and Represents the network The number of nodes and edges in the network. The affiliation relationship between nodes and edges, building the adjacency matrix Specifically, when the node and nodes When there is a connecting edge, The value of is 1; otherwise it is 0. In addition, the neighbor set of the node in the network is constructed ,in For nodes The neighbor set of For nodes The number of neighbors. For the network Remove nodes And the corresponding edge nodes The distance between neighbors is Therefore, Defined as removing nodes After that, the distance between its neighbors is The ratio of node pairs, that is, about the node of -order clustering coefficient, according to By changing the value, any order of clustering coefficient can be defined.

[0075] Specifically, the distance distribution of nodes is defined as follows: Indicates that each node The distance distribution vector is ,in Representation and Node The distance is The ratio of nodes, and It means that the node The proportion of nodes for which no path exists, is the network diameter.

[0076] node The high-order clustering coefficient distribution and distance distribution of the nodes are considered respectively. The degree of clustering between neighbors and the node The distance to other nodes in the network, combining these two distributions to define the network similarity algorithm. , the distance distribution can be By filling with zeros, it becomes a Order vector, and then define the high-order information distribution of the network ,and Dimension ,in , can be adjusted and exist The proportion of The larger it is, the more attention is paid to the high-order clustering coefficient information in the distribution. If A value closer to 0 indicates more emphasis on distance information.

[0077] In a given network And the high-order information distribution on it , network node dispersion (NND) is defined according to Jensen-Shannon divergence:

[0078] ;

[0079] in, The Jen-sen-Shannon divergence of the distribution of N nodes is expressed as:

[0080] ;

[0081] in, is a high-order information distribution No. The specific value of the column, Distribute the first The average value of the dimension is expressed as:

[0082] ;

[0083] The network NND measures the size of the heterogeneity of network node connectivity. The larger the value, the greater the heterogeneity of node connectivity in the network, and vice versa.

[0084] Finally, the simulation evaluation value of the third simulation index is the similarity between the calculated networks. Specifically, in a given network (Simulation network node divergence) and the corresponding reference network topology (real network node divergence), the following formula can be used to calculate the structural similarity between the two:

[0085] ;

[0086] in, It is the similarity between the simulated network node divergence and the real network node divergence, that is, the simulation evaluation value of the third simulation indicator.

[0087] In this way, by obtaining the clustering coefficient and distance distribution vector of each simulated network node, we can comprehensively consider the degree of clustering between node neighbors and the distance between nodes and other nodes. This method comprehensively describes the characteristics of network nodes, avoids the one-sidedness of focusing on a single characteristic, and makes the evaluation of network topology more accurate and comprehensive. Based on the clustering coefficient and distance distribution vector, we define the high-order information distribution and adjust the parameters to obtain the clustering coefficient and distance distribution vector. To flexibly adjust the weights of high-order clustering coefficient information and distance information. This method can highlight the importance of different features according to actual needs and better adapt to different network scenarios. For example, in scenarios with high requirements for network connectivity, the , placing greater emphasis on high-order clustering coefficient information to better assess network connectivity. Using the Jensen-Shannon divergence to define the network node divergence (NND) effectively measures the heterogeneity of network node connectivity. The NND value clearly illustrates the differences in node connectivity within a network, providing an important quantitative metric for network structure analysis and optimization. For example, in network design, the NND value can be used to determine whether the network has node connectivity issues, allowing adjustments and optimization of the network structure. The simulation evaluation value of the third simulation metric, determined by calculating the similarity between the node divergence of the simulated network and the node divergence of the real network, accurately assesses the structural similarity between the simulated network and the real network. This is crucial for verifying the effectiveness and reliability of the simulation model, ensuring that the simulation results more accurately reflect the characteristics of the real network and providing a more reliable basis for decision-making based on the simulation model.

[0088] In some embodiments, the method further comprises:

[0089] (1) When there is a fourth simulation indicator whose indicator attribute characteristic is a network vulnerability, obtaining an average number of simulated vulnerabilities and an average number of real vulnerabilities of the network vulnerability, and obtaining an average level of the simulated vulnerabilities and an average level of the real vulnerabilities;

[0090] (2) Obtaining a ratio of the average number of simulated vulnerabilities to the average number of real vulnerabilities to obtain a first ratio;

[0091] (3) Obtaining a ratio of the average level of the simulated vulnerabilities to the average level of the real vulnerabilities to obtain a second ratio;

[0092] (4) Determine the product of the first proportion and the second proportion to obtain a simulation evaluation value of the fourth simulation indicator.

[0093] For the fourth simulation indicator, whose attribute characteristic is network vulnerability, simply considering the number of vulnerabilities and the security level is not a comprehensive approach. A large number of vulnerabilities does not necessarily mean a high security level, and vice versa. Therefore, for general situations, a comprehensive consideration can be made. The calculation process of these two indicators using the ratio method is as follows:

[0094] ;

[0095] in, represents the average number of vulnerabilities in the simulated network, that is, the average number of simulated vulnerabilities, It represents the set of vulnerabilities in the simulated network. By taking the absolute value and averaging it, we can get the average number of vulnerabilities in the simulated network, which reflects the overall scale of vulnerabilities in the simulated network. It represents the average number of vulnerabilities in the actual network, that is, the average number of real vulnerabilities. Represents the set of vulnerabilities in the actual network. Similarly, the absolute value is taken and the average is calculated to obtain the average number of vulnerabilities in the actual network, which is used as a benchmark for comparison with the simulated network. It represents the average value of vulnerability security level in the simulated network, that is, the average level of simulated vulnerability. Indicates the first The security level of each vulnerability is calculated and the average security level of all vulnerabilities is calculated to reflect the average severity of the vulnerabilities in the simulated network. It represents the average security level of vulnerabilities in the actual network, that is, the average level of real vulnerabilities.

[0096] Represents the security level of the i-th vulnerability in the actual network. The average severity of the vulnerability in the actual network is obtained after averaging, which serves as a reference for evaluating the severity of the vulnerability in the simulated network. That is the first proportion, The second proportion is calculated by multiplying the first proportion by the second proportion to obtain the simulation evaluation value of the fourth simulation indicator. Among them, the number of vulnerabilities and the vulnerability level can be obtained by testing using third-party testing tools.

[0097] In this way, by multiplying the ratio of the number of vulnerabilities with the ratio of the vulnerability security levels, a comprehensive indicator vulnerability is obtained by comprehensively considering the factors of the number of vulnerabilities and the severity of vulnerabilities in the simulated network and the actual network. It is used to comprehensively evaluate the similarity or difference between the simulated network and the actual network in terms of vulnerabilities, thereby more accurately reflecting the simulation effect of the simulated network in terms of network vulnerabilities.

[0098] In step 204, the simulation evaluation value of each simulation indicator is aggregated to obtain a total simulation evaluation value.

[0099] After obtaining the simulation evaluation values ​​of the simulation indicators included in each simulation level, the simulation evaluation values ​​of each simulation indicator are aggregated to calculate a total simulation evaluation value representing the simulation network.

[0100] In some implementations, aggregating the simulation evaluation values ​​of each simulation indicator to obtain a total simulation evaluation value includes:

[0101] (1) When there are at least two simulation indicators in the first simulation level, the simulation evaluation values ​​of the simulation indicators in the first simulation level are aggregated to obtain a layer simulation evaluation value of the first simulation level;

[0102] (2) performing index aggregation on the layer simulation evaluation values ​​of the first simulation level and the simulation evaluation values ​​of the simulation indicators of the second simulation level to obtain a total simulation evaluation value, wherein the second simulation level is the simulation level other than the first simulation level in the simulation model.

[0103] Among them, for the first simulation level with at least two simulation indicators, it is necessary to perform indicator aggregation on the simulation evaluation values ​​of multiple simulation indicators in the first simulation level in advance, so as to determine the layer simulation evaluation value representing the first simulation level, and finally perform indicator aggregation on the layer simulation evaluation values ​​of the first simulation level and the simulation evaluation values ​​of the simulation indicators of the second simulation level to obtain the total simulation evaluation value. The second simulation level here is a simulation level with only one simulation indicator.

[0104] Specifically, we use the AHP to aggregate various metrics. Specifically, we do the following: 1. Perform the AHP within each level to obtain the results for each level. If you are only interested in a particular simulation level, you can stop at that point. 2. Repeat the AHP between each level to obtain the final results.

[0105] For example, the OSI-like model has a total of four layers. If too many simulation indicators are selected in a certain layer, such as 10 simulation indicators, the hierarchical analysis method can be used once in this layer to aggregate the 10 simulation indicators into one or two layers of simulation evaluation values ​​to represent this simulation level. Then, the hierarchical analysis method can be used again among the four layers to aggregate all the first-level indicators into one indicator to represent the credibility.

[0106] Therefore, when a simulation model has multiple levels, each containing multiple simulation indicators, this indicator aggregation method can effectively handle complex hierarchical structures. For the case where there are at least two simulation indicators in the first simulation level, the indicators within that level are first aggregated to obtain a layer simulation evaluation value, which is then aggregated with the simulation indicator evaluation values ​​of other levels. This allows for a comprehensive and organized evaluation of the entire simulation model, meeting the evaluation requirements of complex models. By using the AHP method to obtain the results for each level within each level, the characteristics of each level can be highlighted. For example, when selecting multiple simulation indicators for a layer in an OSI-like model, the indicators are first aggregated within that layer to obtain a layer simulation evaluation value that represents that layer, accurately reflecting the characteristics of that layer. When focusing on only a specific simulation level, the evaluation results for that level can be directly obtained, meeting different evaluation priorities and making the evaluation more flexible and targeted. By considering the relative importance of indicators, the AHP method can more accurately aggregate indicators. Hierarchical analysis is performed both within and between hierarchies, integrating information from different hierarchies and indicators, avoiding the bias that can arise from simple averaging. Multiple simulation indicators are aggregated into a representative hierarchical evaluation value, which is then further aggregated to form an overall simulation evaluation value. This ensures that the evaluation results better reflect the actual situation of the simulation model, improving the accuracy and reliability of the evaluation.

[0107] In some implementations, performing indicator aggregation on the simulation evaluation values ​​of the simulation indicators in the first simulation level to obtain the layer simulation evaluation value of the first simulation level includes:

[0108] (1.1) obtaining an importance scale matrix between simulation indicators in each of the first simulation levels;

[0109] (1.2) determining the product of each row in the importance scale matrix to obtain a first calculation result of each simulation indicator;

[0110] (1.3) performing square root calculation of the number of simulation indicators on the first calculation result of each simulation indicator to obtain a second calculation result of each simulation indicator;

[0111] (1.4) normalizing the second calculation result of each simulation indicator to obtain a factor weight of each simulation indicator;

[0112] (1.5) Based on the factor weight of each simulation indicator, weighted sum is performed on the simulation evaluation value of each simulation indicator to obtain the layer simulation evaluation value of the first simulation level.

[0113] Among them, the indicator aggregation process between the simulation evaluation values ​​corresponding to multiple simulation levels is the same as the indicator aggregation process of the multiple simulation indicators included in the first simulation level. Therefore, the indicator aggregation process of the multiple simulation indicators included in the first simulation level is used to illustrate the specific indicator aggregation method.

[0114] Specifically, the multiple simulation indicators included in the first simulation level are constructed into an importance scale matrix between the simulation indicators in the form of rows and columns. The product of each row in the importance scale matrix is ​​determined to obtain the first calculation result of each simulation indicator; the square root of the number of simulation indicators is calculated for the first calculation result of each simulation indicator to obtain the second calculation result of each simulation indicator; the second calculation result of each simulation indicator is normalized to obtain the factor weight of each simulation indicator; based on the factor weight of each simulation indicator, the simulation evaluation value of each simulation indicator is weighted and summed to obtain the layer simulation evaluation value of the first simulation level. It can be understood that the layer simulation indicator obtained after the aggregation of the multiple simulation indicators corresponding to the first simulation level is not limited to one, but can also be two or three, etc., which is not limited here.

[0115] The following illustrates the aggregation process for simulation metrics using five simulation metrics: network performance, device performance, and topology from the network layer simulation layer, vulnerability threats from the behavioral layer simulation layer, and granularity from the application layer simulation layer. Table 1 shows the five simulation metrics: granularity, network performance, device performance, topology, and vulnerability threats, as well as the relative importance of each metric.

[0116] Table 1

[0117]

[0118] By arranging the five simulation indicators of granularity, network performance, device performance, topology and vulnerability threats in rows and columns according to their importance (which can be obtained by manual scoring), we get the importance scale matrix shown in Table 1. Calculate the product of each row to get the first calculation result set ,in, This is the first calculation result of the granularity. This is the first calculation result of network performance. This is the first calculation result of the equipment performance. This is the first calculation result of the topology. This is the first calculation result of the vulnerability threat. If n=5, then calculate the 5th order square root of each first calculation result, and the second calculation results of the simulation indicators are Finally, the second calculation result of each simulation index is normalized to obtain the factor weight set weights= , where 0.127 is the weight factor of the granularity, is the weight factor of network performance, is the weight factor of device performance, is the weight factor of the topology, This is the weight factor for vulnerability threats. By weighted summation, we can obtain the aggregated results of the five simulation indicators: granularity, network performance, device performance, topology, and vulnerability threats, which is the total simulation evaluation value of the simulated network.

[0119] By constructing an importance scaling matrix, the relative importance of various simulation metrics can be quantified. For example, in the example presented, the matrix clearly illustrates the relative importance of different simulation metrics (such as granularity and network performance). This helps provide a deeper understanding of each metric's role in the overall evaluation and avoids biased evaluation results due to subjective misjudgments of metric importance. After a series of calculations, such as multiplication of each row, square root extraction, and normalization, factor weights are ultimately derived for each simulation metric. These weights accurately reflect the importance of each metric. The subsequent weighted summation ensures that important metrics receive an appropriate weight in the layer simulation evaluation, making the evaluation results more reflective of the actual situation. In actual simulation evaluations, a single metric often fails to fully reflect system performance. This method comprehensively considers multiple simulation metrics, avoiding the one-sidedness of evaluations based solely on individual metrics. For example, when considering network simulation, combining multiple metrics such as granularity, network performance, and device performance allows for a more comprehensive assessment of the overall network status. By weighting and summing multiple indicators, we can balance the fluctuations of each indicator to a certain extent and reduce the impact of abnormal values ​​of individual indicators on the final evaluation results. This makes the layer simulation evaluation value more stable and reliable, providing a more solid basis for decision-making.

[0120] Similarly, after obtaining the indicator aggregation results of the simulation evaluation values ​​of multiple simulation indicators included in the first simulation layer, they can be used as the layer simulation evaluation value corresponding to the first simulation layer. In this way, the first simulation layer only includes one simulation evaluation value, and the second simulation layer also only includes one simulation evaluation value. The simulation evaluation values ​​corresponding to each simulation layer (the first simulation layer and the second simulation layer) are aggregated using the same indicator aggregation method as the simulation evaluation values ​​of the multiple simulation indicators included in the first simulation layer, and the final total simulation evaluation value used to represent the simulation network can be obtained.

[0121] As can be seen from the above, the embodiment of the present application obtains a simulation model obtained for network system simulation, wherein the simulation model includes different simulation levels; determines to select simulation indicators from each simulation level; determines the simulation evaluation value of each simulation indicator according to the indicator attribute characteristics of each simulation indicator; and performs indicator aggregation on the simulation evaluation value of each simulation indicator to obtain a total simulation evaluation value. Compared with the related art, which performs simulation evaluation based on the similarity of the entire system level and has poor evaluation accuracy, different levels can be simulated during simulation, and different simulation indicators can be set for different levels, thereby comprehensively evaluating the simulation evaluation values ​​of different simulation indicators to obtain a final total simulation evaluation value, thereby improving evaluation accuracy.

[0122] For simulation indicators characterized by a single attribute value, a ratio method is used to determine the simulation evaluation value. The calculation process is concise, clear, and easy to understand and operate. This method does not require complex calculations or models, and can quickly obtain simulation evaluation results, reducing the difficulty and cost of evaluation. When calculating the simulation evaluation value, the value of the simulation indicator in the simulation model and the actual value in the actual network are obtained, and the ratio of the two is used to reflect the degree of closeness between the simulation and the actual situation. This evaluation method can more accurately measure the effectiveness and credibility of the simulation model. For simulation indicators with multiple sub-indicators (such as network performance including network bandwidth, network latency, and network packet loss rate), this method calculates the simulation evaluation value of each sub-indicator separately and then synthesizes it to obtain the overall simulation evaluation value. This comprehensively considers all aspects of the complex indicator, avoiding the situation where other important factors are ignored by focusing on a single sub-indicator, thereby more accurately reflecting the actual situation of the simulation indicator and the performance of the simulation model. It provides both an average calculation method to determine the simulation evaluation value and the ability to assign different weights to each sub-indicator based on its importance, making this method highly flexible and adaptable. In different application scenarios and requirements, the appropriate calculation method can be selected according to the actual situation. By obtaining the clustering coefficient and distance distribution vector of each simulated network node, the degree of clustering between node neighbors and the distance between nodes and other nodes can be comprehensively considered. This method comprehensively describes the characteristics of network nodes, avoids the one-sidedness of focusing on a single characteristic, and makes the evaluation of network topology more accurate and comprehensive. Based on the clustering coefficient and distance distribution vector, the high-order information distribution is defined, and by adjusting the parameters To flexibly adjust the weights of high-order clustering coefficient information and distance information. This method can highlight the importance of different features according to actual needs and better adapt to different network scenarios. For example, in scenarios with high requirements for network connectivity, the , placing greater emphasis on high-order clustering coefficient information to better assess network connectivity. Using the Jensen-Shannon divergence to define the network node divergence (NND) effectively measures the heterogeneity of network node connectivity. The NND value clearly illustrates the differences in node connectivity within a network, providing an important quantitative metric for network structure analysis and optimization. For example, in network design, the NND value can be used to determine whether the network has node connectivity issues, allowing adjustments and optimization of the network structure. The simulation evaluation value of the third simulation metric, determined by calculating the similarity between the node divergence of the simulated network and the node divergence of the real network, accurately assesses the structural similarity between the simulated network and the real network. This is crucial for verifying the effectiveness and reliability of the simulation model, ensuring that the simulation results more accurately reflect the characteristics of the real network and providing a more reliable basis for decision-making based on the simulation model. By multiplying the ratio of vulnerability counts with the ratio of vulnerability security levels, a comprehensive vulnerability metric, "vulnerability," is derived, taking into account both the number and severity of vulnerabilities in the simulated network and the actual network. This metric is used to comprehensively assess the similarities or differences between the simulated network and the actual network in terms of vulnerabilities, thereby more accurately reflecting the simulation effect of the simulated network in terms of network vulnerabilities. This metric aggregation method can effectively handle complex hierarchical structures when the simulation model has multiple layers, each containing multiple simulation metrics. For the first simulation layer with at least two simulation metrics, the metrics within that layer are first aggregated to obtain a layer simulation evaluation value, which is then aggregated with the simulation metric evaluation values ​​of other layers. This allows for a comprehensive and organized evaluation of the entire simulation model, meeting the evaluation requirements of complex models. By using the AHP method to generate results for each layer within each layer, the characteristics of each layer can be highlighted. For example, when selecting multiple simulation metrics for a layer in an OSI-like model, metrics are first aggregated within that layer to obtain a layer simulation evaluation value that represents that layer, accurately reflecting the characteristics of that layer. For scenarios focusing on a specific simulation level, the evaluation results for that level can be directly derived, meeting different evaluation priorities and making the evaluation more flexible and targeted. The AHP method, by considering the relative importance of indicators, enables more accurate aggregation of indicators. Performing AHP analysis both within and between levels integrates information from different levels and indicators, avoiding the bias that can arise from simple averaging. Aggregating multiple simulation indicators into a representative evaluation value for each level, and then further aggregating it to obtain an overall simulation evaluation value, ensures that the evaluation results better reflect the true state of the simulation model, improving the accuracy and reliability of the evaluation. By constructing an importance scaling matrix, the relative importance of various simulation indicators can be quantified. For example, in the example presented, the matrix clearly illustrates the importance relationships between different simulation indicators (such as granularity and network performance).This helps to gain a deeper understanding of each metric's role in the overall evaluation and avoid biased evaluation results caused by subjective misjudgment of metric importance. After a series of calculation steps, such as calculating the product of each row, taking square roots, and normalization, factor weights are ultimately derived for each simulation metric. These weights accurately reflect the importance of each metric. The subsequent weighted summation ensures that important metrics receive an appropriate weight in the layer simulation evaluation, making the evaluation results more reflective of actual conditions. In actual simulation evaluations, a single metric often fails to fully reflect system performance. This method comprehensively considers multiple simulation metrics, avoiding the one-sidedness of evaluations based solely on individual metrics. For example, when considering network simulation, combining multiple metrics such as granularity, network performance, and device performance allows for a more comprehensive assessment of the overall network status. By weighting and summing multiple metrics, fluctuations in each metric can be balanced to a certain extent, reducing the impact of outliers in individual metrics on the final evaluation results. This makes layer simulation evaluations more stable and reliable, providing a more solid basis for decision-making.

[0123] The specific implementation of the above steps can be found in the previous embodiments and will not be repeated here.

[0124] To facilitate better implementation of the network simulation evaluation method provided in the embodiment of the present application, the embodiment of the present application also provides a device based on the above network simulation evaluation method. The meanings of the terms are the same as those in the above network simulation evaluation method, and the specific implementation details can be referred to the description in the method embodiment.

[0125] See also Figure 2 , Figure 2 This is a schematic diagram of the structure of a network simulation evaluation device provided in an embodiment of the present application, which is applied to a computer device. The network simulation evaluation device may include an acquisition unit 601, a first determination unit 602, a second determination unit 603, and an aggregation unit 604.

[0126] An acquiring unit 601 is configured to acquire a simulation model obtained by simulating a network system, wherein the simulation model includes different simulation levels;

[0127] A first determining unit 602 is configured to determine a simulation indicator to be selected from each simulation level;

[0128] A second determining unit 603 is configured to determine a simulation evaluation value of each simulation indicator according to an indicator attribute feature of each simulation indicator;

[0129] The aggregation unit 604 is configured to aggregate the simulation evaluation value of each simulation indicator to obtain a total simulation evaluation value.

[0130] In some embodiments, the second determining unit 603 includes:

[0131] A first acquiring subunit is configured to acquire, when there is a first simulation indicator whose indicator attribute characteristic is a single indicator value, a first simulation indicator value of the first simulation indicator and a first actual indicator value of the first simulation indicator;

[0132] The first determining subunit is configured to determine a ratio of the first simulation index value to the first actual index value to obtain a simulation evaluation value of the first simulation index.

[0133] In some embodiments, the second determining unit 603 further includes:

[0134] A second obtaining subunit is configured to obtain a second simulation indicator value and a corresponding second actual indicator value of each sub-indicator in the second simulation indicator when there is a second simulation indicator having an indicator attribute characteristic of having multiple sub-indicators;

[0135] A second determining subunit is configured to determine a ratio of a second simulation index value of each sub-indicator to a corresponding second actual index value, to obtain a sub-simulation evaluation value of each sub-indicator;

[0136] A third obtaining subunit is configured to obtain a sum of the sub-simulation evaluation values ​​of the plurality of sub-indicators to obtain a total sub-simulation evaluation value;

[0137] The third determining subunit is configured to determine a ratio of the total sub-simulation evaluation value to the number of sub-indicators of the sub-indicators, and obtain a simulation evaluation value of the second simulation indicator.

[0138] In some embodiments, the second determining unit 603 further includes:

[0139] a fourth acquisition subunit, configured to, when there is a third simulation indicator whose indicator attribute characteristic is a network topology, acquire a clustering coefficient of each simulated network node in the network topology and a distance distribution vector of each simulated network node;

[0140] a fourth determining subunit, configured to determine the high-order information distribution of each of the simulated network nodes based on the clustering coefficient of each of the simulated network nodes and the corresponding distance distribution vector;

[0141] a fifth determining subunit, configured to determine a simulated network node divergence according to a high-order information distribution of each simulated network node;

[0142] The sixth determining subunit is configured to determine a simulation evaluation value of the third simulation indicator based on the simulated network node divergence and the real network node divergence.

[0143] In some embodiments, the second determining unit 603 further includes:

[0144] a fifth obtaining subunit, configured to obtain, when there is a fourth simulation indicator having an indicator attribute characteristic of network vulnerability, an average number of simulated vulnerabilities and an average number of real vulnerabilities of the network vulnerability, and an average level of the simulated vulnerabilities and an average level of the real vulnerabilities;

[0145] a sixth obtaining subunit, configured to obtain a ratio of the average number of simulated vulnerabilities to the average number of real vulnerabilities to obtain a first proportion;

[0146] a seventh obtaining subunit, configured to obtain a ratio of the average level of the simulated vulnerabilities to the average level of the real vulnerabilities to obtain a second proportion;

[0147] The seventh determining subunit is configured to determine the product of the first proportion and the second proportion to obtain a simulation evaluation value of the fourth simulation indicator.

[0148] In some embodiments, the aggregation unit 604 includes:

[0149] A first indicator aggregation subunit is configured to, when there are at least two simulation indicators in a first simulation level, perform indicator aggregation on the simulation evaluation values ​​of the simulation indicators in the first simulation level to obtain a layer simulation evaluation value of the first simulation level;

[0150] The second indicator aggregation subunit is used to aggregate the layer simulation evaluation value of the first simulation level and the simulation evaluation value of the simulation indicator of the second simulation level to obtain a total simulation evaluation value. The second simulation level is the simulation level in the simulation model other than the first simulation level.

[0151] In some embodiments, the first indicator aggregation subunit is configured to:

[0152] Obtaining an importance scale matrix between simulation indicators in each of the first simulation levels;

[0153] Determine the product of each row in the importance scale matrix to obtain a first calculation result of each simulation indicator;

[0154] Performing square root calculation of the number of simulation indicators on the first calculation result of each simulation indicator to obtain a second calculation result of each simulation indicator;

[0155] Normalizing the second calculation result of each simulation indicator to obtain a factor weight of each simulation indicator;

[0156] Based on the factor weight of each simulation indicator, the simulation evaluation value of each simulation indicator is weighted and summed to obtain the layer simulation evaluation value of the first simulation level.

[0157] The specific implementation of each of the above units can be found in the previous embodiments and will not be described again here.

[0158] As can be seen from the above, the embodiment of the present application obtains a simulation model obtained for network system simulation through the acquisition unit 601, and the simulation model includes different simulation levels; the first determination unit 602 determines to select simulation indicators from each simulation level; the second determination unit 603 determines the simulation evaluation value of each simulation indicator according to the indicator attribute characteristics of each simulation indicator; the aggregation unit 604 aggregates the simulation evaluation value of each simulation indicator to obtain a total simulation evaluation value. Compared with the related art, which performs simulation evaluation based on the similarity of the entire system level and has poor evaluation accuracy, different levels can be simulated during simulation, and different simulation indicators can be set for different levels, so as to comprehensively evaluate the simulation evaluation values ​​of different simulation indicators and obtain a final total simulation evaluation value, thereby improving evaluation accuracy.

[0159] The specific implementation of each of the above units can be found in the previous embodiments and will not be described again here.

[0160] Reference Figure 3 , Figure 3 This is a block diagram of the structure of a portion of a computer device 1000 for implementing an embodiment of the present disclosure. The computer device 1000 may vary greatly due to different configurations or performance, and may include one or more central processing units (CPUs) 622 (for example, one or more processors) and memories 632, and one or more storage media 630 (for example, one or more mass storage devices) for storing application programs 642 or data 644. The memories 632 and storage media 630 may be temporary storage or permanent storage. The program stored in the storage medium 630 may include one or more modules (not shown in the figure), each module may include a series of instruction operations on the server 600. Furthermore, the central processing unit 622 may be configured to communicate with the storage medium 630 to execute a series of instruction operations in the storage medium 630 on the server 600.

[0161] The computer device 1000 may also include one or more power supplies 626, one or more wired or wireless network interfaces 650, one or more input and output interfaces 658, and / or one or more operating systems 641, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc.

[0162] The central processing unit 622 in the computer device 1000 may be used to execute the network simulation evaluation method according to the embodiment of the present disclosure, for example:

[0163] Acquire a simulation model obtained by simulating a network system, wherein the simulation model includes different simulation levels;

[0164] determining simulation indicators selected from each of the simulation levels;

[0165] Determining a simulation evaluation value of each simulation indicator according to the indicator attribute characteristics of each simulation indicator;

[0166] The simulation evaluation value of each simulation indicator is aggregated to obtain the total simulation evaluation value.

[0167] By obtaining a simulation model obtained for network system simulation, the simulation model includes different simulation levels; determining to select simulation indicators from each simulation level; determining the simulation evaluation value of each simulation indicator based on the indicator attribute characteristics of each simulation indicator; and performing indicator aggregation on the simulation evaluation value of each simulation indicator to obtain a total simulation evaluation value. Compared with the related art that performs simulation evaluation based on the similarity of the entire system level, which has poor evaluation accuracy, different levels can be simulated during simulation, and different simulation indicators can be set for different levels, so as to comprehensively evaluate the simulation evaluation values ​​of different simulation indicators and obtain a final total simulation evaluation value, thereby improving evaluation accuracy.

[0168] The embodiments of the present disclosure further provide a computer-readable storage medium, which is used to store program codes, and the program codes are used to execute the network simulation evaluation methods of the aforementioned embodiments.

[0169] The present disclosure also provides a computer program product, which includes a computer program. A processor of a computer device reads and executes the computer program, so that the computer device implements the above-mentioned network simulation evaluation method. For example:

[0170] Acquire a simulation model obtained by simulating a network system, wherein the simulation model includes different simulation levels;

[0171] determining simulation indicators selected from each of the simulation levels;

[0172] Determining a simulation evaluation value of each simulation indicator according to the indicator attribute characteristics of each simulation indicator;

[0173] The simulation evaluation value of each simulation indicator is aggregated to obtain the total simulation evaluation value.

[0174] By obtaining a simulation model obtained for network system simulation, the simulation model includes different simulation levels; determining to select simulation indicators from each simulation level; determining the simulation evaluation value of each simulation indicator based on the indicator attribute characteristics of each simulation indicator; and performing indicator aggregation on the simulation evaluation value of each simulation indicator to obtain a total simulation evaluation value. Compared with the related art that performs simulation evaluation based on the similarity of the entire system level, which has poor evaluation accuracy, different levels can be simulated during simulation, and different simulation indicators can be set for different levels, so as to comprehensively evaluate the simulation evaluation values ​​of different simulation indicators and obtain a final total simulation evaluation value, thereby improving evaluation accuracy.

[0175] In addition, the terms "comprises" and "comprising" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or apparatus that comprises a series of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, product or apparatus.

[0176] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0177] It should be understood that in the description of the embodiments of the present application, the meaning of multiple (or multiple items) is more than two, greater than, less than, exceed, etc. are understood to exclude the number itself, and above, below, within, etc. are understood to include the number itself.

[0178] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0179] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0180] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0181] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0182] It should also be understood that the various implementation methods provided in the embodiments of the present application can be combined arbitrarily to achieve different technical effects.

[0183] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or portion of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal. It can be implemented in whole or in part using software, hardware (such as processing circuits or memory), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the functionality of the module or unit.

[0184] The above is a specific description of the implementation methods of the present application, but the present application is not limited to the above implementation methods. Technical personnel familiar with the art can also make various equivalent modifications or substitutions without violating the spirit of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A network simulation evaluation method, characterized in that: include: Acquire a simulation model obtained for network system simulation, wherein the simulation model includes different simulation levels, including a layer simulation level, an application layer simulation level, a network layer simulation level, and a system layer simulation level; determining simulation indicators selected from each of the simulation levels; When there is a first simulation indicator whose indicator attribute characteristic is a single indicator value, obtaining a first simulation indicator value of the first simulation indicator and a first actual indicator value of the first simulation indicator; Determining a ratio of the first simulation index value to the first actual index value to obtain a simulation evaluation value of the first simulation index; When there is a second simulation indicator having a plurality of sub-indicators as an indicator attribute characteristic, obtaining a second simulation indicator value and a corresponding second actual indicator value of each sub-indicator in the second simulation indicator; Determine the ratio of the second simulation index value of each sub-indicator to the corresponding second actual index value to obtain a sub-simulation evaluation value of each sub-indicator; Obtaining the sum of the sub-simulation evaluation values ​​of the plurality of sub-indicators to obtain a total sub-simulation evaluation value; Determine a ratio of the total sub-simulation evaluation value to the number of sub-indicators of the sub-indicator to obtain a simulation evaluation value of the second simulation indicator; When there is a third simulation indicator whose indicator attribute characteristic is a network topology, obtaining a clustering coefficient of each simulated network node in the network topology and a distance distribution vector of each simulated network node; Determining the high-order information distribution of each of the simulated network nodes based on the clustering coefficient of each of the simulated network nodes and the corresponding distance distribution vector; Determining the simulated network node divergence according to the high-order information distribution of each simulated network node; Determining a simulation evaluation value of the third simulation indicator based on the simulated network node divergence and the real network node divergence; When there is a fourth simulation indicator whose indicator attribute characteristic is a network vulnerability, obtaining an average number of simulated vulnerabilities and an average number of real vulnerabilities of the network vulnerability, and obtaining an average level of the simulated vulnerabilities and an average level of the real vulnerabilities; Obtaining a ratio of the average number of simulated vulnerabilities to the average number of real vulnerabilities to obtain a first ratio; Obtaining a ratio of the average level of the simulated vulnerabilities to the average level of the real vulnerabilities to obtain a second ratio; Determine the product of the first proportion and the second proportion to obtain a simulation evaluation value of the fourth simulation indicator; The simulation evaluation value of each simulation indicator is aggregated to obtain the total simulation evaluation value.

2. The network simulation evaluation method according to claim 1, wherein: The simulation evaluation value of each simulation indicator is aggregated to obtain a total simulation evaluation value, including: When there are at least two simulation indicators in the first simulation level, performing indicator aggregation on the simulation evaluation values ​​of the simulation indicators in the first simulation level to obtain a layer simulation evaluation value of the first simulation level; The layer simulation evaluation values ​​of the first simulation level and the simulation evaluation values ​​of the simulation indicators of the second simulation level are aggregated to obtain a total simulation evaluation value. The second simulation level is the simulation level in the simulation model other than the first simulation level.

3. The network simulation evaluation method according to claim 2, wherein: The performing indicator aggregation on the simulation evaluation values ​​of the simulation indicators in the first simulation level to obtain the layer simulation evaluation value of the first simulation level includes: Obtaining an importance scale matrix between simulation indicators in each of the first simulation levels; Determine the product of each row in the importance scale matrix to obtain a first calculation result of each simulation indicator; Performing square root calculation of the number of simulation indicators on the first calculation result of each simulation indicator to obtain a second calculation result of each simulation indicator; Normalizing the second calculation result of each simulation indicator to obtain a factor weight of each simulation indicator; Based on the factor weight of each simulation indicator, the simulation evaluation value of each simulation indicator is weighted and summed to obtain the layer simulation evaluation value of the first simulation level.

4. A network simulation evaluation device, characterized in that: include: an acquiring unit, configured to acquire a simulation model obtained by simulating a network system, wherein the simulation model includes different simulation levels; A first determining unit, configured to determine to select simulation indicators from each of the simulation levels; The second determining unit includes: A first acquiring subunit is configured to acquire, when there is a first simulation indicator whose indicator attribute characteristic is a single indicator value, a first simulation indicator value of the first simulation indicator and a first actual indicator value of the first simulation indicator; a first determining subunit, configured to determine a ratio of the first simulation index value to the first actual index value, and obtain a simulation evaluation value of the first simulation index; A second obtaining subunit is configured to obtain a second simulation indicator value and a corresponding second actual indicator value of each sub-indicator in the second simulation indicator when there is a second simulation indicator having an indicator attribute characteristic of having multiple sub-indicators; A second determining subunit is configured to determine a ratio of a second simulation index value of each sub-indicator to a corresponding second actual index value, to obtain a sub-simulation evaluation value of each sub-indicator; A third obtaining subunit is configured to obtain a sum of the sub-simulation evaluation values ​​of the plurality of sub-indicators to obtain a total sub-simulation evaluation value; a third determining subunit, configured to determine a ratio of the total sub-simulation evaluation value to the number of sub-indicators of the sub-indicators, to obtain a simulation evaluation value of the second simulation indicator; a fourth acquisition subunit, configured to, when there is a third simulation indicator whose indicator attribute characteristic is a network topology, acquire a clustering coefficient of each simulated network node in the network topology and a distance distribution vector of each simulated network node; a fourth determining subunit, configured to determine the high-order information distribution of each of the simulated network nodes based on the clustering coefficient of each of the simulated network nodes and the corresponding distance distribution vector; a fifth determining subunit, configured to determine a simulated network node divergence according to a high-order information distribution of each simulated network node; a sixth determining subunit, configured to determine a simulation evaluation value of the third simulation indicator based on the simulated network node divergence and the real network node divergence; a fifth obtaining subunit, configured to obtain, when there is a fourth simulation indicator having an indicator attribute characteristic of network vulnerability, an average number of simulated vulnerabilities and an average number of real vulnerabilities of the network vulnerability, and an average level of the simulated vulnerabilities and an average level of the real vulnerabilities; a sixth obtaining subunit, configured to obtain a ratio of the average number of simulated vulnerabilities to the average number of real vulnerabilities to obtain a first proportion; a seventh obtaining subunit, configured to obtain a ratio of the average level of the simulated vulnerabilities to the average level of the real vulnerabilities to obtain a second proportion; a seventh determining subunit, configured to determine a product of the first proportion and the second proportion to obtain a simulation evaluation value of the fourth simulation indicator; The aggregation unit is used to aggregate the simulation evaluation value of each simulation indicator to obtain the total simulation evaluation value.

5. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the network simulation evaluation method according to any one of claims 1 to 3.

6. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the network simulation evaluation method according to any one of claims 1 to 3 is implemented.

Images