Network anti-attack performance evaluation method, device, computer equipment and storage medium

Abstract

The embodiments of the present application provide a network anti-attack performance evaluation method, apparatus, computer device, and storage medium. The method includes: establishing a simulated network system corresponding to a target network system and determining multiple simulation indicator objects in the simulated network system; obtaining a corresponding first evaluation indicator set for the multiple simulation indicator objects in the simulated network system; performing a simulated attack on at least one simulation indicator object in the simulated network system to obtain a simulated network system to be analyzed after the simulated attack; obtaining a second evaluation indicator set corresponding to the multiple simulation indicator objects in the simulated network system to be analyzed; and determining the anti-attack performance score of the target network system based on the difference between the first evaluation indicator set and the second evaluation indicator set. This improves the comprehensiveness and accuracy of network anti-attack performance evaluation.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network anti-attack performance evaluation method, device, computer equipment and storage medium. Background Art

[0002] A cyberattack refers to an attempt to infiltrate or damage a target system through offensive means (such as vulnerability exploitation, data tampering, and denial of service) in order to steal sensitive information, disable critical services, or disrupt business continuity. The threats posed by these attacks are diverse and complex. As cyberattack techniques become increasingly intelligent and covert, traditional defense systems struggle to fully address unknown attack chains, exposing shortcomings in identifying abnormal traffic, maintaining service resilience, and rapidly recovering from them. Therefore, it is necessary to conduct an attack resistance assessment of network systems to uncover blind spots in defense strategies and verify the consistency of attack response behavior between simulated environments and real systems. This allows for optimized security architecture design and ensures the continued reliability of core services in adversarial environments.

[0003] Related technologies typically use static analysis methods to assess a network's attack resistance. For example, they first calculate the degree centrality or betweenness centrality of network nodes based on graph theory, screening out core nodes with dense topological connections as pre-set attack targets. Next, they simulate attack behavior by performing a single node removal operation, such as directly deleting the top 10% of highly connected nodes. Finally, they evaluate the network's attack resistance based on the remaining network state after the attack. However, this approach relies solely on a single node removal operation and cannot fully assess the attack resistance of the entire network system. Consequently, the evaluation results are often incomplete and inaccurate. Summary of the Invention

[0004] The embodiments of the present application provide a network anti-attack performance evaluation method, apparatus, computer equipment, and storage medium, which can improve the comprehensiveness and accuracy of network anti-attack performance evaluation.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application proposes a method for evaluating network anti-attack performance, the method comprising:

[0006] Establishing a simulation network system corresponding to the target network system, and determining a plurality of simulation indicator objects in the simulation network system;

[0007] For a plurality of simulation indicator objects in the simulation network system, obtaining a corresponding first evaluation indicator set;

[0008] Performing a simulated attack on at least one simulation indicator object in the simulated network system to obtain a simulated network system to be analyzed after the simulated attack;

[0009] Obtain a second evaluation indicator set corresponding to a plurality of simulation indicator objects in the simulated network system to be analyzed;

[0010] Determine the anti-attack performance score of the target network system according to the indicator difference between the first evaluation indicator set and the second evaluation indicator set.

[0011] Accordingly, a second aspect of an embodiment of the present application provides a network anti-attack performance evaluation device, the device comprising:

[0012] An establishment module is used to establish a simulation network system corresponding to the target network system and determine a plurality of simulation indicator objects in the simulation network system;

[0013] A first acquisition module is used to acquire a corresponding first evaluation indicator set for a plurality of simulation indicator objects in the simulation network system;

[0014] An attack module, configured to perform a simulated attack on at least one simulation indicator object in the simulated network system to obtain a simulated network system to be analyzed after the simulated attack;

[0015] A second acquisition module is used to obtain a second evaluation index set corresponding to a plurality of simulation index objects in the simulated network system to be analyzed;

[0016] A determination module is used to determine the anti-attack performance score of the target network system according to the indicator difference between the first evaluation indicator set and the second evaluation indicator set.

[0017] In some embodiments, the first evaluation indicator set includes a first functional index subset, a first performance index subset, and a first robustness index subset; the second evaluation indicator set includes a second functional index subset, a second performance index subset, and a second robustness index subset; and the determining module is further configured to:

[0018] For each simulation indicator object, determining a function difference value, a performance difference value, and a robustness difference value between each simulation indicator object corresponding to the simulated network system and the simulated network system to be analyzed based on the first function index subset and the second function index subset, the first performance index subset and the second performance index subset, and the first robustness index subset and the second robustness index subset;

[0019] The anti-attack performance score of the target network system is determined based on the function difference value, the performance difference value and the robustness difference value associated with each simulation indicator object.

[0020] In some embodiments, the plurality of simulation indicator objects include a network topology, a server, and an application firewall corresponding to an application layer of the simulated network system, and communication lines and routers corresponding to a network layer of the simulated network system. The determining module is further configured to:

[0021] For the network topology structure in the simulated network system, obtaining the degree distribution and clustering coefficient corresponding to the network topology structure in the functional index dimension, obtaining a corresponding first functional index subset, and the average shortest path length between any two network nodes in the performance index dimension, obtaining a corresponding first performance index subset, and the number of cascading failure nodes and network communication efficiency in the robustness index dimension, obtaining a corresponding first robustness index subset;

[0022] Obtaining the uptime ratio of the server in the functional indicator dimension to obtain a corresponding first functional index subset, as well as the number of transactions processed per unit time, system response time, and system load in the performance indicator dimension to obtain a corresponding first performance index subset, and obtaining the central processing unit utilization rate, memory utilization rate, and hard disk utilization rate in the robustness indicator dimension to obtain a corresponding first robustness index subset;

[0023] Obtaining the attack detection rate, attack false alarm rate, and attack missed alarm rate of the application firewall in the functional indicator dimension to obtain a corresponding first functional index subset, as well as the maximum number of concurrent connections, maximum new connection rate, and maximum throughput in the performance indicator dimension to obtain a corresponding first performance index subset, and the attack response index in the robustness indicator dimension to obtain a corresponding first robustness index subset;

[0024] Obtaining device connectivity of the communication line in a functional indicator dimension to obtain a corresponding first functional index subset, as well as network throughput in a performance indicator dimension to obtain a corresponding first performance index subset, and transmission error rate in a robustness indicator dimension to obtain a corresponding first robustness index subset;

[0025] Obtain the packet forwarding accuracy and path optimization index of the router in the functional indicator dimension to obtain the corresponding first functional index subset, as well as the network throughput, routing table capacity, packet loss rate and input and output delay time in the performance indicator dimension to obtain the corresponding first performance index subset, and the system stability in the robustness indicator dimension to obtain the corresponding first robustness index subset.

[0026] In some embodiments, the determining module is further configured to:

[0027] For each simulation indicator object, inputting the corresponding first function index subset and second function index subset, the first performance index subset and second performance index subset, and the first robustness index subset and second robustness index subset into a preset algorithm mapping model to determine a corresponding algorithm type;

[0028] The functional difference value, performance difference value, and robustness difference value between each simulation indicator object are calculated through the corresponding algorithm type.

[0029] In some embodiments, the network anti-attack performance evaluation device further includes a determination module, further configured to:

[0030] By taking the simulation network system as a first root node, constructing a plurality of first child nodes corresponding to the simulation indicator objects, and taking the simulation network system to be analyzed as a second root node, constructing a plurality of second child nodes corresponding to the simulation indicator objects, wherein each first child node is associated with a corresponding first function index subset, a first performance index subset, and a first robustness index subset, and each second child node is associated with a corresponding second function index subset, a second performance index subset, and a second robustness index subset;

[0031] A difference connection edge between a first child node and a second child node corresponding to each simulation indicator object is respectively connected based on a function difference value, a performance difference value, and a robustness difference value between each simulation indicator object corresponding to the simulation network system to be analyzed;

[0032] Based on any of the first child nodes, the corresponding second child nodes, and the corresponding difference connection edges, global difference conduction is performed to determine the anti-attack performance score of the target network system.

[0033] In some embodiments, the network anti-attack performance evaluation device further includes an identification module for:

[0034] Acquire attack traffic launched against the simulated network system, and identify the attack type of the attack traffic through a variational autoencoder to obtain a target attack type;

[0035] Determining, according to the target attack type, the function difference weight, the performance difference weight, and the robustness difference weight corresponding to each simulation indicator object;

[0036] Adjusting the function difference value, performance difference value, and robustness difference value of each simulation indicator object based on the function difference weight, the performance difference weight, and the robustness difference weight, respectively, to obtain a target function difference value, a target performance difference value, and a target robustness difference value;

[0037] Then, determining the anti-attack performance score of the target network system based on the function difference value, the performance difference value, and the robustness difference value associated with each simulation indicator object in sequence includes:

[0038] The anti-attack performance score of the target network system is determined based on the target function difference value, the target performance difference value and the target robustness difference value associated with each simulation indicator object.

[0039] In some embodiments, the network anti-attack performance evaluation device further includes a comparison module for:

[0040] Comparing the anti-attack performance score with a preset performance evaluation standard to obtain a comparison result;

[0041] Based on the comparison result, determining a target simulation indicator object that needs to be adjusted and an adjustment plan from the multiple simulation indicator objects of the simulated network system to be analyzed;

[0042] According to the adjustment scheme, the indicator object corresponding to the target simulation indicator object in the target network system is adjusted.

[0043] Correspondingly, the third aspect of the embodiments of the present application proposes a computer device, which includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the network anti-attack performance evaluation method of any one of the embodiments of the first aspect of the present application.

[0044] Correspondingly, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the network anti-attack performance evaluation method of any one of the embodiments of the first aspect of the present application.

[0045] The embodiment of the present application establishes a simulation network system corresponding to the target network system and determines multiple simulation indicator objects in the simulation network system; obtains a corresponding first evaluation indicator set for multiple simulation indicator objects in the simulation network system; performs a simulated attack on at least one simulation indicator object in the simulation network system to obtain the simulation network system to be analyzed after the simulated attack; obtains a second evaluation indicator set corresponding to multiple simulation indicator objects in the simulation network system to be analyzed; and determines the anti-attack performance score of the target network system based on the indicator difference between the first evaluation indicator set and the second evaluation indicator set. In this way, the attack process can be simulated dynamically, and the changes of multiple simulation indicator objects before and after the attack can be comprehensively considered, and the behavioral deviation of the network system in complex attack scenarios can be quantified, breaking through the limitation of relying solely on single node removal, and realizing a comprehensive evaluation of the dynamic defense capability, behavioral consistency verification and recovery efficiency of the system under the unknown attack chain, thereby more accurately and comprehensively evaluating the network anti-attack performance of the network system. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 This is a schematic diagram of the architecture of the network anti-attack performance evaluation system provided in an embodiment of the present application;

[0047] Figure 2 This is a flow chart of a method for evaluating network anti-attack performance provided by an embodiment of the present application;

[0048] Figure 3 This is a schematic diagram of the functional modules of the network anti-attack performance evaluation device provided in an embodiment of the present application;

[0049] Figure 4 This is a schematic diagram of the hardware structure of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0051] It should be noted that although the device schematics illustrate functional module divisions and the flowcharts illustrate logical sequences, in certain circumstances, the steps shown or described may be performed in a sequence that differs from the module divisions in the device or the sequence in the flowcharts. The terms "first," "second," and so on, in the specification, claims, and drawings, are used to distinguish similar items and are not necessarily used to describe a specific sequence or precedence.

[0052] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0053] A cyberattack refers to an attempt to infiltrate or damage a target system through offensive means (such as vulnerability exploitation, data tampering, and denial of service) in order to steal sensitive information, disable critical services, or disrupt business continuity. The threats posed by these attacks are diverse and complex. As cyberattack techniques become increasingly intelligent and covert, traditional defense systems struggle to fully address unknown attack chains, exposing shortcomings in identifying abnormal traffic, maintaining service resilience, and rapidly recovering from them. Therefore, it is necessary to conduct an attack resistance assessment of network systems to uncover blind spots in defense strategies and verify the consistency of attack response behavior between simulated environments and real systems. This allows for optimized security architecture design and ensures the continued reliability of core services in adversarial environments.

[0054] Related technologies typically use static analysis methods to assess a network's attack resistance. For example, they first calculate the degree centrality or betweenness centrality of network nodes based on graph theory, screening out core nodes with dense topological connections as pre-set attack targets. Next, they simulate attack behavior by performing a single node removal operation, such as directly deleting the top 10% of highly connected nodes. Finally, they evaluate the network's attack resistance based on the remaining network state after the attack. However, this approach relies solely on a single node removal operation and cannot fully assess the attack resistance of the entire network system. Consequently, the evaluation results are often incomplete and inaccurate.

[0055] Based on this, the embodiments of the present application provide a network anti-attack performance evaluation method, apparatus, computer equipment and storage medium, which can improve the comprehensiveness and accuracy of network anti-attack performance evaluation.

[0056] The network anti-attack performance evaluation method, device, computer equipment and storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the network anti-attack performance evaluation system in the embodiments of the present application is described.

[0057] Please refer to Figure 1 In some implementations, an embodiment of the present application provides a network anti-attack performance evaluation system, including a terminal 11 and a server 12.

[0058] Exemplarily, the terminal 11 may be a personal computer or a mobile device (such as a tablet computer or a smart phone). The terminal 11 may provide a user interface, enabling technicians to initiate simulated attack requests, detect simulation processes, and view evaluation results of the network's anti-attack performance.

[0059] Furthermore, the server side 12 can be a high-performance computing server, a cloud computing cluster, etc., which can be used to run the core logic of the simulated network system, including relevant components of the application layer and the network layer, and process various indicator extraction and comparative calculations from before the attack to after the attack.

[0060] Furthermore, terminal 11 sends instructions to server 12 via a network connection, such as starting a new attack simulation or requesting the latest simulation results report. Upon receiving the instructions from terminal 11, server 12 can execute the corresponding simulation task based on the preset simulated network system to be analyzed, compare the post-attack indicator data with the pre-attack attack data, generate an anti-attack performance score, and return the processed results to terminal 11 for display.

[0061] The network anti-attack performance evaluation method in the embodiment of the present application can be illustrated by the following example.

[0062] It should be noted that in each specific embodiment of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0063] In the embodiment of the present application, the network anti-attack performance evaluation device will be described from the perspective of the network anti-attack performance evaluation device, which can be integrated into a computer device. Figure 2 , Figure 2 This is a flowchart of the steps of the network anti-attack performance evaluation method provided in an embodiment of the present application. In this embodiment of the present application, the network anti-attack performance evaluation device is specifically integrated into a terminal or server as an example. When the processor on the terminal or server executes the program instructions corresponding to the network anti-attack performance evaluation method, the specific process is as follows:

[0064] Step 101: Establish a simulated network system corresponding to the target network system, and determine a plurality of simulation indicator objects in the simulated network system.

[0065] In some implementations, researchers can conduct comprehensive and detailed analysis and testing of the network system's anti-attack performance without affecting real business operations. They can create a simulated network system that is highly similar to the actual target network system, so that network security attack simulation and evaluation can be performed on the simulated network system.

[0066] Among them, the target network system can be the actual network system to be evaluated in a real network environment, including the complete architecture of the application layer (such as servers, user behavior protocols, etc.) and the network layer (such as routers, switches, etc.), and is the prototype object for simulation and replication of the network target range (that is, the simulated network system).

[0067] Among them, the simulated network system can be a digital mapping system built through virtualization technology in a network target range platform, which is highly consistent with the structure and function of the target network system. It can be composed of dynamically configurable simulation components such as the application layer (such as simulated network topology structure, Hypertext Transfer Protocol (HTTP) interaction behavior) and the network layer (such as virtual router packet forwarding rules), and can accurately reproduce the protocol interaction logic and data transmission mechanism in the real network environment.

[0068] The simulation indicator objects may be various parameters selected in the simulation network system and used to quantitatively evaluate the system performance.

[0069] For example, traffic mirroring and configuration capture can be used to extract the topology, protocol interaction rules, hardware parameters, etc. of the target network system. In the network target range platform, kernel-based virtual machine (KVM) virtualization technology can be used to create a logical topology consistent with the target network system, deploy application layer components and network layer components, and finally implant adjustable parameters (such as dynamically increasing or decreasing the number of server nodes and simulating link bandwidth fluctuations) to ensure that the simulated network system has elastic expansion capabilities.

[0070] In some embodiments, the simulation indicator object can be the network topology structure, server, intrusion detection system (IDS), Web application firewall (WAF), application firewall, etc. corresponding to the application layer of the simulated network system, as well as the communication lines, three-layer switches, routers, etc. corresponding to the network layer of the simulated network system.

[0071] Specifically, since network attacks typically prioritize destroying key nodes (such as those with high centrality and high betweenness), changes in their degree distribution and clustering coefficient directly reflect the resilience of the system structure. Therefore, network topology can be used as a simulation indicator. Servers and application firewalls, as the service carriers and security boundaries of the application layer, are most sensitive to attack responses, such as their detection rates. Therefore, servers and application firewalls are used as simulation indicators. Routers and communication lines, as the basic network layer settings, determine the scope of attack propagation. For example, routing table overflows can cause network-wide paralysis. Therefore, routers and communication lines are used as simulation indicators. This allows us to focus on service availability and security protection capabilities after an attack at the application layer, and on the reliability of data transmission and device robustness (such as router forwarding accuracy) after an attack at the network layer, thereby improving the accuracy and comprehensiveness of network anti-attack performance evaluation.

[0072] Through the above method, a simulated network system corresponding to the target network system can be established, and multiple simulation indicator objects can be determined therein, achieving a high degree of simulation of the real network environment, so as to facilitate the subsequent comprehensive evaluation of the changes in the simulated network system before and after the attack without affecting the actual business operation.

[0073] Step 102: Obtain corresponding first evaluation indicator sets for multiple simulation indicator objects in the simulation network system.

[0074] In some embodiments, in order to provide an original reference for dynamic difference analysis after subsequent attack simulation, the baseline data (first evaluation indicator set) of each simulation indicator object of the simulated network system when it is not attacked can be systematically collected to establish indicator baseline data to support the quantitative comparison of system state changes before and after the attack, thereby accurately evaluating the target network system's anti-attack capabilities.

[0075] The first evaluation indicator set may be a first functional indicator set, a first performance indicator set, and a first robustness indicator set collected for each simulation indicator object of the application layer and the network layer in the baseline state of the simulation network system before the attack.

[0076] In some embodiments, each simulation indicator object corresponds to a first evaluation indicator set, that is, each simulation indicator object corresponds to a first functional index subset, a first performance index subset, and a first robustness index subset. Taking the network topology structure as an example, the network topology structure can obtain the degree distribution (i.e., the distribution of the number of connections between each node in the network topology structure, which can be expressed as the probability of the number of connections for each node) and the clustering coefficient (which can be used to represent the average degree of clustering of the entire network topology structure) corresponding to the functional indicator dimension of the network topology structure, and obtain the corresponding first functional index subset. In addition, in the performance indicator dimension, the average shortest path length between any two network nodes (which can be the average of the shortest path lengths between any two nodes in the network topology structure) can be obtained, and the corresponding first performance index subset can be obtained. In the robustness indicator dimension, the number of cascading failure nodes (which can be the number of other nodes that will be triggered to fail when each node in the network topology structure fails due to an attack) and network communication efficiency (which can be the ability of the remaining network to maintain a certain level of information exchange when some nodes or links in the network fail) can be obtained, and the corresponding first robustness index subset can be obtained.

[0077] By obtaining the first evaluation metric set corresponding to multiple simulation indicator objects, a comprehensive and detailed quantitative analysis of the network system's functionality, performance, and robustness before an attack can be achieved. This not only provides baseline data for subsequent attack simulations, ensuring accurate comparison of changes before and after an attack, but also effectively identifies the system's initial state and potential vulnerabilities, providing solid data support for further optimizing network security protection strategies and significantly improving the accuracy and reliability of overall network security assessments.

[0078] In some implementations, to provide comprehensive, fine-grained baseline data for dynamic differential analysis after subsequent attack simulations, the functionality, performance, and robustness indicators of each simulation indicator object in the simulated network system before the attack can be collected at the layered level (application layer, network layer) to construct a multidimensional benchmark dataset (the first evaluation indicator set), thereby supporting the authenticity and accuracy of the resilience (anti-attack performance) evaluation of the network range simulation system. For example, step 102 may include:

[0079] (102.1) For the network topology structure in the simulated network system, obtain the degree distribution and clustering coefficient corresponding to the network topology structure in the functional index dimension, obtain the corresponding first functional index subset, and the average shortest path length between any two network nodes in the performance index dimension, obtain the corresponding first performance index subset, and the number of cascading failure nodes and network communication efficiency in the robustness index dimension, obtain the corresponding first robustness index subset;

[0080] (102.2) Obtain the server's uptime percentage in the functional indicator dimension to obtain the corresponding first functional index subset, as well as the number of transactions processed per unit time, system response time, and system load in the performance indicator dimension to obtain the corresponding first performance index subset, and obtain the CPU usage, memory usage, and hard disk usage in the robustness indicator dimension to obtain the corresponding first robustness index subset;

[0081] (102.3) Obtain the attack detection rate, attack false alarm rate, and attack missed alarm rate of the application firewall in the functional indicator dimension, and obtain the corresponding first functional index subset; obtain the maximum number of concurrent connections, maximum new connection rate, and maximum throughput in the performance indicator dimension, and obtain the corresponding first performance index subset; and obtain the attack response index in the robustness indicator dimension, and obtain the corresponding first robustness index subset;

[0082] (102.4) Obtaining device connectivity of the communication line in the functional indicator dimension, obtaining a corresponding first functional index subset, as well as network throughput in the performance indicator dimension, obtaining a corresponding first performance index subset, and transmission error rate in the robustness indicator dimension, obtaining a corresponding first robustness index subset;

[0083] (102.5) Obtain the packet forwarding accuracy and path optimization index of the router in the functional indicator dimension, and obtain the corresponding first functional index subset, as well as the network throughput, routing table capacity, packet loss rate and input and output delay time in the performance indicator dimension, and obtain the corresponding first performance index subset, and obtain the system stability in the robustness indicator dimension, and obtain the corresponding first robustness index subset.

[0084] Among them, the application layer can be the layer in the network model that faces users and upper-layer services, including simulation indicator objects such as network topology, servers, and application firewalls, which are used to simulate real business scenarios.

[0085] The network topology structure can be a connection relationship and layout model of nodes (such as servers and clients) in a simulated network system, which is used to reflect the communication paths and dependencies between nodes.

[0086] The degree distribution may be the distribution of the number of connections of each node in the network topology.

[0087] The clustering coefficient can be the ability of nodes in the network topology to form tight clusters.

[0088] Among them, the server can be a simulation device that provides computing, storage or application services, simulating the hardware resources (CPU / memory / hard disk) and service operation status of a real server.

[0089] Among them, the application firewall can be a security device deployed at the application layer, simulating protection rules (such as HTTP request filtering, etc.) and attack response behaviors.

[0090] Among them, the network layer can be the layer responsible for data packet routing and forwarding, including communication lines, routers, three-layer switches and other equipment, which are used to simulate the transmission and switching functions of the physical network.

[0091] The communication line can be a transmission medium (such as optical fiber, twisted pair) in the simulated network, simulating link connectivity and transmission characteristics (speed, bit error rate).

[0092] Among them, the router can be a network layer device that simulates data packet forwarding, routing table management and path optimization functions.

[0093] Among them, the functional indicator dimension can be a set of indicators that measure the integrity of the core functions of the simulation indicator object, such as the degree distribution of the network topology, the effectiveness of the firewall rules, etc.

[0094] The performance indicator dimension may be a set of indicators that quantify the service efficiency of the simulation indicator object, such as server transaction processing rate and network throughput.

[0095] A network node can be a terminal or an intermediate device (such as a server or router) in the network topology.

[0096] The average shortest path length may be the average value of the shortest communication path lengths between any two nodes in the network topology, and is used to reflect the network communication efficiency.

[0097] Among them, the robustness indicator dimension can be a set of indicators for evaluating the system's anti-destruction and recovery capabilities, such as the impact range of cascading failures and link fault tolerance.

[0098] The number of cascading failure nodes may be the total number of nodes affected by the chain failure caused by the node being attacked.

[0099] The network communication efficiency may be an overall network communication performance index calculated based on path length and transmission quality.

[0100] The normal operating time ratio may be the proportion of time during which the server can provide services normally within the statistical period.

[0101] The number of transactions processed per unit time may be the number of transaction requests that the server can process per second.

[0102] The system response time can be the time delay from when the server receives a request to when it returns a result.

[0103] The system load may be a comprehensive indicator of the current resource usage (CPU / memory / hard disk) of the server.

[0104] The CPU usage rate may be a percentage of CPU (Central Processing Unit) resources of the server.

[0105] The memory usage may be a percentage of memory resources occupied by the server.

[0106] The hard disk usage rate may be a percentage of storage resource usage of the server.

[0107] The attack detection rate may be the proportion of attack behaviors correctly identified by the application firewall.

[0108] The attack false alarm rate may be the ratio of normal traffic misidentified as attack traffic by the application firewall.

[0109] The attack missed reporting rate may be the proportion of attack behaviors that the application firewall fails to identify.

[0110] The maximum number of concurrent connections may be the maximum number of connections that the application firewall can maintain simultaneously.

[0111] The maximum new connection rate may be the upper limit of the number of new connections that the application firewall can establish per second.

[0112] The maximum throughput can be the maximum amount of data transmission that the application firewall can handle per unit time. It can be measured in terms of the amount of data transmitted per second, and is used to reflect the maximum network traffic that the application firewall can handle without losing data packets.

[0113] The attack response index is a comprehensive score of the application firewall's interception efficiency and response speed to attack behaviors. Specifically, the attack response index can include detection time (the time from the start of an attack to its detection by the application firewall), blocking efficiency (the proportion of attacks successfully blocked by the application firewall, that is, its ability to successfully identify and block attacks), recovery time (the time required for the simulated network system to resume normal operations after the impact of an attack), and resource usage (changes in the application firewall's own resources, such as CPU usage and memory usage, during the attack period, which reflects the application firewall's stability under high pressure).

[0114] The device connectivity may be the physical connection status (connected / disconnected) of a communication line or a network device.

[0115] The network throughput of a communication line may be the amount of data successfully transmitted by the communication line per unit time.

[0116] The transmission error rate may be the ratio of data errors that occur during transmission over the communication line.

[0117] The data packet forwarding accuracy rate may be the ratio of data packets correctly forwarded by the router.

[0118] The path optimization index may be a score of the efficiency of the router in selecting the optimal path (eg, minimizing delay).

[0119] A router's network throughput is the total amount of valid data successfully transmitted by the router and other network devices within a unit of time (usually seconds). It can be measured in Mbps (megabits per second) or Gbps (gigabits per second). Network throughput quantifies the data transmission efficiency of network layer devices and reflects their performance under attack pressure.

[0120] The routing table capacity may be the maximum value of routing entries that can be stored in the router.

[0121] The packet loss rate may be the ratio of data packets lost by a router during network transmission.

[0122] The input and output delay time can be the time difference between the router port receiving and forwarding the data packet.

[0123] Among them, system stability can be the proportion of time that the router maintains normal operation under load or attack.

[0124] In some embodiments, in order to facilitate understanding of the above scheme, an example is given of the process of obtaining the first evaluation indicator set corresponding to each simulation indicator object. It should be noted that the calculation method and specific values ​​may change in actual situations, and can be flexibly adjusted according to actual conditions.

[0125] For example, for a network topology in a simulated network system, in the functional index dimension, when calculating the degree distribution, for example, the network topology corresponds to a 10-node network with the number of connections per node being [3, 4, 2, 5, 3, 4, 2, 1, 3, 2]. The degree distribution can be represented as the frequency distribution of these values. When calculating the clustering coefficient, for each node in the network topology, the connection ratio between its neighboring nodes is calculated. For example, node A has three neighbors, B, C, and D. If there is an edge between BC, BD, and CD, then node A's clustering coefficient is 1; otherwise, it is the corresponding connection ratio. This yields the first functional index subset corresponding to the network topology: degree distribution: {3: 3 times, 4: 2 times, 2: 3 times, 5: 1 time, 1: 1 time}; clustering coefficient: [0.67, 0.5, 0.67, 1.0, 0.67, 0.5, 0.67, 0.0, 0.67, 0.67].

[0126] Furthermore, for the performance indicator dimension of a network topology, when calculating the average shortest path length, the shortest path length between any two nodes can be calculated and averaged. For example, in the aforementioned network topology, the average shortest path length can be calculated by dividing the sum of the shortest path lengths between all node pairs by the number of node pairs. For example, the first performance index subset can be obtained: average shortest path length: 2.5 (hypothetical calculation result).

[0127] Furthermore, for robustness metrics related to network topology, the number of nodes with cascading failures can be calculated by simulating the number of other nodes affected by an attack on a critical node. For example, after removing the node with the highest degree, three nodes were observed to have lost all connections to other nodes. Regarding network communication efficiency, the remaining connected components can be calculated. For example, the first robustness index subset calculated is: number of nodes with cascading failures: 3; network communication efficiency: 0.8 (hypothetical calculation results).

[0128] For example, for the functional indicator dimension of the server, when calculating the uptime percentage, if the server's uptime in the past month (the time measurement is determined based on actual conditions) is 720 hours and the total time is 744 hours, then the first functional index subset: uptime percentage: 720 / 744=96.77%.

[0129] Furthermore, for server performance metrics, when calculating the number of transactions per unit time, we can directly obtain the number of transactions per unit time (the specific unit time can be determined based on actual conditions). For example, if a server can process 1000 transactions per second, then the system response time is 50. When calculating system load, if the time from request issuance to system response is 50 milliseconds, then the system response time is 50. When calculating system load, we can directly obtain the current system load as 60% CPU utilization and 40% memory utilization. Therefore, the first performance index subset corresponding to the server is: Number of transactions per unit time: 1000 TPS; System response time: 50ms; System load: CPU 60%, Memory 40%.

[0130] Furthermore, for the robustness indicator dimensions of the server, the CPU utilization can be 60%, the memory utilization can be 40%, and the hard disk utilization can be 50%. Then the first robustness index subset is: CPU utilization: 60%; memory utilization: 40%; hard disk utilization: 50%.

[0131] For example, for the functional indicator dimension of an application firewall, if the firewall correctly detects 95% of attacks, the attack detection rate is 95%; if the firewall mistakenly marks normal traffic as attacks 1% of the time, the attack false alarm rate is 1%; if the firewall fails to detect 2% of actual attacks, the attack missed alarm rate is 2%. The corresponding first functional index subset is: attack detection rate: 95%; attack false alarm rate: 1%; attack missed alarm rate: 2%.

[0132] Furthermore, regarding the performance indicator dimensions of an application firewall, if the maximum number of connections that the application firewall can handle simultaneously is 10,000, then the maximum concurrent connections is 10,000; if the number of new connections that the application firewall can establish per unit time is 5,000 per second, then the maximum new connection rate is 5,000 per second; if the maximum data transmission volume that the application firewall can handle per unit time is 1 Gbps, then the maximum throughput is 1 Gbps. Therefore, the corresponding first performance index subset is: maximum concurrent connections: 10,000; maximum new connection rate: 5,000 new connections / second; maximum throughput: 1 Gbps.

[0133] Furthermore, the robustness metrics of an application firewall can be calculated using the attack response index. The specific attack response index includes detection time, blocking efficiency, recovery time, and resource utilization. For example, if the detection time is 10 milliseconds, the blocking efficiency is 98%, the recovery time is 20 milliseconds, and the resource utilization is 30% CPU utilization and 20% memory utilization, then the corresponding first robustness index subset is: detection time: 10ms; blocking efficiency: 98%; recovery time: 20ms; resource utilization: 30% CPU utilization, 20% memory utilization.

[0134] For example, for the functional index dimension of a communication line, if the connectivity between all communication line devices is 100%, then the device connectivity is 100%. Then, the corresponding first functional index subset is: device connectivity: 100%.

[0135] Furthermore, for the performance indicator dimension of the communication line, if the network throughput of the communication line is 10 Gbps, then the corresponding network throughput is 10 Gbps. Then, the corresponding first performance index subset is: network throughput: 10 Gbps.

[0136] Furthermore, for the robustness indicator dimension of the communication line, if the proportion of transmission errors during the communication process is 0.01%, then the transmission error rate is 0.01%. Then, the corresponding first robustness index subset is: transmission error rate: 0.01%.

[0137] For example, for a router's functional indicator dimension, if the router correctly forwards 99.9% of packets, the packet forwarding accuracy is 99.9%; if the router's ability to select the optimal path is scored 85 points (out of 100), the path optimization index is 85. The corresponding first functional index subset is: packet forwarding accuracy: 99.9%; path optimization index: 85.

[0138] Furthermore, regarding the performance indicator dimensions of a router, if the network throughput of the router is 100Gbps, then the network throughput is 100Gbps; if the number of routing information that the router can store is 100,000, then the routing table capacity is 100,000 entries; if the proportion of packets lost during network transmission is 0.001%, then the packet loss rate is 0.001%; ​​if the delay time for packets passing through the router is 1 microsecond, then the input and output delay time is 1 microsecond. Therefore, the corresponding first performance index subset is: network throughput: 100Gbps; routing table capacity: 100,000 entries; packet loss rate: 0.001%; ​​input and output delay time: 1μs.

[0139] Furthermore, for the robustness index dimension of the router, if the router's ability to maintain stable operation under high load or abnormal conditions is scored as 90 points (out of 100), then the system stability is 90 points. Then, the corresponding first robustness index subset is: system stability: 90.

[0140] Through the above methods, the functionality, performance, and robustness of the components of the simulated network system before being attacked can be comprehensively evaluated, thereby better understanding the anti-attack capability and overall health of the entire system.

[0141] Step 103 : Perform a simulated attack on at least one simulation indicator object in the simulated network system to obtain a simulated network system to be analyzed after the simulated attack.

[0142] In some embodiments, in order to provide a benchmark object under attack for the quantitative analysis of the difference in indicators before and after subsequent attacks, it is possible to simulate real network attack behaviors (such as node removal, malicious traffic injection, etc.), apply attack loads to specific simulation indicator objects in the simulated network system (such as application layer servers, network layer routers), and dynamically generate a system state image after the attack (i.e., the simulated network system to be analyzed) to accurately capture dynamic change data such as functional abnormalities, performance degradation, and robustness degradation caused by the attack.

[0143] The simulated network system to be analyzed may be a dynamic simulated system instance formed by applying a simulated attack to at least one simulation indicator object (such as an application layer server, a network topology node, or a network layer router) in the simulated network system.

[0144] For example, various attack methods can be used to simulate attacks on the simulated network system. For example, a range tool can be used to send 10,000 Transmission Control Protocol (TCP) semi-connected requests with forged source Internet Protocol (IP) addresses to the application firewall within 10 seconds, triggering its maximum concurrent connection threshold (preset to 5,000). Alternatively, a range traffic generation tool can be used to initiate 10,000 Hypertext Transfer Protocol (HTTP) requests per second (the normal baseline is 500 requests per second) to the target server within 5 minutes, simulating a botnet attack scenario. Alternatively, a common distributed denial of service (DDoS) attack simulation can be deployed to test the network's stress resistance, etc. It should be noted that the method of simulating attacks can be determined based on actual circumstances and is not specifically limited in this embodiment of the present application.

[0145] Through the above methods, it is convenient to effectively evaluate the network's response and recovery capabilities when subjected to different types of attacks, identify the system's vulnerabilities and potential risks, and provide data support for optimizing defense strategies.

[0146] Step 104: Obtain a second evaluation indicator set corresponding to a plurality of simulation indicator objects in the simulated network system to be analyzed.

[0147] In some embodiments, in order to quantitatively evaluate the anti-attack capability and behavioral consistency of the simulated network system, and thus achieve a quantitative evaluation of the anti-attack capability and behavioral consistency of the target network system, a second evaluation indicator set can be formed by collecting real-time data on the functions, performance and robustness of each simulation indicator object (such as application layer servers, network layer routers) in the simulated network system to be analyzed after the attack, so as to provide a complete data set in the attacked state for the dynamic difference analysis of the system state after the attack, and then combine it with the first evaluation indicator set for accurate evaluation.

[0148] Among them, the second evaluation indicator set can be a second functional indicator set, a second performance indicator set and a second robustness indicator set collected from each simulation indicator object of the application layer and the network layer after a simulated attack is imposed on the simulated network system.

[0149] In some embodiments, each simulation indicator object corresponds to a second evaluation indicator set, that is, each simulation indicator object corresponds to a second functional index subset, a second performance index subset, and a second robustness index subset. Taking the simulation indicator object as a network topology structure as an example, the degree distribution (i.e., the distribution of the number of connections between each node in the network topology structure, which can be expressed as the probability of the number of connections for each node) and the clustering coefficient (which can be used to represent the average degree of clustering of the entire network topology structure) corresponding to the network topology structure in the functional indicator dimension can be obtained to obtain the corresponding second functional index subset, as well as the average shortest path length between any two network nodes in the performance indicator dimension (which can be the average of the shortest path lengths between any two nodes in the network topology structure), to obtain the corresponding second performance index subset, and the number of cascading failure nodes (which can be the number of other nodes that will be triggered to fail when each node in the network topology structure fails due to an attack) and network communication efficiency (which can be the ability of the remaining network to maintain a certain level of information exchange when some nodes or links in the network fail) in the robustness indicator dimension to obtain the corresponding second robustness index subset.

[0150] In some embodiments, obtaining a second evaluation indicator set corresponding to multiple simulation indicator objects in the simulated network system to be analyzed is the same as the process of obtaining the corresponding first evaluation indicator set for multiple simulation indicator objects in the simulated network system introduced above. The only difference is that the first evaluation indicator set is obtained for data of the simulated network system before the attack, and the second evaluation indicator set is obtained for data of the simulated network system to be analyzed after the attack. The embodiments of the present application do not elaborate on this one by one.

[0151] By obtaining a second set of evaluation indicators corresponding to multiple simulation indicator objects, a comprehensive and detailed quantitative analysis of the network system's functionality, performance, and robustness before an attack can be achieved. This not only provides baseline data for subsequent attack simulations, ensuring accurate comparison of changes before and after an attack, but also effectively identifies the system's initial state and potential vulnerabilities, providing solid data support for further optimizing network security protection strategies and significantly improving the accuracy and reliability of overall network security assessments.

[0152] Step 105 : Determine the anti-attack performance score of the target network system according to the indicator difference between the first evaluation indicator set and the second evaluation indicator set.

[0153] In some embodiments, in order to systematically evaluate the resilience performance of a simulated network system under an attack scenario, the multi-dimensional differences (function, performance, robustness) between the first evaluation indicator set and the second evaluation indicator set before and after the attack can be calculated. In this way, the changes in the network system before and after the attack can be quantified, revealing the system's actual anti-attack capability and recovery capability.

[0154] The indicator difference may be the degree of dynamic deviation between the first evaluation indicator set (beginning data before the attack) and the second evaluation indicator set (status data after the attack) calculated by mathematical methods (such as KL divergence, mean square error, etc.).

[0155] The anti-attack performance score may be a normalized quantized value generated based on the indicator difference, or the anti-attack performance score may be a total score obtained by fusion calculation based on the indicator difference.

[0156] In some embodiments, the changes between the first evaluation metric set and the second evaluation metric set can be quantified using a variety of statistical methods. For example, a method for calculating the degree of difference between the indicators can be determined based on the characteristics of the data for each indicator corresponding to each simulation metric object. For example, if the simulation metric object is a network topology, then for the degree distribution, the Kullback-Leibler (KL) divergence or the Jensen-Shannon (JS) divergence can be used as the method for calculating the difference between the degree distribution before and after the attack based on the degree distribution of the simulated network system and the degree distribution of the simulated network system to be analyzed, and the corresponding result can be calculated.

[0157] Exemplarily, the calculation method may further include mean squared error (MSE), root mean squared error (RMSE), mean absolute error (MAE), mean absolute percentage error (MAPE), symmetric mean absolute percentage error (SMAPE), Pearson correlation coefficient, Spearman correlation coefficient, Kendall correlation coefficient, Wasserstein distance, total variation, Kolmogorov-Smirnov (KS) distance, etc. The calculation method of the indicator difference before and after the attack for each indicator corresponding to each simulation indicator object may be the same or different. The corresponding calculation method is selected according to actual conditions.

[0158] In some embodiments, after calculating the indicator difference between the first evaluation indicator set and the second evaluation indicator set, an indicator threshold corresponding to each indicator can be obtained, and the indicator threshold is compared with the indicator difference to obtain a comparison result. Based on the comparison result, a value is assigned to the corresponding indicator to obtain an indicator score. Taking one of the indicator degree distributions of the simulation indicator object as an example, if the indicator difference before and after the attack is 0.036 calculated using the KL divergence method, and the indicator threshold of the degree distribution is 0.05, the indicator difference is less than the indicator threshold. In this case, a value of 10 can be assigned, i.e., the indicator score corresponding to the degree distribution is 10. Furthermore, the indicator score can also be calculated by the distance between the indicator difference and the indicator threshold. When the gap is positive, i.e., the indicator threshold is greater than the indicator difference, the larger the gap, the higher the indicator score; when the gap is negative, i.e., the indicator threshold is less than the indicator difference, the smaller the gap, the higher the indicator score.

[0159] Furthermore, after obtaining the indicator scores for all indicators of each simulation indicator object, all indicator scores corresponding to all simulation indicator objects can be added together to obtain a total difference value as the target network system's anti-attack performance score. For example, when the simulation indicator object is the network topology structure, the corresponding indicator score for degree distribution is 10, the indicator score for clustering coefficient is 5, the indicator score for average shortest path length between any two network nodes is 8, the indicator score for number of cascading failure nodes is 20, the indicator score for network communication efficiency is 15, and so on. By adding the indicator scores for multiple indicators such as network topology structure, server, application firewall, communication line, router, etc., the target network system's anti-attack performance score can be obtained.

[0160] In some implementations, the indicator weight of each indicator included in each simulation indicator object can be obtained, and the corresponding indicator score value can be adjusted based on the indicator weight. The adjusted indicator scores of multiple indicators such as network topology, servers, application firewalls, communication lines, routers, etc. are then added together to obtain the anti-attack performance score of the target network system. The indicator weight corresponding to each indicator can be set according to actual conditions. For example, the indicator weight corresponding to the degree distribution is set to 0.08, and the sum of all indicator weights of all indicators is set to 1.

[0161] Furthermore, by mapping the attack resistance performance score to a pre-set resilience level range, system resilience can be intuitively assessed. For example, the score range can be defined as follows: 0-50 points for low resilience (severe functional degradation, system paralysis, and the need for infrastructure reconstruction); 51-150 points for medium resilience (partial performance degradation, but core services are available, requiring manual intervention for recovery); and greater than 150 points for high resilience (minimal difference before and after the attack, key functions intact, and rapid recovery).

[0162] The embodiment of the present application establishes a simulation network system corresponding to the target network system and determines multiple simulation indicator objects in the simulation network system; obtains a corresponding first evaluation indicator set for multiple simulation indicator objects in the simulation network system; performs a simulated attack on at least one simulation indicator object in the simulation network system to obtain the simulation network system to be analyzed after the simulated attack; obtains a second evaluation indicator set corresponding to multiple simulation indicator objects in the simulation network system to be analyzed; and determines the anti-attack performance score of the target network system based on the indicator difference between the first evaluation indicator set and the second evaluation indicator set. In this way, the attack process can be simulated dynamically, and the changes of multiple simulation indicator objects before and after the attack can be comprehensively considered, and the behavioral deviation of the network system in complex attack scenarios can be quantified, breaking through the limitation of relying solely on single node removal, and realizing a comprehensive evaluation of the dynamic defense capability, behavioral consistency verification and recovery efficiency of the system under the unknown attack chain, thereby more accurately and comprehensively evaluating the network anti-attack performance of the network system.

[0163] In some embodiments, the first evaluation indicator set includes a first functional index subset, a first performance index subset, and a first robustness index subset, and the second evaluation indicator set includes a second functional index subset, a second performance index subset, and a second robustness index subset. In order to quantitatively evaluate the dynamic resilience performance of the network range simulation system under attack and identify key vulnerabilities, the function, performance, and robustness index subsets of each simulation indicator object before and after the attack can be compared layer by layer, and multi-dimensional difference values ​​can be calculated and weighted fused to generate an anti-attack performance score, thereby achieving an accurate and comprehensive network anti-attack performance evaluation of the target network system. For example, step 105 can include:

[0164] (105.1) For each simulation indicator object, determine, based on the first function index subset and the second function index subset, the first performance index subset and the second performance index subset, and the first robustness index subset and the second robustness index subset, a function difference value, a performance difference value, and a robustness difference value between each simulation indicator object corresponding to the simulated network system and the simulated network system to be analyzed;

[0165] (105.2) Determine the anti-attack performance score of the target network system based on the functional difference value, performance difference value, and robustness difference value associated with each simulation indicator object.

[0166] The first functional index subset may be a data set of functional dimensions for each indicator contained in each simulation indicator object before a simulated attack is performed on the simulated network system. For example, if the simulation indicator object is a network topology structure, the corresponding first functional index subset includes the numerical values ​​of the degree distribution and clustering coefficient.

[0167] The first performance index subset can be a data set of the performance dimensions of each indicator contained in each simulation indicator object before the simulated attack is performed on the simulated network system. For example, if the simulation indicator object is a network topology structure, the corresponding first performance index subset includes the value of the average shortest path length between any two network nodes.

[0168] The first robustness index subset can be a data set of robustness metrics for each simulation indicator object before a simulated attack is performed on the simulated network system. For example, if the simulation indicator object is a network topology, the corresponding first robustness index subset includes values ​​for the number of cascading failure nodes and network communication efficiency.

[0169] The second functional index subset may be a data set of each indicator in the functional dimension contained in each simulation indicator object after a simulation attack is performed on the simulation network system.

[0170] The second performance index subset may be a data set of each indicator in the performance dimension contained in each simulation indicator object after a simulation attack is performed on the simulation network system.

[0171] The second robustness index subset may be a data set of each indicator in the robustness dimension contained in each simulation indicator object after a simulation attack is performed on the simulation network system.

[0172] The functional difference value can be the difference in functional index distribution before and after the attack, calculated using a corresponding calculation method based on the first and second functional index subsets, and is used to measure the dynamic deviation of the functional dimension indicator. Specifically, the corresponding calculation method can be KL divergence, JS divergence, or mean square error, etc., which is determined based on actual circumstances and is not specifically limited in this application.

[0173] The performance difference value may be a value obtained by calculating the value of each indicator of each simulation indicator object before and after the attack based on the first and second performance index subsets.

[0174] The robustness difference value may be a value obtained by calculating the value of each indicator of each simulation indicator object before and after the attack based on the first and second robustness index subsets.

[0175] For example, for each indicator in the first functional index subset and the second functional index subset, a corresponding numerical value can be obtained to calculate the functional difference value of the indicator. Similarly, for each indicator in the first performance index subset and the second performance index subset, a corresponding numerical value can be obtained to calculate the performance difference value of the indicator. And for each indicator in the first robustness index subset and the second robustness index subset, a corresponding numerical value can be obtained to calculate the robustness difference value of the indicator.

[0176] In some embodiments, the changes in various indicators before and after the attack can be quantified by selecting appropriate calculation methods, and the anti-attack performance of the target network system can be comprehensively evaluated. For example, for indicators of probability distribution type such as degree distribution, KL divergence or JS divergence can be selected to calculate the difference before and after the attack; and for numerical indicators, such as the average shortest path length, MAE, MSE or RMSE can be selected to calculate the difference before and after the attack. In this way, basic data can be provided for subsequent scoring and comprehensive analysis, which helps to identify potential vulnerabilities and optimize defense strategies. Taking the degree distribution of the network topology structure of the simulation indicator object in the functional indicator dimension as an example, the indicator difference degree of the degree distribution can be calculated by KL divergence. :

[0177] ;

[0178] in, To simulate the network topology of the network system before the attack, To simulate the network topology of the network system after the attack, is the degree distribution of the network topology before the attack, is the degree distribution of the network topology after the attack. The smaller it is, the more similar the degree distribution of the network topology before and after the attack is.

[0179] In some embodiments, for each simulation indicator object, the indicator differences of the multiple indicators it contains can be summarized to obtain corresponding functional difference values, performance difference values, and robustness difference values. Taking the simulation indicator object as a network topology structure as an example, in the functional indicator dimension, the indicator difference corresponding to the degree distribution and the indicator difference corresponding to the clustering coefficient can be calculated based on the first functional index subset and the second functional index subset; in the performance indicator dimension, the indicator difference of the average shortest path length between any two network nodes can be calculated based on the first functional index subset and the second functional index subset; in the robustness indicator dimension, the indicator difference of the number of cascading failure nodes and the indicator difference of network communication efficiency can be calculated based on the first robustness index subset and the second robustness index subset. The calculation method can be flexibly selected according to the actual situation. For example, the indicator difference corresponding to the degree distribution can be calculated by KL divergence.

[0180] In some embodiments, after calculating the difference between each metric (e.g., the degree distribution of a network topology structure) of each simulation metric object included in the first evaluation metric set and the second evaluation metric set, a corresponding metric threshold can be obtained for each metric. The metric threshold is then compared with the metric difference to obtain a comparison result. Based on the comparison result, a value is assigned to the corresponding metric to obtain an metric score. Taking the degree distribution of one metric of the simulation metric object as an example, if the difference between the metric before and after the attack is 0.036 calculated using the KL divergence method, and the metric threshold for the degree distribution is 0.05, the metric difference is less than the metric threshold. Therefore, a value of 10 can be assigned, i.e., the metric score corresponding to the degree distribution is 10. Furthermore, the metric score can also be calculated based on the distance between the metric difference and the metric threshold. When the difference is positive, i.e., the metric threshold is greater than the metric difference, the greater the difference, the higher the metric score. When the difference is negative, i.e., the metric threshold is less than the metric difference, the smaller the difference, the higher the metric score. It will be appreciated that the assignment rules can be customized based on actual circumstances.

[0181] Furthermore, after obtaining the indicator score values ​​of all indicators in the functional indicator dimension, performance indicator dimension, and robustness indicator dimension for each simulation indicator object, the included indicator score values ​​can be added together in the functional indicator dimension, performance indicator dimension, and robustness indicator dimension to obtain the functional difference value, performance difference value, and robustness difference value corresponding to the functional indicator dimension, performance indicator dimension, and robustness indicator dimension. Taking the simulation indicator object as a network topology structure as an example, if the indicator score value of the degree distribution is 10 and the indicator score value of the clustering coefficient is 12, then the functional difference value of the network topology structure is 22. Similarly, the performance difference value and robustness difference value can be calculated, which are not listed here one by one.

[0182] Furthermore, the target network system's anti-attack performance score can be obtained by summing up all the functional difference values, performance difference values, and robustness difference values ​​corresponding to all simulation indicator objects. The sub-performance scores corresponding to each simulation indicator object can then be summed up to obtain the target network system's anti-attack performance score. For example, if the simulation indicator object is the network topology structure, the corresponding functional difference value is 22, the performance difference value is 18, and the robustness difference value is 5, then the corresponding sub-performance score is 45. The target network system's anti-attack performance score can be obtained by summing up the sub-performance scores corresponding to the network topology structure, server, application firewall, communication line, and router.

[0183] In some embodiments, it is also possible to directly output the indicator score value of each indicator without comprehensively calculating the anti-attack performance score, so that technical personnel can directly analyze the changes of each indicator (such as degree distribution, etc.) before and after the attack based on the corresponding indicator score value, so as to improve the accuracy and comprehensiveness of the evaluation.

[0184] Through the above methods, the changes in the target network system before and after the attack can be fully quantified and potential vulnerabilities can be identified. This not only improves the accuracy and comprehensiveness of the assessment, but also provides solid data support for subsequent security improvements.

[0185] In some implementations, to avoid evaluation bias caused by a single algorithm, a preset algorithm mapping model can be used to dynamically match the pre- and post-attack indicator data characteristics of each indicator of each simulation indicator object, adaptively selecting the optimal difference calculation algorithm type to improve the accuracy and adaptability of the difference value calculation. (105.1) This may include:

[0186] (105.1.1) For each simulation indicator object, input the corresponding first function index subset and second function index subset, first performance index subset and second performance index subset, and first robustness index subset and second robustness index subset into a preset algorithm mapping model to determine the corresponding algorithm type;

[0187] (105.1.2) Calculate the functional difference value, performance difference value, and robustness difference value between each simulation indicator object using the corresponding algorithm type.

[0188] Among them, the algorithm mapping model can be a decision model based on rules or machine learning, which can automatically match the applicable difference calculation algorithm type according to the type of input indicator data (such as discrete distribution, continuous time series), statistical characteristics (such as normality, sparsity) and business scenarios (such as network topology difference analysis, server performance degradation evaluation).

[0189] The algorithm type refers to the specific mathematical method used to calculate the difference between indicators before and after the attack, including but not limited to KL divergence, JS divergence, Wasserstein distance, mean square error (MSE), mean absolute error (MAE), symmetric mean absolute percentage error (SMAPE), Pearson correlation coefficient, Spearman rank correlation coefficient, chi-square test, t-test, and other methods.

[0190] Furthermore, the indicators of each simulation indicator object in the first and second functional index subsets, the first and second performance index subsets, and the first and second robustness index subsets can be input into the algorithm mapping model. The algorithm mapping model can identify the indicator data characteristics of each indicator and determine the algorithm type of multiple indicators corresponding to each simulation indicator object. Taking degree distribution as an example, the algorithm mapping model can map the corresponding JS divergence algorithm as the algorithm type, and calculate the degree distribution before and after the attack using the JS divergence algorithm to obtain the corresponding indicator difference. Furthermore, the method for calculating the corresponding function difference value, performance difference value, and robustness difference value based on the indicator difference corresponding to the indicator has been expanded above and will not be repeated here.

[0191] Afterwards, the first functional index subset and the second functional index subset are calculated using the corresponding algorithm type to obtain the functional difference value, performance difference value, and robustness difference value between each simulation indicator object.

[0192] For example, for discrete distribution indicators such as degree distribution and clustering coefficient contained in the simulation indicator object, the algorithm mapping model can be mapped to KL divergence or JS divergence algorithm according to the characteristics of the indicator data; for continuous numerical indicators such as the number of transactions processed per unit time and input and output delay time, the algorithm mapping model can be mapped to mean square error or Pearson correlation coefficient according to the characteristics of the indicator data; for counting indicators such as the number of cascading failure nodes, the algorithm mapping model can be mapped to chi-square test or Poisson distribution difference algorithm according to the characteristics of the indicator data.

[0193] By automatically matching algorithm types through the algorithm mapping model and selecting different algorithm types for different indicators, the evaluation bias caused by a single algorithm can be avoided. This can effectively reduce the trial and error cost of manual algorithm selection and greatly improve the calculation speed and accuracy.

[0194] In some implementations, to overcome the limitations of traditional single-point differential analysis, a hierarchical graph structure (root node-child node) and differential connection edges of the simulated network system before and after the attack can be constructed to achieve global differential transmission and aggregation across simulation indicator objects. This can quantify the coupling impact of the attack on components at all levels of the system and accurately and comprehensively evaluate the overall anti-attack capability of the network system. For example, (105.2) can include:

[0195] (105.2.1) By taking the simulation network system as the first root node, constructing a plurality of first child nodes corresponding to the simulation indicator objects, and taking the simulation network system to be analyzed as the second root node, constructing a plurality of second child nodes corresponding to the simulation indicator objects, wherein each first child node is associated with a corresponding first functional index subset, a first performance index subset, and a first robustness index subset, and each second child node is associated with a corresponding second functional index subset, a second performance index subset, and a second robustness index subset;

[0196] (105.2.2) Based on the functional difference value, performance difference value, and robustness difference value between each simulation indicator object corresponding to the simulation network system and the simulation network system to be analyzed, the difference connection edge between the first child node and the second child node corresponding to each simulation indicator object is used;

[0197] (105.2.3) Perform global difference conduction based on any first child node, the corresponding second child node, and the corresponding difference connection edge to determine the anti-attack performance score of the target network system.

[0198] The first root node may be a global entity node representing the original simulation network system, serving as an abstract carrier of the system state before the attack, and associated with all child nodes of the simulation indicator objects before the attack.

[0199] Among them, the first child node can be a simulation indicator object node under the first root node (such as a server at the application layer, a network topology structure, etc.). Each first child node is bound to its first function, performance, and robustness index subset before the attack, which is used to characterize the baseline state of the object when it is not attacked.

[0200] The second root node may be a global entity node representing the simulated network system to be analyzed after the attack, serving as an abstract carrier of the system state after the attack, and associated with the child nodes of all simulation indicator objects after the attack.

[0201] Among them, the second child node can be a simulation indicator object node under the second root node, which corresponds one-to-one to the first child node and is bound to its second function, performance, and robustness index subset after the attack, which is used to characterize the dynamic state of the object after the attack.

[0202] Among them, the difference connection edge can be a directed edge connecting the first child node and the second child node of the same simulation indicator object, and the weight value is the difference value of the object in the function, performance, and robustness dimensions, which represents the local impact intensity of the attack on the object.

[0203] In some embodiments, the indicator data of the simulated network system (first root node) and the simulated network system to be analyzed (second root node) can be converted into a tree structure through hierarchical modeling technology. Each root node contains multiple child nodes, each of which corresponds to a simulation indicator object (such as network topology, user behavior, server performance, etc.) and is associated with its function, performance, and robustness indicator set. For example, it is assumed that the first root node contains the following child nodes (this is only an example, and the actual situation may contain more or fewer child nodes): Network topology structure: Functional indicators: degree distribution, clustering coefficient; Performance indicator: average shortest path length; Robustness indicator: maximum connected component ratio. Server: Functional indicator: CPU utilization threshold; Performance indicator: Transactions Per Second (TPS); Robustness indicator: load balancing recovery time. Furthermore, the second root node constructs child nodes according to the same structure to form a symmetrical tree model.

[0204] Furthermore, the difference connection edge represents the difference value between the simulation network system and the simulation network system to be analyzed on the same simulation indicator object. The specific calculation methods of the functional difference value, performance difference value, and robustness difference value have been expanded above and will not be repeated here.

[0205] Furthermore, local differences can be aggregated into a global attack resistance score using a weighted distribution and propagation algorithm through tree-structured difference links. For example, if the simulation metric includes network topology and servers, the corresponding network topology difference link has a function difference value of 0.35, a performance difference value of 1.7, and a robustness difference value of 0.2. The server difference link has a function difference value of 0.15, a performance difference value of 0.9, and a robustness difference value of 0.1. When performing global propagation, weights can be assigned first, for example, a 40% weight for network topology (30% for function, 40% for performance, and 30% for robustness) and a 30% weight for servers (20% for function, 50% for performance, and 30% for robustness). Aggregate calculations yield a comprehensive network topology difference of 0.35 × 30% + 1.7 × 40% + 0.2 × 30% = 0.815, with a weighted contribution of 0.815 × 40% = 0.326. The comprehensive server difference is 0.15 × 20% + 0.9 × 50% + 0.1 × 30% = 0.51, with a weighted contribution of 0.51 × 30% = 0.153. Finally, based on the sum of the network topology and server contribution values, the total difference is 0.326 + 0.153 = 0.479. This total difference is converted to an anti-attack performance score of (1 − 0.479) × 100% = 52.1, indicating that the target network system has moderate anti-attack capability.

[0206] Through the above method, based on the difference transmission model, the differences between multi-level indicators can be dynamically aggregated into a single score, capturing the cross-layer chain effects caused by attacks, and achieving accurate and efficient quantitative evaluation of anti-attack performance. It also significantly improves the systematicity and interpretability of network anti-attack performance evaluation in complex attack scenarios, providing reliable technical support for the construction of a multi-level security defense system.

[0207] In some implementations, to improve the relevance and credibility of the scoring results, the specific types of attack traffic can be identified and the weighting of the function, performance, and robustness difference values ​​of each simulation indicator object can be dynamically adjusted to ensure that the anti-attack performance score more closely reflects the impact characteristics of real-world attack scenarios, thereby improving the accuracy of the assessment. For example, before (105.2), that is, before "determining the target network system's anti-attack performance score based on the function difference value, performance difference value, and robustness difference value associated with each simulation indicator object," it also includes:

[0208] (A.1) Obtain attack traffic launched against the simulated network system and identify the attack type of the attack traffic using a variational autoencoder to obtain the target attack type;

[0209] (A.2) Determine the functional difference weight, performance difference weight, and robustness difference weight corresponding to each simulation indicator object based on the target attack type;

[0210] (A.3) Based on the functional difference weight, performance difference weight, and robustness difference weight, respectively, adjust the functional difference value, performance difference value, and robustness difference value of each simulation indicator object to obtain the target functional difference value, target performance difference value, and target robustness difference value;

[0211] The anti-attack performance score of the target network system is determined based on the functional difference value, performance difference value, and robustness difference value associated with each simulation indicator object, including:

[0212] The anti-attack performance score of the target network system is determined based on the target function difference value, target performance difference value and target robustness difference value associated with each simulation indicator object.

[0213] Among them, attack traffic can be a simulated attack data stream launched against the simulated network system, including attack payload (such as malicious data packets, vulnerability exploitation code) and behavioral characteristics (such as request frequency, protocol type), which is used to reproduce real network attack behavior.

[0214] Among them, the attack type can be a classification label of the attack behavior, such as Distributed Denial of Service (DDoS), Advanced Persistent Threat (APT), Structured Query Language (SQL) injection, port scanning, etc., which represents the differences in the targets and means of the attack.

[0215] The target attack type may be a specific attack type determination result (such as identification as a "DDoS attack") output after feature extraction and pattern recognition of attack traffic by a variational autoencoder (VAE).

[0216] The functional difference weight can be the weight of the functional difference value (such as network topology destruction) set according to the target attack type in the anti-attack performance score. For example, APT attacks focus more on functional concealment destruction, which is weighted higher than performance difference.

[0217] The performance variance weight can be the percentage of the performance variance value (such as server response latency) set for the target attack type in the score. For example, DDoS attacks focus on performance degradation, so the performance variance weight is increased to 60%.

[0218] The robustness difference weight can be the importance coefficient of the robustness difference value (such as cascading failure range) set according to the attack type in the scoring. For example, for physical layer destruction attacks, the robustness weight is higher than function / performance.

[0219] The target functional difference value may be a weighted value obtained by adjusting the original functional difference value according to the functional difference weight, reflecting the contribution of functional damage under the attack type.

[0220] The target performance difference value may be the original performance difference value adjusted by the performance difference weight, representing the emphasis of the impact of the attack type on performance degradation.

[0221] The target robustness difference value may be the original robustness difference value (such as the number of cascading failure nodes) corrected by the robustness difference weight, and is used to quantify the degree of damage to the system resilience caused by the attack type.

[0222] For example, a pre-trained variational autoencoder can be used to analyze attack traffic in a simulated network system. For example, in a simulated distributed denial of service attack scenario, the variational autoencoder can extract features and perform pattern recognition on the attack traffic to determine that the target attack type corresponding to the attack traffic is a DDoS attack. Alternatively, the attack type of the corresponding attack traffic can be directly obtained from the data source.

[0223] Furthermore, based on the identified target attack type (e.g., DDoS attack), the corresponding functional difference weight, performance difference weight, and robustness difference weight can be determined for each simulation indicator object. For example, for DDoS attacks, since DDoS attacks primarily affect system performance and have little impact on functional aspects, a lower functional difference weight, such as 15%, can be set. Since DDoS attacks aim to deplete bandwidth or resources, a higher performance difference weight, such as 50%, can be set. Since DDoS attacks can cause cascading failures and other problems, a relatively high robustness difference weight, such as 35%, can also be set.

[0224] Furthermore, based on the function difference weight, performance difference weight, and robustness difference weight determined above, the function difference value, performance difference value, and robustness difference value of each simulation indicator object can be adjusted. The specific formulas are: target function difference value = function difference value * function difference weight; target performance difference value = performance difference value * performance difference weight; target robustness difference value = robustness difference value * robustness difference weight.

[0225] In some implementations, the functional difference weight, performance difference weight, and robustness difference weight corresponding to each simulation indicator object can be flexibly set according to actual conditions, and this application does not impose specific restrictions on this.

[0226] This approach allows for more accurate quantification of the impact of different types of attacks on various dimensions of the target network system, ensuring that assessment results are more closely aligned with the characteristics of actual attack scenarios. This not only improves the accuracy and reliability of the assessment but also effectively avoids the misjudgment issues associated with traditional static weighting.

[0227] In some embodiments, to dynamically optimize the security and behavioral authenticity of the target network, the anti-attack performance score can be compared with preset standards to identify weaknesses in the simulated network system and generate targeted adjustment plans. This, in turn, identifies weaknesses in the target network system and generates targeted adjustment plans to improve the target network system's defense capabilities in complex attack scenarios and its consistency with the real system. For example, after step 105, i.e., after "determining the anti-attack performance score of the target network system based on the difference between the first evaluation indicator set and the second evaluation indicator set," the following steps may also be included:

[0228] (B.1) Comparing the anti-attack performance score with the preset performance evaluation standard to obtain a comparison result;

[0229] (B.2) Based on the comparison results, determine the target simulation indicator object that needs to be adjusted and the adjustment plan from the multiple simulation indicator objects of the simulated network system to be analyzed;

[0230] (B.3) According to the adjustment plan, adjust the indicator object corresponding to the target simulation indicator object in the target network system.

[0231] The performance evaluation criteria may be a pre-set threshold value and scoring rule for anti-attack capability.

[0232] The comparison result may be a conclusion obtained by comparing the anti-attack performance score with the performance evaluation standard.

[0233] Among them, the adjustment plan can be an improvement strategy for the target simulation indicator object, such as improving the server CPU / memory configuration, increasing network bandwidth, adding backup nodes to reduce the risk of cascading failure, updating the firewall detection rule base, adjusting the router routing table update frequency to reduce latency, etc.

[0234] For example, if the preset performance evaluation standard is that the anti-attack performance score is greater than or equal to 70 points: the system resilience is qualified, the anti-attack performance score is between 60 and 70 points, and high-weight indicators (such as network throughput) need to be optimized. If the attack performance score is less than 60 points, multiple indicator objects need to be comprehensively adjusted.

[0235] For example, first, a target simulation indicator object requiring adjustment can be identified from multiple simulation indicator objects. Specifically, for each indicator of the simulation indicator object (e.g., degree distribution, clustering coefficient, etc.), the pre-calculated indicator score before and after the attack can be compared with the corresponding scoring threshold. If the proportion of each simulation indicator object's indicator score that is less than the scoring threshold is greater than a preset proportion, the simulation indicator object is determined as the target simulation indicator object. For example, if the simulation indicator object is a network topology structure, among the multiple indicators it contains, the indicator score corresponding to the degree distribution is 3, with a scoring threshold of 10; the indicator score corresponding to the clustering coefficient is 12, with a scoring threshold of 10; the indicator score corresponding to the average shortest path length between any two network nodes is 15, with a scoring threshold of 10; the indicator score corresponding to the cascading failure node is 7, with a scoring threshold of 5; and the indicator score corresponding to the network communication efficiency is 5, with a scoring threshold of 10. The number of indicators whose indicator scores are less than the scoring threshold is 2, and the ratio of the indicator scores of the simulation indicator objects less than the scoring threshold is 2 / 5 = 0.4. If the preset ratio is 0.2, then the network topology can be determined as the target simulation indicator object, and the network topology corresponding to the target network system can be adjusted. For example, a content delivery network (CDN) can be deployed to divert attack traffic and expand the bandwidth to 10Gbps (gigabits per second). Furthermore, the scoring threshold can be set according to actual conditions, and the embodiments of the present application do not impose too many restrictions on this.

[0236] In some implementations, a network repair table may be pre-stored, which may record corresponding adjustment plans when problems occur with different simulation indicator objects (corresponding to indicator objects of the target network system), thereby improving the efficiency and accuracy of network services.

[0237] By comparing attack resistance performance scores with pre-set performance evaluation criteria, it is possible to accurately identify target simulation metrics within the simulated network system that exceed deviation tolerances (such as degree distribution, average shortest path length, and the number of cascading failure nodes). Based on these comparison results, targeted adjustment plans can be formulated, such as enhancing topology redundancy design, optimizing routing algorithms, or improving detection mechanisms. Ultimately, specific adjustments to the target simulation metrics are made based on these adjustment plans, significantly improving the system's attack resistance and recovery efficiency, ensuring high stability and security even under attack. This not only improves the accuracy and comprehensiveness of the assessment, but also provides a scientific basis for subsequent security reinforcement, enhancing the effectiveness of overall network security protection.

[0238] See also Figure 3The embodiment of the present application further provides a network anti-attack performance evaluation device, which can implement the above-mentioned network anti-attack performance evaluation method. The network anti-attack performance evaluation device includes:

[0239] An establishing module 31 is used to establish a simulation network system corresponding to the target network system and determine a plurality of simulation indicator objects in the simulation network system;

[0240] A first acquisition module 32 is configured to acquire a corresponding first evaluation indicator set for a plurality of simulation indicator objects in the simulation network system;

[0241] An attack module 33 is configured to perform a simulated attack on at least one simulation indicator object in the simulated network system to obtain a simulated network system to be analyzed after the simulated attack;

[0242] A second acquisition module 34 is used to obtain a second evaluation indicator set corresponding to multiple simulation indicator objects in the simulated network system to be analyzed;

[0243] The determination module 35 is configured to determine the anti-attack performance score of the target network system according to the difference between the first evaluation indicator set and the second evaluation indicator set.

[0244] The specific implementation of the network anti-attack performance evaluation device is basically the same as the specific embodiment of the network anti-attack performance evaluation method described above, and will not be repeated here. Under the premise of meeting the requirements of the embodiment of the present application, the network anti-attack performance evaluation device can also be provided with other functional modules to implement the network anti-attack performance evaluation method in the above embodiment.

[0245] The present application also provides a computer device comprising a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned network anti-attack performance evaluation method. The computer device can be any intelligent terminal, including a tablet computer and an in-vehicle computer.

[0246] See also Figure 4 , Figure 4 The hardware structure of a computer device according to another embodiment is shown. The computer device includes:

[0247] The processor 41 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0248] The memory 42 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 42 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 42 and is called by the processor 41 to execute the network anti-attack performance evaluation method of the embodiments of this application;

[0249] Input / output interface 43, used for information input and output;

[0250] Communication interface 44, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, communication lines, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0251] bus 45 , which transmits information between the various components of the device (e.g., processor 41 , memory 42 , input / output interface 43 , and communication interface 44 );

[0252] The processor 41 , the memory 42 , the input / output interface 43 and the communication interface 44 are connected to each other in communication within the device via a bus 45 .

[0253] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned network anti-attack performance evaluation method is implemented.

[0254] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0255] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0256] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0257] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0258] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0259] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0260] It should be understood that in this application, "at least one (item)" and "several" refer to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0261] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the division of the above units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0262] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0263] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0264] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: various media that can store programs, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0265] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A network anti-attack performance evaluation method, characterized in that: The method comprises: Establishing a simulation network system corresponding to the target network system, and determining a plurality of simulation indicator objects in the simulation network system; For a plurality of simulation indicator objects in the simulation network system, obtaining a corresponding first evaluation indicator set, wherein the first evaluation indicator set includes a first function index subset, a first performance index subset, and a first robustness index subset; Performing a simulated attack on at least one simulation indicator object in the simulated network system to obtain a simulated network system to be analyzed after the simulated attack; Acquire a second evaluation index set corresponding to a plurality of simulation index objects in the simulated network system to be analyzed, wherein the second evaluation index set includes a second function index subset, a second performance index subset, and a second robustness index subset; For each simulation indicator object, determining a function difference value, a performance difference value, and a robustness difference value between each simulation indicator object corresponding to the simulated network system and the simulated network system to be analyzed based on the first function index subset and the second function index subset, the first performance index subset and the second performance index subset, and the first robustness index subset and the second robustness index subset; Determining an anti-attack performance score of the target network system based on the function difference value, the performance difference value, and the robustness difference value associated with each simulation indicator object; The step of determining the anti-attack performance score of the target network system based on the function difference value, the performance difference value, and the robustness difference value associated with each simulation indicator object in sequence includes: By taking the simulation network system as the first root node, constructing multiple first child nodes corresponding to the simulation indicator objects, and taking the simulation network system to be analyzed as the second root node, constructing the second child nodes corresponding to the multiple simulation indicator objects, wherein each first child node is associated with a corresponding first function index subset, a first performance index subset and a first robustness index subset, and each second child node is associated with a corresponding second function index subset, a second performance index subset and a second robustness index subset; the function difference value, the performance difference value, and the robustness difference value between each simulation indicator object corresponding to the simulation network system and the simulation network system to be analyzed are respectively used as the difference connection edge between the first child node and the second child node corresponding to each simulation indicator object; global difference conduction is performed based on any first child node, the corresponding second child node and the corresponding difference connection edge to determine the anti-attack performance score of the target network system.

2. The network anti-attack performance evaluation method according to claim 1, characterized in that: The plurality of simulation indicator objects include a network topology structure, a server and an application firewall corresponding to an application layer of the simulation network system, and communication lines and routers corresponding to a network layer of the simulation network system; The step of obtaining a corresponding first evaluation indicator set for a plurality of simulation indicator objects in the simulation network system includes: For the network topology structure in the simulated network system, obtaining the degree distribution and clustering coefficient corresponding to the network topology structure in the functional index dimension, obtaining a corresponding first functional index subset, and the average shortest path length between any two network nodes in the performance index dimension, obtaining a corresponding first performance index subset, and the number of cascading failure nodes and network communication efficiency in the robustness index dimension, obtaining a corresponding first robustness index subset; Obtaining the uptime ratio of the server in the functional indicator dimension to obtain a corresponding first functional index subset, as well as the number of transactions processed per unit time, system response time, and system load in the performance indicator dimension to obtain a corresponding first performance index subset, and obtaining the central processing unit utilization rate, memory utilization rate, and hard disk utilization rate in the robustness indicator dimension to obtain a corresponding first robustness index subset; Obtaining the attack detection rate, attack false alarm rate, and attack missed alarm rate of the application firewall in the functional indicator dimension to obtain a corresponding first functional index subset, as well as the maximum number of concurrent connections, maximum new connection rate, and maximum throughput in the performance indicator dimension to obtain a corresponding first performance index subset, and the attack response index in the robustness indicator dimension to obtain a corresponding first robustness index subset; Obtaining device connectivity of the communication line in a functional indicator dimension to obtain a corresponding first functional index subset, as well as network throughput in a performance indicator dimension to obtain a corresponding first performance index subset, and transmission error rate in a robustness indicator dimension to obtain a corresponding first robustness index subset; Obtain the packet forwarding accuracy and path optimization index of the router in the functional indicator dimension to obtain the corresponding first functional index subset, as well as the network throughput, routing table capacity, packet loss rate and input and output delay time in the performance indicator dimension to obtain the corresponding first performance index subset, and the system stability in the robustness indicator dimension to obtain the corresponding first robustness index subset.

3. The network anti-attack performance evaluation method according to claim 1, characterized in that: The determining, for each simulation indicator object, a function difference value, a performance difference value, and a robustness difference value between each simulation indicator object corresponding to the simulated network system and the simulated network system to be analyzed based on the first function index subset and the second function index subset, the first performance index subset and the second performance index subset, and the first robustness index subset and the second robustness index subset, respectively, includes: For each simulation indicator object, inputting the corresponding first function index subset and second function index subset, the first performance index subset and second performance index subset, and the first robustness index subset and second robustness index subset into a preset algorithm mapping model to determine the corresponding algorithm type; The functional difference value, performance difference value, and robustness difference value between each simulation indicator object are calculated through the corresponding algorithm type.

4. The network anti-attack performance evaluation method according to claim 1, characterized in that: Before determining the anti-attack performance score of the target network system based on the function difference value, the performance difference value, and the robustness difference value associated with each simulation indicator object, the method further includes: Acquire attack traffic launched against the simulated network system, and identify the attack type of the attack traffic through a variational autoencoder to obtain a target attack type; Determining, according to the target attack type, the function difference weight, the performance difference weight, and the robustness difference weight corresponding to each simulation indicator object; Adjusting the function difference value, performance difference value, and robustness difference value of each simulation indicator object based on the function difference weight, the performance difference weight, and the robustness difference weight, respectively, to obtain a target function difference value, a target performance difference value, and a target robustness difference value; Then, determining the anti-attack performance score of the target network system based on the function difference value, the performance difference value, and the robustness difference value associated with each simulation indicator object in sequence includes: The anti-attack performance score of the target network system is determined based on the target function difference value, the target performance difference value and the target robustness difference value associated with each simulation indicator object.

5. The network anti-attack performance evaluation method according to claim 1, characterized in that: After determining the anti-attack performance score of the target network system according to the indicator difference between the first evaluation indicator set and the second evaluation indicator set, the method further includes: Comparing the anti-attack performance score with a preset performance evaluation standard to obtain a comparison result; Based on the comparison result, determining a target simulation indicator object that needs to be adjusted and an adjustment plan from the multiple simulation indicator objects of the simulated network system to be analyzed; According to the adjustment scheme, the indicator object corresponding to the target simulation indicator object in the target network system is adjusted.

6. A network anti-attack performance evaluation device, characterized in that: The device comprises: An establishment module is used to establish a simulation network system corresponding to the target network system and determine a plurality of simulation indicator objects in the simulation network system; A first acquisition module is configured to acquire, for a plurality of simulation indicator objects in the simulation network system, a corresponding first evaluation indicator set, wherein the first evaluation indicator set includes a first function index subset, a first performance index subset, and a first robustness index subset; An attack module, configured to perform a simulated attack on at least one simulation indicator object in the simulated network system to obtain a simulated network system to be analyzed after the simulated attack; A second acquisition module is used to obtain a second evaluation index set corresponding to multiple simulation index objects in the simulated network system to be analyzed, wherein the second evaluation index set includes a second function index subset, a second performance index subset, and a second robustness index subset; a determination module for determining, for each simulation indicator object, a function difference value, a performance difference value, and a robustness difference value between each simulation indicator object corresponding to the simulated network system and the simulated network system to be analyzed based on the first function index subset and the second function index subset, the first performance index subset and the second performance index subset, and the first robustness index subset and the second robustness index subset; and determining, in sequence, an anti-attack performance score of the target network system based on the function difference value, the performance difference value, and the robustness difference value associated with each simulation indicator object; The step of determining the anti-attack performance score of the target network system based on the function difference value, the performance difference value, and the robustness difference value associated with each simulation indicator object in sequence includes: By taking the simulation network system as the first root node, constructing multiple first child nodes corresponding to the simulation indicator objects, and taking the simulation network system to be analyzed as the second root node, constructing the second child nodes corresponding to the multiple simulation indicator objects, wherein each first child node is associated with a corresponding first function index subset, a first performance index subset and a first robustness index subset, and each second child node is associated with a corresponding second function index subset, a second performance index subset and a second robustness index subset; the function difference value, the performance difference value, and the robustness difference value between each simulation indicator object corresponding to the simulation network system and the simulation network system to be analyzed are respectively used as the difference connection edge between the first child node and the second child node corresponding to each simulation indicator object; global difference conduction is performed based on any first child node, the corresponding second child node and the corresponding difference connection edge to determine the anti-attack performance score of the target network system.

7. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the network anti-attack performance evaluation method according to any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the network anti-attack performance evaluation method according to any one of claims 1 to 5 is implemented.

Images