Multi-scale fusion network performance evaluation method based on killer chain driving

Abstract

The invention discloses a multi-scale fusion network efficiency evaluation method based on killing chain driving, and the method employs the bottom-up idea of a complex system, considers the three-in-one condition of confrontation, dynamic and overall structure based on the incidence relation of nodes, a killing chain and a killing network, and carries out the evaluation of the efficiency of a multi-scale fusion network. An evaluation model from a micro scale to a middle scale and then to a macro scale is constructed, and the feasibility of the method is verified by comparing network efficiencies of tactical-level command systems with different architecture forms through simulation. By using the method, the integrality, the dynamic nature, the antagonism and the uncertainty characteristics of the network are comprehensively considered, and efficiency evaluation can be performed on the network in different environments. The method can be widely applied to the field of network performance evaluation.

Description

Technical Field

[0001] The present invention relates to the field of network effectiveness evaluation, and particularly to a multi-scale fusion network effectiveness evaluation method driven by a kill chain. Background Art

[0002] The essence of network confrontation is to compete for information control rights. By means of network attack and defense, the security of one's own system is protected, while the information system of the enemy is acquired or destroyed, so as to achieve the purpose of disintegrating and destroying the enemy's information system and protecting one's own information system. The combat objects of network confrontation mainly focus on computer networks and related information systems, including critical infrastructure, military networks, government networks, and enterprise business networks, etc. Its combat means are diverse, including malicious code attacks, denial-of-service attacks, network penetration attacks, etc. In addition, electronic warfare technology is also widely used in cyber warfare to interfere with the enemy's communication system, spread false information, and weaken the enemy's command and control capabilities.

[0003] The confrontation between the two sides has shifted from traditional system confrontation to system confrontation under strong confrontation conditions. Since the system architecture determines the form and functional characteristics of the system, in a strong confrontation environment, the traditional confrontation system is restricted by the original architecture, and the speed and efficiency of information acquisition, information processing, and information sharing cannot meet the confrontation requirements. Improving and optimizing the existing system architecture has become an urgent problem to be solved.

[0004] However, network confrontation also faces many challenges. First of all, with the development of technology, network attack means are becoming increasingly complex and diverse, and traditional defense measures may be difficult to cope with new threats.

[0005] Comprehensively, reasonably, and effectively evaluating the effectiveness of cyber confrontation is an important link in improving combat capabilities. Traditional evaluation methods mostly adopt static evaluation methods. First, an index system is established, and then the fuzzy comprehensive evaluation method is used to evaluate the system. However, traditional evaluation methods rarely consider the characteristics of the confrontation environment, lack corresponding evaluation indicators, and cannot meet the needs of the existing strong confrontation field. Summary of the Invention

[0006] In view of this, in order to solve the technical problem that the existing network effectiveness evaluation method does not consider the characteristics of the confrontation environment, resulting in low applicability, the present invention proposes a multi-scale fusion network effectiveness evaluation method driven by a kill chain, and the method includes the following steps:

[0007] According to the combat and technical indicators of the node elements and the communication link corresponding entity units, use the method based on information entropy to evaluate the ability values of the nodes and links in different functional requirements;

[0008] Utilize the ability values of nodes and edges, combine the sequence composition relationship between nodes, edges and kill chains, and calculate the task efficiency, task ability and anti-destruction ability of kill chains based on the product effect;

[0009] According to the way that kill chains aggregate kill nets to form the network system ability, taking the number of kill chains and the ability indicators of kill chains as the basic evaluation parameters, construct static structure effectiveness indicators such as information effectiveness and structural effectiveness, and combine with dynamic confrontation effectiveness indicators to establish a comprehensive evaluation model for the network effectiveness of a strong confrontation system;

[0010] Based on the analytic hierarchy process, analyze the importance relationship between different index parameters in the confrontation environment, obtain the weights of each effectiveness index, and form a comprehensive evaluation method for the network effectiveness of a strong confrontation system.

[0011] Based on the above scheme, the present invention provides a multi-scale fusion network effectiveness evaluation method driven by kill chains. Based on the association relationship between nodes, kill chains and kill nets, considering the trinity conditions of confrontation, dynamics and overall structure, an evaluation model from the micro scale to the middle scale and then to the macro scale is constructed. At the micro scale, based on the combat technology indicators of nodes and edges, an evaluation method for node ability is established based on information entropy; at the middle scale, according to the sequence relationship between nodes and kill chains, an evaluation method for the ability of nodes to kill chains is established based on the product effect; at the macro scale, by aggregating the abilities of kill chains in different dimensions, an evaluation method for the comprehensive effectiveness of kill nets is established based on the analytic hierarchy process. The present invention can calculate the confrontation effectiveness of different network system architectures, analyze the adaptability of architectures in different confrontation environments, guide the improvement and optimization of existing system architectures, and improve the overall ability of strong confrontation systems. Brief Description of the Drawings

[0012] Figure 1 is the step flow chart of a multi-scale fusion network effectiveness evaluation method driven by kill chains according to the present invention;

[0013] Figure 2 is the schematic diagram of the hierarchical structure decomposition of the detection type node indicators according to the present invention;

[0014] Figure 3 is the schematic diagram of the hierarchical structure decomposition of the command type node indicators in the embodiment of the present invention;

[0015] Figure 4 is the schematic diagram of the hierarchical structure decomposition of the firepower type node indicators in the embodiment of the present invention;

[0016] Figure 5 is the schematic diagram of the hierarchical structure decomposition of the communication edge indicators in the embodiment of the present invention;

[0017] Figure 6 is the network architecture morphology diagram of a strong confrontation system in the embodiment of the present invention;

[0018] Figure 7 is a comparison chart of network information efficiency in different architecture forms in the embodiments of the present invention;

[0019] Figure 8 is a comparison chart of network organization efficiency in different architecture forms in the embodiments of the present invention;

[0020] Figure 9 is a comparison chart of network structure efficiency in different architecture forms in the embodiments of the present invention;

[0021] Figure 10 is a comparison chart of network robustness in different architecture forms in the embodiments of the present invention;

[0022] Figure 11 is a comparison chart of network survivability in different architecture forms in the embodiments of the present invention;

[0023] Figure 12 is a comparison chart of the number of communication links between reconnaissance-command nodes in different architecture forms in the embodiments of the present invention;

[0024] Figure 13 is a comparison chart of the comprehensive network efficiency in different architecture forms in the embodiments of the present invention; Detailed implementation manners

[0025] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0026] It should be noted that for the convenience of description, only the parts related to the relevant invention are shown in the accompanying drawings. Without conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

[0027] It should be understood that the "system" used in the present application is a method for distinguishing different components, elements, parts, portions or assemblies at different levels. However, if other words can achieve the same purpose, the word can be replaced by other expressions.

[0028] Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the clearly identified steps and elements, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0029] In addition, flowcharts are used in this application to illustrate the operations performed by the system according to the embodiments of this application. It should be understood that the operations before or after may not necessarily be executed precisely in sequence. Instead, the steps can be processed in reverse order or simultaneously. At the same time, other operations can also be added to these processes, or one or several steps can be removed from these processes.

[0030] Referring to Figure 1 , which is a schematic flowchart of an optional example of the method for evaluating the effectiveness of a multi-scale fusion network driven by a kill chain proposed by the present invention. This method can be applied to computer devices. The effectiveness evaluation method proposed in this embodiment may include but is not limited to the following steps:

[0031] Step S1: According to the combat and technical indicators of the entity units corresponding to the nodes and edges, use the method based on information entropy for evaluation to obtain the node ability value and the edge ability value;

[0032] Step S2: Based on the node ability value and the edge ability value, construct the ability indicators;

[0033] Step S3: Use the information effectiveness and the structural effectiveness as the static structural effectiveness, and combine the dynamic confrontation performance indicators to construct the effectiveness indicator system;

[0034] Step S4: Analyze the importance relationship between different effectiveness indicators in the confrontation environment based on the analytic hierarchy process to obtain the weights of each effectiveness indicator;

[0035] Step S5: Combine the ability indicators, the effectiveness indicator system and the weights to conduct the network effectiveness evaluation.

[0036] In some feasible embodiments, it is necessary to clarify the relevant descriptions of the system network model mentioned in the present invention:

[0037] The strong confrontation system network model is based on the information link, aggregates various components, and forms a kill network model with multiple and multiple kill chain sequences. Therefore, the entity units can be mapped to the nodes in the network, and the information communication between the entity units can be abstracted as edges to obtain the network topology model of the strong confrontation system. This model can be expressed as:

[0038] G = (N, E)

[0039] In the formula, N is the set of all entity units in the strong confrontation system, and E is the set of all communication interactions. These entity nodes are aggregated through communication interactions to form the kill network model G to serve the system confrontation for target requirements.

[0040] Description and modeling of nodes:

[0041] According to the concept of the kill chain, the system elements can be divided into three types of entities: reconnaissance, command and firepower according to their functions. The mathematical model can be expressed as:

[0042] V NodeType =(S,C,F)

[0043] In the formula, S represents the set of reconnaissance nodes, C represents the set of command nodes, and F represents the set of firepower nodes.

[0044] The premise of obtaining the overall capability of the strong confrontation system network is to first understand the capabilities of all nodes in the system, and these capabilities are determined by the combat skills indicators of the physical nodes during design. For this reason, combat skills indicators can be used to represent the capability vector of the system. Assuming that a certain type of node in the system confrontation requires m capabilities, and the elements have a total of n combat skills indicators, its capability vector V_NodeCapability can be expressed as:

[0045]

[0046] In the formula, Expressed as k of the ith capability j Combat skill indicators, It represents the set of combat skill indicators that affect the mth ability. The union of all combat skill indicator sets is n combat skill indicators.

[0047] In the actual confrontation process, it is hoped that the physical nodes can efficiently exert their own capabilities while ensuring their own survival as much as possible. Therefore, the research divides the capability indicators required by the nodes into three types: failure probability, mission capability, and mission efficiency according to the survival conditions, capability size, and performance. The combat skill indicators that affect the capabilities of different types of nodes are as follows.

[0048] Reconnaissance nodes. Reconnaissance nodes are a general term for entity units with one or more intelligence functions such as reconnaissance, identification, tracking and search. Their role is to obtain various intelligence information of the enemy and transmit the information after preliminary processing to command nodes through communication data links to provide a basis for their command decisions. The indicator hierarchy structure for constructing reconnaissance nodes is decomposed as follows: Figure 2 shown.

[0049] Command nodes. Command nodes are a general term for entity units that integrate intelligence analysis and command decision-making functions. Their role is to integrate the intelligence information of each reconnaissance node, generate the situation of the two opposing sides, analyze the enemy's behavior to determine its intentions, form decision instructions, and pass the decision instructions to the firepower node through the communication data link to assign task objectives to the firepower node. The indicator hierarchy structure for constructing command nodes is decomposed as follows: Figure 3 shown.

[0050] Firepower - type nodes. Firepower - type nodes refer to the general term for entity units that can conduct physical or electromagnetic strikes on targets. Their role is to implement specific strike actions on targets and fulfill the command requirements of command - type nodes. The hierarchical decomposition of the index structure for constructing firepower - type nodes is as follows Figure 4 as shown.

[0051] Description and modeling of edges:

[0052] In the kill chain, the information interaction relationships between element nodes involve various types such as command, intelligence, coordination, sharing, and support. Since these information flows are intricate and cannot be exhausted, considering that their transmission methods are all in the form of communication data links, the information interaction sending and receiving processes are abstracted into directed communication edges. The hierarchical decomposition of the index structure for constructing communication edges is as follows Figure 5 as shown.

[0053] In some feasible embodiments, step S1 specifically includes:

[0054] The uncertainty of node and edge combat - technical indicators is described by membership degrees. According to the weights of each combat - technical indicator in the corresponding functional requirements, the method of information entropy is used to obtain the weighted self - information amount. By summing up the weighted self - information amounts of the combat - technical indicators belonging to the ability requirements, the total self - information of the uncertainty of the functional requirements is obtained. On this basis, based on the entropy function, the relationship between the uncertainty of combat - technical indicators and the ability value of functional requirements is constructed.

[0055] The capabilities of nodes and edges in a strong - confrontation system are affected by a large number of combat - technical indicators. These combat - technical indicators have uncertainties in a strong - confrontation environment, resulting in uncertainties in node capabilities. Since traditional weighted evaluation methods based on tree - like architectures cannot describe uncertainties, while information entropy can well describe uncertainties, therefore, for the node capabilities of network nodes or edges, a method based on information entropy is studied for measurement.

[0056] When using the method based on information entropy to measure the capabilities of nodes and edges, we believe that the smaller the uncertainty of the combat - technical indicators that meet the ability requirements, the higher the node capabilities; conversely, the greater the uncertainty of the combat - technical indicators that meet the ability requirements, the lower the node capabilities. And how to describe the uncertainty of combat - technical indicators on the capabilities of nodes and edges, here the membership degree index is used to measure the uncertainty. Suppose there are n combat - technical indicators that affect a certain aspect of node capabilities. The membership degree when these indicators fully meet the node ability requirements is 1, and the membership degree when they completely do not meet the node ability requirements is 0. Let the membership degrees of these n combat - technical indicators be R1, R2,..., R n , and the corresponding weights are denoted as ω1, ω2,..., ω n , where ω1 + ω2+... + ω n = 1. For each combat - technical indicator, its weighted self - information amount is:

[0057] I i =-ω i ln R i

[0058] Since the capabilities of a node in a certain aspect are aggregated from combat skill indicators, we can consider that the total self-information of the uncertainties of combat skill indicators is the ability W of the node in a certain aspect j The value of the uncertain self-information contained in it. The greater the uncertain self-information, the smaller the ability. According to the entropy function, the node ability W can be obtained j The relationship with the total self-information P of the uncertainties of combat skill indicators is as follows:

[0059]

[0060] In some feasible embodiments, steps S2 - S3 specifically include:

[0061] In an informationized confrontation environment, the confrontation system needs a higher exchange frequency and intensity of information, matter, and energy to cope with the future confrontation environment, which requires the strong confrontation system to have better information efficiency and organizational efficiency. Therefore, the research evaluates the network effectiveness of the strong confrontation system from two perspectives: information effectiveness and organizational effectiveness.

[0062] Information effectiveness:

[0063] Information effectiveness refers to the value manifestation of information in a strong confrontation system, including aspects such as the accuracy, timeliness, integrity, and availability of information. High - efficient information effectiveness means that information can be quickly and accurately transmitted to where it is needed and effectively support decision - making and actions. In this regard, the research proposes timeliness and transferability indicators to evaluate the information effectiveness of the network.

[0064] 1) Timeliness E. In a single kill chain, timeliness refers to the transfer efficiency of information from a reconnaissance - type node to a fire - power - type node in the link sequence. Suppose there are s nodes on a certain kill chain path, and its transfer efficiency is the product of the task efficiency capabilities of these s nodes and the communication links between the s nodes:

[0065] ∏t(v,w)

[0066] In the formula, t(v,w) represents the task efficiency values corresponding to all nodes and links on the kill chain path from node v to node w. In the network system of a strong confrontation system, timeliness is defined as the average transfer efficiency of information in the network, expressed as the ratio of the sum of the shortest - path information transfer efficiencies of available kill chains from reconnaissance - type nodes to fire - power - type nodes to the number of shortest - path kill chains when the network is fully connected:

[0067]

[0068] Wherein, |S| represents the number of reconnaissance nodes, and |F| represents the number of firepower nodes. The value range of the timeliness E is 0 to 1. When E = 0, it means that the information transmission efficiency completely does not meet the requirements of the current confrontation environment; when E = 1, it means that the information transmission efficiency completely meets the requirements of the confrontation environment.

[0069] 2) Transitivity T. In a single kill chain, transitivity refers to the information quality of the link sequence of information transmitted from reconnaissance nodes to firepower nodes. Suppose there are s nodes on a certain kill chain, and its transmission efficiency is the product of the task capabilities of these s nodes and the communication links between the s nodes:

[0070] ∏d(v,w)

[0071] Wherein, d(v,w) represents the task capability values corresponding to all nodes and links on the kill chain path from node v to node w. In the network system of a strong confrontation system, transitivity is defined as the average information quality of information transmitted in the network, and is represented by the ratio of the sum of the information transmission quality of the shortest paths of available kill chains from reconnaissance nodes to firepower nodes to the number of shortest path kill chains when the network is fully connected:

[0072]

[0073] The value range of transitivity T is 0 to 1. When T = 0, it means that the information transmission quality completely does not meet the requirements of the current confrontation environment; when E = 1, it means that the information transmission quality completely meets the requirements of the confrontation environment. Since the influence of timeliness and transitivity on information effectiveness has a short-board effect, when any one of the indicators is very low, it will cause a serious decline in information effectiveness. Therefore, the relationship between information effectiveness IE and timeliness and transitivity is:

[0074]

[0075] β1+β2=1

[0076] Wherein, β i is the weight coefficient of the i-th effectiveness.

[0077] Organizational effectiveness:

[0078] Organizational effectiveness refers to the efficiency and effect of an organization in achieving its goals. In this embodiment, it is defined as the ability of the network system of a strong confrontation system to construct kill chains. The higher the organizational effectiveness, the more kill chains the network system of a strong confrontation system can form. Usually, the number of kill chains in the network is determined by its own organizational structure on the one hand and the collaborative relationship formed based on tasks on the other hand. Therefore, connectivity and compactness indicators are proposed in the research to evaluate the information effectiveness of the network.

[0079] 1) Connectivity L. In a single kill chain, connectivity refers to whether there is a sequence of links for information from reconnaissance nodes to firepower nodes. In the network system of a strong confrontation system, connectivity is defined as the ability of the network to construct kill chains, expressed as the ratio of the number of available shortest kill chain paths from reconnaissance nodes to firepower nodes to the number of shortest kill chain paths in a fully connected state:

[0080]

[0081] In the formula, p(v, w) represents the shortest kill chain path from node v to node w. The value range of the transitivity L is 0 to 1. When L = 0, it means there is no kill chain in the network; when L = 1, it means the network has a fully connected kill chain.

[0082] 2) Closeness J. Closeness means that during confrontation, nodes on different kill chains are linked to form a collaborative relationship. During collaboration, due to the ability to share information, more kill chain paths can be formed, thereby enhancing the anti-destruction effectiveness of the network. In the network of a strong confrontation system, closeness can be represented by the clustering coefficient:

[0083]

[0084] In the formula, k y represents the degree of the y-th node, N is the number of network nodes, and e y is the actual number of edges existing between the neighbor nodes of node y.

[0085] Since the influence of connectivity and closeness on organizational effectiveness is relatively independent, it is considered that the relationship between organizational effectiveness and connectivity and closeness is a weighted sum, expressed as:

[0086] OE = η1L + η2J

[0087] η1 + η2 = 1

[0088] In the formula, η i is the weight coefficient of the i-th item.

[0089] In some feasible embodiments, the confrontation performance in step S3 specifically includes:

[0090] The mission of a strong confrontation system is to achieve victory when confronting the enemy's system. During confrontation, both sides usually first look for key nodes or paths in the enemy's system and destroy the enemy's system architecture by attacking these critical points to reduce the enemy's confrontation effectiveness. It can be seen that the effectiveness of the network is not only determined by the characteristics of the initial topological architecture of the network, but more importantly, lies in the ability to maintain its own network during confrontation. Therefore, the confrontation effectiveness is proposed as one of the evaluation indicators for the comprehensive effectiveness of the network.

[0091] An excellent architecture form is matched with the environment. Only by being matched with the environment can the advantages of the architecture be brought into play and the advantages under confrontation be obtained. Some networks are robust against random attacks but vulnerable to carefully selected attacks; for some networks, when facing attacks, without changing the core architecture of the network, local changes in nodes and edges in the network will not have a great impact on the network performance. In simulation experiments, the network breaking strategies usually adopted are deterministic and random attacks. For the study of the network performance of deterministic attacks, the invulnerability parameter is used as the evaluation index; for the study of the network performance of random attacks, the robustness parameter is used as the evaluation index. Following this idea, this embodiment uses robustness and invulnerability indexes to evaluate the confrontation effectiveness of the network.

[0092] 1) Robustness R. Robustness refers to the ability of the network architecture of a strong confrontation system to maintain its function and architecture after facing random attacks. Here, the robustness is defined as the ratio of the network structure effectiveness after randomly losing k nodes in the network to the network structure effectiveness before the change, expressed as:

[0093]

[0094] In the formula, IE(k) is the network structure effectiveness after randomly losing k nodes in the network, and IE is the network structure effectiveness before the change.

[0095] 2) Invulnerability D. Invulnerability refers to the ability of the network architecture of a strong confrontation system to maintain its function and architecture after facing targeted attacks. In the actual confrontation process, the enemy usually takes command and reconnaissance targets as the primary targets for key strikes. Therefore, the invulnerability is defined as the ratio of the network structure effectiveness after randomly losing k reconnaissance and index nodes in the network to the network structure effectiveness before the change, expressed as

[0096]

[0097] Among them, IE(|S,C| k ) is the network structure effectiveness after randomly losing k reconnaissance and command nodes, and NE is the network structure effectiveness before the change.

[0098] The overall effectiveness of the network is closely related to its structure and confrontation ability. When the ability of any link reaches a certain threshold, it will cause a rapid decrease in the overall effectiveness of the network. We believe that the relationship between static structure effectiveness, robustness, and invulnerability is a multiplicative relationship.

[0099] Therefore, the comprehensive network effectiveness NE can be expressed as:

[0100]

[0101] α1 + α2 + α3 = 1

[0102] In the formula, α k is the weight coefficient of the i-th network effectiveness.

[0103] In some feasible embodiments, step S4 specifically includes:

[0104] The analytic hierarchy process is a systematic and hierarchical multi-criteria decision-making analysis method. It decomposes complex problems into multiple levels and factors, conducts quantitative and qualitative analyses, and helps decision-makers make scientific decisions. Since the research only conducts fuzzy comparisons and has low requirements for judgment accuracy, a 1-5 scale is used as the judgment scale for the hierarchical structure of factor membership. The scale values of the judgment scale are shown in Table 1.

[0105] Table 1 Judgment Scale Table

[0106] Scale value Meaning 1 Two factors are equally important 2 One factor is slightly more important than the other 3 One factor is significantly more important than the other 4 One factor is strongly more important than the other 5 One factor is extremely more important than the other Reciprocal If the importance of factor A compared to factor B is k, then the importance of factor B compared to factor A is 1 / k

[0107] Under information-based conditions, taking information effectiveness and organizational effectiveness as criteria, the judgment matrix of the network structure effectiveness of a strong confrontation system is constructed as follows:

[0108]

[0109] Calculating, we get λ max = 2. After consistency test and normalization, its weight vector can be obtained as:

[0110] W = (0.75, 0.25) T

[0111] Referring to the calculation steps of the analytic hierarchy process, the weight vectors of other effectiveness index parameters in the previous section can be calculated. By constructing a judgment matrix and inputting it into a calculation program, the results of the relative importance of other influencing factors to the upper-level criterion are shown in Table 2.

[0112] Table 2 Index Effectiveness Weights Based on the Analytic Hierarchy Process

[0113]

[0114] System architectures of different forms have different adaptability in different confrontation environments, and there are also differences in confrontation effectiveness. In an information-based confrontation environment, designing a system architecture that can adapt to higher frequencies and intensities of information, material, and energy exchanges is a key link to obtaining confrontation advantages. Among them, the network effectiveness evaluation method of the system architecture is of great significance for the design and optimization of the system architecture. Based on the proposed network effectiveness comprehensive evaluation method, the feasibility of the proposed method is verified by comparing the network comprehensive effectiveness of different architecture forms.

[0115] Based on the above evaluation method, the present invention also gives an example of simulation analysis:

[0116] For the tactical-level command system, by comparing the network effectiveness of four confrontation system architectures, namely the centralized, centralized-distributed hybrid, hierarchical-centralized hybrid, and fully distributed architectures under informationized conditions, the effectiveness of the method is verified. These four architecture form models are respectively as follows Figure 6 shown.

[0117] When modeling, it is assumed that nodes of the same type and the connection capabilities of edges in the tactical-level confrontation system network are the same. The confrontation system network constructed according to the network generation rules is as follows:

[0118] 1) The network topology diagram is a directed graph connected in the order of reconnaissance nodes, command nodes, and firepower nodes;

[0119] 2) The number of network reconnaissance nodes of different architecture forms remains unchanged and is connected to all the highest-level command nodes in the architecture;

[0120] 3) Firepower-type nodes are only connected to the lowest-level command nodes, and the number of firepower nodes connected to each low-level command node is the same;

[0121] 4) The architecture form of the network is only related to the command network architecture, where the centralized architecture is affected by the command level and command span;

[0122] 5) The number of low-level command nodes of all architecture forms is the same as that of the centralized architecture;

[0123] 6) The hierarchical-centralized hybrid only considers two layers.

[0124] Comprehensive evaluation of the network effectiveness of the strong confrontation system:

[0125] To solve the macroscopic network effectiveness of the strong confrontation system, it is necessary to obtain the ability measurement index values of each node and edge at the microscopic scale. The ability measurement index is calculated according to the membership function model. The ability of a node is affected by multiple combat technology indexes. The greater the membership degree of each combat technology index that meets the ability requirements, the more the index meets the requirements of the confrontation environment, and the better the ability of the node. Tables 3 to 6 give the ability values and combat technology index membership degree values of reconnaissance-type, command-type, firepower-type nodes, and communication edge-type in the strong confrontation system.

[0126] Table 3 Weighted ability values of reconnaissance-type nodes

[0127]

[0128] Table 4 Weighted ability values of command-type nodes

[0129]

[0130] Table 5 Weighted ability values of firepower-type nodes

[0131]

[0132] Table 6 Communication Link Weighted Capacity Values

[0133]

[0134]

[0135] When calculating the robustness and survivability of the network topology, it is assumed that nodes have random loss characteristics. Among them, robustness is the ratio of the network structure efficiency when all nodes in the network are randomly lost by 10%, and survivability is the ratio of the network structure efficiency when the command and reconnaissance nodes in the network are randomly lost by 10%. Due to certain randomness in the calculation, the Monte Carlo method is used to calculate the average value of 30 random times as the final result of the comprehensive evaluation of the network efficiency of the strong confrontation system.

[0136] Through simulation Figures 7 - 13 a comparison chart of network capacity data for different architecture forms is given.

[0137] From Figures 7 - 9 it can be obtained that in the tactical-level command architecture, considering that the capabilities of nodes of the same type are the same, the reconnaissance information can be distributed to all processing nodes, and there is no horizontal task coordination, these different forms of system architectures have the same organizational efficiency. However, in the hierarchical architecture, due to information transmission between layers, decision-making lag and information loss will occur, resulting in a decrease in information efficiency, thus affecting the efficiency of the overall network structure. Therefore, in the tactical-level command architecture, the fewer intermediate hierarchical structures in the architecture, the better the static structure efficiency of the network.

[0138] From Figure 10 and Figure 11 it can be obtained that in the dynamic confrontation process, considering that all nodes of the same type have the same damage probability, and the order of the damage probability is firepower nodes > reconnaissance nodes > command nodes, the network performance of the hierarchical architecture will decline as the number of command levels increases. This is because the more levels there are, the higher the proportion of command nodes in the whole, and the greater the possibility of the number of losses. At the same time, in the case of a higher level, the loss of high-level command nodes will affect more command nodes, resulting in lower overall performance. And the more distributed the architecture is, the more stable the proportion of the number of various nodes is. In the case of continuous increase in the number, due to the higher loss probability, firepower nodes will become the node type with the largest number of losses, making the impact of node losses on the overall performance gradually smaller, which is also the reason why the network performance first decreases and then increases. In addition, in the centralized-distributed hybrid architecture, there is a situation where the local performance suddenly decays, which is because the performance drops significantly due to the multiple random losses of reconnaissance nodes or high-level command nodes, resulting in a lower overall average value.

[0139] FromFigure 13 It can be seen that in the simulation scenario, the overall efficiency of the fully distributed network is the best, the overall efficiency of the centralized architecture network is the worst, and the hybrid architecture has relatively better network efficiency. At the same time, as the scale increases, the overall efficiency of the hierarchical architecture will continuously decrease, while the overall efficiency of the flat architecture will first decline and then gradually increase after reaching a certain scale. However, from Figure 12 it can be known that the fully distributed and centralized-distributed hybrid architectures have high requirements for communication capabilities, and there needs to be a strong communication transmission ability between the reconnaissance nodes and the command nodes. In contrast, the centralized or hierarchical-centralized hybrid architectures have lower requirements for the communication capabilities of the reconnaissance nodes.

[0140] In summary, in the confrontation under information technology conditions, considering that the capabilities of the same type of nodes in the tactical-level system are the same, the flatter the command architecture, the better the comprehensive efficiency because it can significantly increase the information flow and transmission efficiency. On the contrary, due to the lower information flow efficiency, the hierarchical structure will lead to a continuous decrease in the comprehensive efficiency. To improve its comprehensive efficiency, only by improving the intelligence information processing capabilities, knowledge levels, and command and dispatching capabilities of command nodes at different levels can it be possible to handle more complex and larger-scale situations. This is consistent with our understanding and demonstrates the feasibility of the multi-scale fusion network efficiency evaluation method driven by the kill chain.

[0141] A multi-scale fusion network efficiency evaluation device driven by the kill chain:

[0142] At least one processor;

[0143] At least one memory for storing at least one program;

[0144] When the at least one program is executed by the at least one processor, the at least one processor implements the multi-scale fusion network efficiency evaluation method driven by the kill chain as described above.

[0145] The content in the above method embodiments is applicable to the embodiments of this device. The functions specifically implemented by the embodiments of this device are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those of the above method embodiments.

[0146] A storage medium storing instructions executable by a processor, where the instructions executable by the processor are used to implement the multi-scale fusion network efficiency evaluation method driven by the kill chain as described above when executed by the processor.

[0147] The content in the above method embodiments is applicable to the embodiments of this storage medium. The functions specifically implemented by the embodiments of this storage medium are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those of the above method embodiments.

[0148] The above has made a specific description of the preferred embodiments of the present invention. However, the present invention is not limited to the described embodiments. Those skilled in the art can make various equivalent deformations or substitutions without departing from the spirit of the present invention. These equivalent deformations or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A method for evaluating the effectiveness of a multi-scale fusion network driven by a kill chain, characterized in that, It includes the following steps: According to the combat technology indicators of the entity units corresponding to the nodes and connection edges, use the method based on information entropy for evaluation to obtain the node ability value and the connection edge ability value; Based on the node ability value and the connection edge ability value, construct the ability index; Taking information efficiency and structural efficiency as static structural efficiency, and combining dynamic confrontation performance indicators, construct an efficiency index system; Based on the analytic hierarchy process, analyze the importance relationship between different efficiency indicators in the confrontation environment to obtain the weights of each efficiency indicator; Combining the ability index, the efficiency index system and the weights, conduct network efficiency evaluation.

2. The multi-scale fusion network effectiveness evaluation method based on kill chain drive according to claim 1, wherein, The step of using the method based on information entropy for evaluation according to the combat technology indicators of the entity units corresponding to the node elements and communication connection edges to obtain the node ability value and the connection edge ability value specifically includes: Describe the uncertainty of the combat technology indicators of the nodes and connection edges as membership degrees, and according to the weights of each combat technology indicator corresponding to the corresponding functional requirements, use the method of information entropy to obtain the weighted self-information amount; By summing the weighted self-information amounts of the combat technology indicators, obtain the total self-information of uncertainty; Determine the node ability value and the connection edge ability value according to the total self-information of the uncertainty.

3. The method for evaluating the effectiveness of a multi-scale fusion network driven by a kill chain according to claim 2, characterized in that, The calculation formula of the weighted self-information amount is expressed as follows: I i = -ω i lnR i Among them, I i represents the weighted self-information amount corresponding to the i-th combat skill index, ω i represents the weight corresponding to the i-th combat skill index, R i represents the membership degree corresponding to the i-th combat skill index.

4. The method for evaluating the effectiveness of a multi-scale fusion network driven by a kill chain according to claim 1, characterized in that The nodes include reconnaissance nodes, command nodes and firepower nodes. The ability indicators include anti-destruction ability, task ability and task efficiency. The information efficiency includes timeliness and transferability. The structural efficiency includes connectivity and compactness. The dynamic confrontation performance indicators include robustness and anti-destruction ability.

5. The multi-scale fusion network effectiveness evaluation method based on the kill chain drive according to claim 4, wherein, The calculation formula of the timeliness is as follows: Where, |S| represents the number of reconnaissance nodes, |F| represents the number of firepower nodes, and t(v, w) represents the task efficiency values corresponding to all nodes and connection edges on the kill chain path from node v to node w.

6. The multi-scale fusion network effectiveness evaluation method based on kill chain drive according to claim 4, wherein, The calculation formula of the compactness is expressed as follows: where k y represents the degree of the y-th node, N is the number of network nodes, and e y is the actual number of edges existing between the neighbor nodes of the y-th node.

7. The multi-scale fusion network effectiveness evaluation method based on the kill chain drive according to claim 4, characterized in that, The formula of the anti-destruction ability is expressed as follows: Among them, IE(|S,C| k ) is the network structure effectiveness after randomly losing k detection and command nodes, and IE is the network structure effectiveness before the change.

8. A multi-scale fusion network effectiveness evaluation device driven by a kill chain, characterized in that It includes: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements a method for evaluating the network efficiency of multi-scale fusion driven by the kill chain according to any one of claims 1-7.

Images