A method and device for constructing and simulating evaluation of a kill chain model

Abstract

The application discloses a kind of killing chain model construction and simulation evaluation method and device, the method includes: S1, preset node entity set;S2, obtain killing chain element information set;S3, based on the node entity set and the killing chain element information set, carry out countermeasure simulation processing, obtain global damage information set and killing chain execution information set;S4, to the global damage information set, the killing chain execution information set and the killing chain element information set are evaluated processing, obtain killing chain evaluation result.The application can accurately simulate killing link, and improve the comprehensiveness and accuracy of killing chain benefit evaluation.

Description

Technical Field

[0001] This invention belongs to the field of scenario simulation technology, specifically a method and apparatus for constructing and simulating a kill chain model. Background Technology

[0002] The kill chain is a core theory used in military force design, operational planning, and evaluation, breaking down the kill process into stages such as situational awareness, decision-making, action, and effect assessment. Its typical stages include detection (finding targets through radar, satellites, etc.), location (confirming target identity and attributes), tracking (continuously locking onto target movement), aiming (developing strike plans), strike (carrying out physical attacks), and assessment (determining target damage status). In actual combat, resources must be allocated in conjunction with factors such as enemy situation and terrain, and the kill objective is achieved through multiple cycles.

[0003] With the development of information technology, the kill chain has evolved from a traditional closed-loop model based on a single platform to a multi-platform collaborative model. The capabilities of each link are distributed across different sensors or platforms, placing higher demands on the accuracy and comprehensiveness of modeling, simulation, and evaluation. Currently, kill chain-related technologies face the following key challenges:

[0004] First, the accuracy of model construction is insufficient: most methods do not standardize and preset the five core node entities of detection, positioning, tracking, aiming and attack, making it difficult to quickly construct a kill chain model that adapts to specific combat needs, resulting in a large deviation between the simulation scenario and the actual scenario.

[0005] Second, the evaluation logic is one-sided: traditional assessments often only focus on the closed kill chain of "whether the target is completely destroyed", ignoring the value of the non-closed kill chain of "not completely destroyed but effectively weakened". They cannot quantify the benefits of such kill chains in terms of resource consumption and phase completion, resulting in the evaluation results failing to provide a comprehensive reference for the performance demonstration of equipment development.

[0006] Third, there is a lack of comprehensive evaluation capabilities: existing evaluations have not established classification and calculation models for closed and non-closed kill chains, nor do they have a standardized comprehensive integration mechanism, making it difficult to systematically measure the overall performance of the kill chain, which in turn affects the scientific nature of action decisions.

[0007] In summary, modeling and simulation, as core tools in kill chain research, are crucial in weapon and equipment development (requiring analysis of capabilities at each stage for iterative performance verification) and application (requiring verification of collaborative effects to optimize action plans). Therefore, there is an urgent need for a kill chain model construction and simulation evaluation method that can accurately model, classify, evaluate, and comprehensively measure kill chains to address current technical challenges. Summary of the Invention

[0008] The technical problem to be solved by the present invention is to provide a method and apparatus for constructing and simulating a kill chain model, which can accurately simulate the kill links and improve the comprehensiveness and accuracy of the kill chain benefit evaluation.

[0009] To address the aforementioned technical problems, this invention discloses a method for constructing and simulating a kill chain model, the method comprising:

[0010] S1. A preset set of node entities; the set of node entities includes a subset of detection node entities, a subset of location node entities, a subset of tracking node entities, a subset of targeting node entities, a subset of attacking node entities, and a subset of evaluation node entities;

[0011] The subset of detection node entities includes several detection node entities; the subset of positioning node entities includes several positioning node entities; the subset of tracking node entities includes several tracking node entities; the subset of aiming node entities includes several aiming node entities; the subset of attack node entities includes several attack node entities; and the subset of evaluation node entities includes several evaluation node entities.

[0012] S2. Obtain a kill chain element information set; the kill chain element information set includes P kill chain element information; the kill chain element information includes detection node number, positioning node number, tracking node number, aiming node number, strike node number, evaluation node number, first allowed consumption matrix, second allowed consumption matrix, third allowed consumption matrix, fourth allowed consumption matrix, fifth allowed consumption matrix, and sixth allowed consumption matrix; P is an integer greater than 1;

[0013] S3. Based on the set of node entities and the set of kill chain element information, perform adversarial simulation processing to obtain a global damage information set and a kill chain execution information set;

[0014] The global damage information set includes P damage information items; the damage information includes target value, damage level, priority value, destruction time, and implementation node number; the damage level is an integer greater than 0 and less than T, where T is an integer greater than 1;

[0015] The kill chain execution information set includes P kill chain execution information pieces; the kill chain execution information includes the first detection time, the first actual consumption, the second actual consumption, the third actual consumption, the fourth actual consumption, the fifth actual consumption, the sixth actual consumption, the first execution time, the second execution time, the third execution time, the fourth execution time, the fifth execution time, and the sixth execution time.

[0016] S4. Evaluate the global damage information set, the kill chain execution information set, and the kill chain element information set to obtain the kill chain evaluation result; the kill chain evaluation result includes a closed benefit set, a non-closed benefit set, and a comprehensive benefit value.

[0017] As an optional implementation, in the first aspect of the present invention, the step of performing adversarial simulation processing based on the set of node entities and the set of kill chain element information to obtain a global damage information set and a kill chain execution information set includes:

[0018] S31, Based on the set of node entities and the set of kill chain element information, a kill chain model set is constructed; the kill chain model set includes the kill chain model corresponding to each kill chain information in the kill chain information set;

[0019] S32. Perform parallel simulation processing on the kill chain model set to obtain the global damage information set and the kill chain execution information set.

[0020] As an optional implementation, in the first aspect of the present invention, the evaluation processing of the global damage information set, the kill chain execution information set, and the kill chain element information set to obtain a kill chain evaluation result includes:

[0021] S41. Process the global damage information set and the kill chain execution information set to obtain a closed damage information set, a non-closed damage information set, a closed kill chain execution information set, and a non-closed kill chain execution information set;

[0022] The closed damage information set includes N The damage information; the non-closed damage information set includes M The damage information described above;

[0023] The closed kill chain execution information set includes N The kill chain execution information set includes: [the set of] kill chain execution information; [the set of] non-closed kill chain execution information. M The kill chain execution information described above;

[0024] N and M All are non-negative integers;

[0025] S42. Process the closed damage information set, the kill chain execution information set, and the kill chain element information set to obtain a closed benefit set;

[0026] S43. Process the non-closed damage information set, the kill chain execution information set, and the kill chain element information set to obtain a non-closed benefit set;

[0027] S44. Process the closed benefit set and the non-closed benefit set to obtain the comprehensive benefit value.

[0028] As an optional implementation, in the first aspect of the present invention, processing the closed damage information set, the kill chain execution information set, and the kill chain element information set to obtain a closed benefit set includes:

[0029] S421. Perform a first splitting process on the closed damage information set to obtain a first target value set, a first damage level set, a first priority set, a destruction time set, and a first implementation node number set;

[0030] S422. Based on the first set of implementation node numbers, query the set of kill chain element information and the set of kill chain execution information to obtain the set of first discovery times, the first allowed consumption matrix and the first actual consumption matrix.

[0031] Both the first allowed consumption matrix and the first actual consumption matrix include N Rows 6 columns;

[0032] S423. Using a closed kill chain benefit calculation model, process the first damage level set, the first priority set, the first target value set, the first actual consumption matrix, the first allowed consumption matrix, the destruction time set, and the first discovery time set to obtain the closed benefit set.

[0033] As an optional implementation, in the first aspect of the present invention, the expression for the closed kill chain benefit calculation model is:

[0034]

[0035] In the formula, GA i The first of the closed benefit set i The closed-loop benefit value, 1 ≤ i ≤ N and i It is an integer; LA i For the first set of damage levels i The damage level described; PA i For the first priority set of the first priority set i The aforementioned priority values; VA i For the first target value set, the first i The stated target value; RA i,l For the first actual consumption matrix, the first... i Line number l The element values ​​of the column; QA i,l For the first allowed consumption matrix, the i Line number l The element values ​​of the column; ta i The first discovery time set i The first discovery time mentioned above; tb i For the set of destruction times, the first i The moment of destruction described.

[0036] As an optional implementation, in the first aspect of the present invention, processing the non-closed damage information set, the kill chain execution information set, and the kill chain element information set to obtain a non-closed benefit set includes:

[0037] S431. Perform a second splitting process on the non-closed damage information set to obtain a second target value set, a second damage level set, a second priority set, and a second implementation node number set.

[0038] S432. Based on the first set of implementation node numbers, query the set of kill chain element information and the set of kill chain execution information to obtain the set of execution time, the second allowed consumption matrix and the second actual consumption matrix.

[0039] The execution time set includes M A subset of execution times; the subset of execution times includes the first execution time, the second execution time, the third execution time, the fourth execution time, the fifth execution time, and the sixth execution time;

[0040] Both the second allowed consumption matrix and the second actual consumption matrix include M Rows 6 columns;

[0041] S433. Using a non-closed kill chain benefit calculation model, process the execution time set, the second priority set, the second allowed consumption matrix, the second actual consumption matrix, the second damage level set, and the second target value set to obtain the non-closed benefit set.

[0042] As an optional implementation, in the first aspect of the present invention, the expression for the non-closed kill chain benefit calculation model is:

[0043]

[0044] In the formula, GB j The first of the non-closed benefit set j A non-closed benefit value, 1 ≤ j ≤ M and j It is an integer; tca j , tcb j , tcc j , tcd j and tce j The execution time set is respectively the first j The first execution time, the second execution time, the third execution time, the fourth execution time, and the fifth execution time of the aforementioned subset of execution times; NN j The number of times 0 is equal to the first execution time, the second execution time, the third execution time, the fourth execution time, and the fifth execution time; RB j,l For the second actual consumption matrix, the first j Line number l The element values ​​of the column; QB i,l For the second allowed consumption matrix, the first j Line number l The element values ​​of the column; LB j For the second set of damage levels j The damage level described; PB i For the second priority set of j The aforementioned priority values; VB j For the second target value set, the first j The stated target value; k l For the preset first l There are weighted coefficients, and k 1+ k 2+ k 3+ k 4+ k 5+ k 6 = 1.

[0045] A second aspect of this invention discloses a kill chain model construction and simulation evaluation device, the device comprising an information acquisition module, an adversarial simulation module, and a benefit evaluation module;

[0046] The information acquisition module is used to acquire a set of kill chain element information;

[0047] The adversarial simulation module is used to perform adversarial simulation processing based on the set of node entities and the set of kill chain element information to obtain a global damage information set and a kill chain execution information set.

[0048] The benefit evaluation module is used to evaluate the global damage information set, the kill chain execution information set, and the kill chain element information set to obtain the kill chain evaluation result.

[0049] A third aspect of this invention discloses another kill chain model construction and simulation evaluation apparatus, the apparatus comprising:

[0050] Memory containing executable program code;

[0051] A processor coupled to the memory;

[0052] The processor calls the executable program code stored in the memory to execute some or all of the steps in the kill chain model construction and simulation evaluation method disclosed in the first aspect of the present invention.

[0053] The fourth aspect of the present invention discloses a computer storage medium storing computer instructions, which, when invoked, are used to execute some or all of the steps in the kill chain model construction and simulation evaluation method disclosed in the first aspect of the present invention.

[0054] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0055] (1) By pre-setting a set of five types of node entities including detection, positioning, tracking, aiming and striking, and combining specific kill chain element information, a kill chain model corresponding to different needs can be accurately constructed.

[0056] (2) The kill chain is divided into closed and open categories for separate benefit calculation. For closed kill chains where the target is completely destroyed, the benefit is quantified by the benefit-cost ratio, reflecting the evaluation logic of "low consumption and high efficiency". For open kill chains where the target is not completely destroyed, the benefit is calculated by combining factors such as the number of completed stages, ammunition consumption, and damage level, so as to avoid ignoring the value of kill chains that "effectively weaken the target even if it is not destroyed". Through classification evaluation, the accuracy of kill chain benefit evaluation is improved, providing a scientific reference for the performance demonstration and iteration of equipment development, and improving the scientific nature of action decision-making.

[0057] (3) By standardizing the processing and comprehensive evaluation model, the two types of benefits are integrated to obtain a comprehensive benefit value, thereby achieving a comprehensive measurement of the overall performance of the kill chain. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 This is a flowchart illustrating a kill chain model construction and simulation evaluation method disclosed in an embodiment of the present invention.

[0060] Figure 2 This is a schematic diagram of the structure of a kill chain model construction and simulation evaluation device disclosed in an embodiment of the present invention.

[0061] Figure 3 This is a schematic diagram of another kill chain model construction and simulation evaluation device disclosed in an embodiment of the present invention. Detailed Implementation

[0062] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0064] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0065] Example 1

[0066] Please see Figure 1 . Figure 1 This is a flowchart illustrating a kill chain model construction and simulation evaluation method disclosed in an embodiment of the present invention. Figure 1 The described kill chain model construction and simulation evaluation method is applied to the field of scenario simulation, such as the simulation evaluation of military simulation scenarios. This invention does not limit its application to specific scenarios. Figure 1 As shown, the method includes:

[0067] S1. Preset set of node entities; the above set of node entities includes a subset of detection node entities, a subset of location node entities, a subset of tracking node entities, a subset of targeting node entities, a subset of attacking node entities, and a subset of evaluation node entities.

[0068] The aforementioned subset of detection node entities includes several detection node entities; the aforementioned subset of positioning node entities includes several positioning node entities; the aforementioned subset of tracking node entities includes several tracking node entities; the aforementioned subset of aiming node entities includes several aiming node entities; the aforementioned subset of strike node entities includes several strike node entities; and the aforementioned subset of evaluation node entities includes several evaluation node entities.

[0069] It should be noted that the above-mentioned detection node entities, positioning node entities, tracking node entities, aiming node entities, attack node entities and evaluation node entities are all constructed based on the model design tool of the adversarial simulation platform XSimStudio, and can all be run using the scenario operation tool of XSimStudio. Among them: (1) Detection node entities are platform entities equipped with sensors, such as reconnaissance satellites equipped with synthetic aperture radar, aircraft equipped with electronic reconnaissance devices, etc., which are used to interact with the real-time changing simulation environment according to the input mission information, conduct target reconnaissance, and output reconnaissance information and actual detection consumption after the target is detected (representing the value of resources such as fuel consumed during the reconnaissance process, and the sum of equipment wear value). The mission information includes reconnaissance type, reconnaissance range, reconnaissance distance, reconnaissance resolution, maximum reconnaissance speed and reconnaissance capability attenuation. The reconnaissance information includes the target's first detection time, preliminary location, preliminary type (such as aircraft) and preliminary identity (such as belonging to a certain red party). (2) Positioning node entities have the ability to quickly locate and identify targets within a large area where the initial location is located. For example, the detection module of a radar reconnaissance satellite is configured to cover the target area once every 30 minutes. Positioning node entities are used to interact with the real-time changing simulation environment based on the received reconnaissance information to locate targets. After the mission is completed, they output positioning information and actual positioning consumption (representing the value of resources consumed during the positioning process, plus the sum of equipment wear and tear). The positioning information includes the detailed location, detailed type (such as the specific model of the aircraft), and detailed identity (such as belonging to the Red Army's squad in a certain area). (3) Tracking node entities, such as ground phased array radar, have stronger continuous capability but smaller coverage area compared to positioning nodes. Therefore, they can continuously lock onto targets. They are used to interact with the real-time changing simulation environment based on the input positioning information to track targets. They output tracking information and actual tracking consumption (representing the value of resources consumed during the tracking process, plus the sum of equipment wear and tear). The tracking information includes the target's ID, real-time location, stable tracking duration, and target value. (4) Targeting node entities are used to interact with the real-time changing simulation environment based on the received tracking information, and automatically make decisions to generate strike plans and actual targeting consumption (representing the value of resources consumed during the targeting process, plus the sum of equipment wear and tear). The strike plan includes strike priority, strike time window, strike execution platform and strike method.(5) Strike node entities, such as artillery shells, missiles and other weapon systems, are used to automatically execute strike missions after receiving strike plans, interact with the real-time changing simulation environment according to the strike plan, physically strike targets in real time, and output strike information and actual strike consumption (representing the value of ammunition consumed during the strike process and the sum of equipment wear and tear) after the strike is completed. The strike information includes the implementation node number, ammunition type, launch time and ammunition landing point. The implementation node number is the number of the strike node entity that carried out this strike mission in the strike node entity subset. (6) Evaluation node entities, such as control rooms and the crowdless people they control for collecting battlefield images, are used to conduct battlefield evaluation after receiving strike information, and output damage information and actual evaluation consumption (representing the value of resources consumed during the battlefield evaluation process and the sum of equipment wear and tear). The damage information includes target value, damage level, priority value and destruction time.

[0070] It should be noted that the aforementioned adversarial simulation platform is XSimStudio. XSimStudio is based on multi-agent modeling and simulation methods, with object-oriented component-based modeling and parallel discrete event simulation technology at its core, supporting OODA process simulation. XSimStudio covers the entire lifecycle of the simulation system, providing comprehensive support in integration development, operation management, and resource services at each stage, including model preparation, scheme formulation, system operation, analysis and evaluation, and situation presentation. XSimStudio has a built-in general modeling system, providing a component-based modeling mechanism that supports secondary development of models and application software at different granularities. It can provide a series of complete solutions for the development, integration, and operation management of simulation systems at various levels and in various fields, including analysis and demonstration, simulation training, and experimental evaluation. XSimStudio is both a mature simulation application platform and a professional simulation development platform. As an application platform, XSimStudio provides a series of tools (including model design tools, state machine editing tools, model assembly tools, scenario editing tools, experiment design tools, scenario execution tools, operation management tools, situation display tools, etc.) covering pre-simulation, during-simulation, and post-simulation stages. Users can utilize existing resources to conduct research, demonstration, experimentation, and simulation training in their professional fields. As a development platform, XSimStudio provides an efficient simulation engine and a comprehensive modeling framework to support users in developing models and application systems.

[0071] S2. Obtain the kill chain element information set; the kill chain element information set includes P kill chain element information; the kill chain element information includes the detection node number, the positioning node number, the tracking node number, the aiming node number, the strike node number, the evaluation node number, the first allowed consumption matrix, the second allowed consumption matrix, the third allowed consumption matrix, the fourth allowed consumption matrix, the fifth allowed consumption matrix, and the sixth allowed consumption matrix; P is an integer greater than 1.

[0072] It should be noted that the above P kill chain element information corresponds to P kill chains respectively. The first allowed consumption matrix, the second allowed consumption matrix, the third allowed consumption matrix, the fourth allowed consumption matrix, the fifth allowed consumption matrix, and the sixth allowed consumption matrix represent the allowed consumption amount (i.e., the sum of the consumed resource value and the equipment wear value) of the detection node, location node, tracking node, aiming node, strike node, and evaluation node during the execution of the corresponding kill chain.

[0073] S3. Based on the above set of node entities and the above set of kill chain element information, perform adversarial simulation processing to obtain a global damage information set and a kill chain execution information set.

[0074] The aforementioned global damage information set includes P damage information items; the aforementioned damage information includes target value, damage level, priority value, destruction time, and implementation node number; the aforementioned damage level is an integer greater than 0 and less than T, where T is an integer greater than 1; the aforementioned target value is greater than 0.

[0075] It should be noted that the higher the damage level mentioned above, the greater the degree of damage to the corresponding target. When the damage level is 1, it means that the target is not damaged; when the damage level is T, it means that the target is completely destroyed.

[0076] The aforementioned kill chain execution information set includes P kill chain execution information; the aforementioned kill chain execution information includes the first detection time, the first actual consumption, the second actual consumption, the third actual consumption, the fourth actual consumption, the fifth actual consumption, the sixth actual consumption, the first execution time, the second execution time, the third execution time, the fourth execution time, the fifth execution time, and the sixth execution time.

[0077] S4. Evaluate and process the above-mentioned global damage information set, the above-mentioned kill chain execution information set, and the above-mentioned kill chain element information set to obtain the kill chain evaluation result; the above-mentioned kill chain evaluation result includes a closed benefit set, a non-closed benefit set, and a comprehensive benefit value.

[0078] The aforementioned closed benefit set includes several closed benefit values; the aforementioned non-closed benefit set includes several non-closed benefit values.

[0079] In an optional embodiment, the adversarial simulation processing is performed based on the aforementioned set of node entities and the aforementioned set of kill chain element information to obtain a global damage information set and a kill chain execution information set, including:

[0080] S31. Based on the above set of node entities and the above set of kill chain element information, a kill chain model set is constructed; the kill chain model set includes the kill chain model corresponding to each of the above kill chain information in the above kill chain information set.

[0081] S32. Perform parallel simulation processing on the above kill chain model set to obtain the above global damage information set and the above kill chain execution information set.

[0082] In another optional embodiment, the kill chain model set constructed based on the above-mentioned set of node entities and the above-mentioned set of kill chain element information includes:

[0083] S311. Initialize the above kill chain model set to an empty set.

[0084] S312. Set the current kill chain element information to any of the kill chain element information in the kill chain element information set; delete the current kill chain element information from the kill chain element information set.

[0085] S313. Set the first number ia, the second number ib, the third number ic, the fourth number id, the fifth number ie, and the sixth number if to the detection node number, location node number, tracking node number, aiming node number, strike node number, and evaluation node number of the above-mentioned current kill chain element information, respectively.

[0086] S314. Set the current probe node entity as the ia-th probe node entity in the subset of the above probe node entities;

[0087] Set the current location node entity to the ib-th location node entity in the above location node entity subset;

[0088] Set the current tracking node entity to the ic-th tracking node entity in the subset of the above tracking node entities;

[0089] Set the current target node entity to the id-th target node entity in the subset of the above target node entities;

[0090] Set the current attack node entity to the ie-th attack node entity in the subset of the above attack node entities;

[0091] Set the current evaluation node entity to the if-th evaluation node entity in the subset of the above evaluation node entities.

[0092] S315. Using the model assembly tool of XSimStudio, load the above-mentioned current detection node entity, the above-mentioned current positioning node entity, the above-mentioned current tracking node entity, the above-mentioned current aiming node entity, the above-mentioned current strike node entity, and the above-mentioned current evaluation node entity, and connect the above-mentioned current detection node entity, the above-mentioned current positioning node entity, the above-mentioned current tracking node entity, the above-mentioned current aiming node entity, the above-mentioned current strike node entity, and the above-mentioned current evaluation node entity in sequence to obtain the above-mentioned kill chain model.

[0093] S316. Add the above kill chain model to the above kill chain model set.

[0094] S317. Repeat S312~S316 until the above kill chain information set is empty.

[0095] In another optional embodiment, the parallel simulation processing of the aforementioned kill chain model set to obtain the aforementioned global damage information set and the aforementioned kill chain execution information set includes:

[0096] S321. Run the preset simulation environment.

[0097] S322. Simultaneously, kill chain simulation is performed on each of the kill chain models in the above kill chain model set to obtain the above damage information and the above kill chain execution information corresponding to each kill chain model.

[0098] S323. Combine all the above damage information to obtain the above global damage information set.

[0099] All the above kill chain execution information is combined to obtain the above kill chain execution information set.

[0100] It should be noted that the p-th damage information in the global damage information set and the p-th kill chain execution information in the kill chain execution information set both correspond to the p-th kill chain model, where p is an integer greater than 0 and less than P+1.

[0101] The aforementioned simulation environment provides the spatial boundaries, physical rules (such as gravity and electromagnetic laws), and external constraints (such as weather and resource limitations) for the activities of simulated entities, including those that detect, locate, track, aim at, attack, and evaluate node entities. This environment forms the basis for the behavior of these entities. Simulated entities, within the framework of the simulation environment, interact with it based on their own attributes (such as capabilities and roles) (e.g., moving due to terrain or communicating due to weather interference). They also react to the environment through interactions between entities (e.g., vehicles changing road conditions or equipment consuming environmental resources), ultimately presenting a dynamic process that conforms to the simulation objectives.

[0102] In another optional embodiment, the above-mentioned kill chain simulation is performed on each of the kill chain models in the kill chain model set to obtain the damage information and kill chain execution information corresponding to each kill chain model, including:

[0103] S3221. Set t0 to the current time.

[0104] S3222. Initialize the first actual consumption, the second actual consumption, the third actual consumption, the fourth actual consumption, the fifth actual consumption, the sixth actual consumption, the first execution time, the second execution time, the third execution time, the fourth execution time, the fifth execution time, and the sixth execution time in the above kill chain execution information to 0.

[0105] S3223. Based on the above kill chain model, generate corresponding reconnaissance information and damage information, and update the values ​​of the first actual consumption, the second actual consumption, the third actual consumption, the fourth actual consumption, the fifth actual consumption, the sixth actual consumption, the first execution time, the second execution time, the third execution time, the fourth execution time, the fifth execution time, and the sixth execution time in the above kill chain execution information.

[0106] S3224. The first discovery time, the first actual consumption, the second actual consumption, the third actual consumption, the fourth actual consumption, the fifth actual consumption, the sixth actual consumption, the first execution time, the second execution time, the third execution time, the fourth execution time, the fifth execution time, and the sixth execution time in the above reconnaissance information are combined to obtain the corresponding kill chain execution information.

[0107] In another optional embodiment, based on the kill chain model, reconnaissance information is generated, and the values ​​of the first actual consumption, the second actual consumption, the third actual consumption, the fourth actual consumption, the fifth actual consumption, the sixth actual consumption, the first execution time, the second execution time, the third execution time, the fourth execution time, the fifth execution time, and the sixth execution time are updated, including:

[0108] S32231. Using the aforementioned detection node entity, target reconnaissance is conducted based on preset task information to obtain reconnaissance information and actual detection consumption, and the value of the aforementioned first actual consumption is updated to the aforementioned actual detection consumption; t1 is set to the current time, and the value of the first execution time is updated to t1-t0;

[0109] The system determines whether t1-t0 is greater than the preset simulation duration and obtains the first determination result.

[0110] If the result of the first judgment above is yes, execute S3224;

[0111] If the result of the first judgment above is negative, execute S32232.

[0112] It should be noted that each kill chain model corresponds to one task information.

[0113] S32232, using the aforementioned positioning node entity, target positioning is performed based on the aforementioned reconnaissance information to obtain positioning information and actual positioning consumption, and the value of the aforementioned second actual consumption is updated to the aforementioned actual positioning consumption; t2 is set to the current time.

[0114] The second judgment result is obtained by judging whether t2-t0 is greater than the preset simulation time.

[0115] If the result of the second judgment above is yes, execute S3224;

[0116] If the result of the second judgment above is negative, execute S32233.

[0117] S32233, determine whether the above positioning information meets the preset tracking rules, and obtain the third judgment result;

[0118] When the result of the third judgment above is yes, update the value of the second execution time to t2-t1; execute S32234;

[0119] If the result of the third judgment above is negative, execute S32232.

[0120] S32234, using the aforementioned tracking node entity, target tracking is performed based on the aforementioned positioning information to obtain tracking information and actual tracking consumption, and the value of the aforementioned third actual consumption is updated to the aforementioned actual tracking consumption; t3 is set to the current time.

[0121] The fourth judgment result is obtained by judging whether t3-t0 is greater than the preset simulation time.

[0122] If the result of the fourth judgment above is yes, execute S3224;

[0123] If the result of the fourth judgment above is negative, execute S32235.

[0124] S32235, determine whether the above tracking information meets the preset aiming conditions, and obtain the fifth judgment result;

[0125] When the result of the fifth judgment above is yes, update the value of the third execution time to t3-t2; execute S32236;

[0126] If the result of the fifth judgment above is negative, execute S32234.

[0127] S32236, using the aforementioned targeting node entity, generate an attack plan and actual targeting consumption based on the aforementioned tracking information, and update the value of the aforementioned fourth actual consumption to the aforementioned actual targeting consumption; set t4 to the current time.

[0128] The sixth judgment result is obtained by judging whether t4-t0 is greater than the preset simulation time.

[0129] If the result of the sixth judgment above is yes, execute S3224;

[0130] If the result of the sixth judgment above is negative, execute S32237.

[0131] S32237, Determine whether the above strike plan meets the preset strike conditions, and obtain the seventh judgment result;

[0132] When the result of the seventh judgment above is yes, update the value of the fourth execution time to t4-t3; execute S32238;

[0133] If the result of the seventh judgment above is negative, execute S32236.

[0134] S32238, using the aforementioned strike node entity, carry out the strike based on the aforementioned strike plan, obtain the corresponding strike information and actual strike consumption, and update the value of the aforementioned fifth actual consumption to the aforementioned actual strike consumption; set t5 to the current time; update the value of the fifth execution time to t5-t4;

[0135] The system determines whether t5-t0 is greater than the preset simulation duration, and obtains the eighth determination result.

[0136] If the result of the eighth judgment above is yes, execute S3224;

[0137] If the result of the eighth judgment above is negative, execute S32239.

[0138] S32239, using the aforementioned evaluation node entity, conduct battlefield evaluation based on the aforementioned strike information to obtain the corresponding damage information and actual tracking consumption, and update the value of the aforementioned sixth actual consumption to the aforementioned actual tracking consumption; set t6 to the current time; update the value of the sixth execution time to t6-t5;

[0139] The ninth judgment result is obtained by judging whether t6-t0 is greater than the preset simulation time.

[0140] If the result of the ninth judgment above is yes, execute S3224;

[0141] If the result of the ninth judgment above is negative, execute S322310.

[0142] S322310, determine whether the above damage information meets the preset damage conditions, and obtain the tenth judgment result.

[0143] If the result of the tenth judgment above is yes, execute S3224;

[0144] If the result of the tenth judgment above is negative, execute S32238.

[0145] In another optional embodiment, the evaluation processing of the aforementioned global damage information set, the aforementioned kill chain execution information set, and the aforementioned kill chain element information set to obtain a kill chain evaluation result includes:

[0146] S41. Process the above-mentioned global damage information set and the above-mentioned kill chain execution information set to obtain a closed damage information set, a non-closed damage information set, a closed kill chain execution information set, and a non-closed kill chain execution information set.

[0147] The aforementioned set of closed damage information includes N The aforementioned damage information; the aforementioned set of non-closed damage information includes M The above-mentioned damage information.

[0148] The aforementioned closed kill chain execution information set includes N The aforementioned kill chain execution information; the aforementioned set of non-closed kill chain execution information, including M The above-mentioned kill chain execution information.

[0149] N and M All are non-negative integers.

[0150] S42. Process the above-mentioned closed damage information set, the above-mentioned kill chain execution information set, and the above-mentioned kill chain element information set to obtain a closed benefit set.

[0151] S43. Process the above-mentioned non-closed damage information set, the above-mentioned kill chain execution information set, and the above-mentioned kill chain element information set to obtain a non-closed benefit set.

[0152] S44. Process the above closed benefit set and the above non-closed benefit set to obtain the above comprehensive benefit value.

[0153] In another optional embodiment, the above-mentioned processing of the global damage information set and the kill chain execution information set to obtain a closed damage information set, a non-closed damage information set, a closed kill chain execution information set, and a non-closed kill chain execution information set includes:

[0154] S411. Take all the damage information with damage level equal to T from the above global damage information set and combine them in sequence to obtain the above closed damage information set.

[0155] The above-mentioned non-closed damage information set is obtained by sequentially combining all damage information with damage level less than T from the above global damage information set.

[0156] S412. Combine all the above-mentioned implementation node numbers of the above-mentioned closed damage information set in sequence to obtain a closed node number set.

[0157] The non-closed node number set is obtained by sequentially combining all the above-mentioned implementation node numbers of the non-closed damage information set.

[0158] S413. The above-mentioned kill chain execution information that corresponds to the above-mentioned strike node number belonging to the above-mentioned closed node number set in the above-mentioned kill chain execution information set is sequentially combined to obtain the above-mentioned closed kill chain execution information set.

[0159] The aforementioned kill chain execution information set is obtained by sequentially combining all the aforementioned kill chain execution information whose corresponding strike node numbers belong to the aforementioned non-closed node number set.

[0160] In another optional embodiment, the above-mentioned processing of the closed damage information set, the kill chain execution information set, and the kill chain element information set to obtain a closed benefit set includes:

[0161] S421. Perform a first splitting process on the above closed damage information set to obtain a first target value set, a first damage level set, a first priority set, a destruction time set, and a first implementation node number set.

[0162] It should be noted that in the first target value set, first damage level set, first priority set, destruction time set, and first implementation node number set after the first split, the target value, damage level, priority value, destruction time, and implementation node number of sequence number ii are all obtained by splitting the ii-th damage information in the closed damage information set, where 1 ≤ ii ≤ N And ii is an integer.

[0163] S422. Based on the above-mentioned first implementation node number set, query and process the above-mentioned kill chain element information set and the above-mentioned kill chain execution information set to obtain the first discovery time set, the first allowed consumption matrix and the first actual consumption matrix.

[0164] Both the aforementioned first allowed consumption matrix and the aforementioned first actual consumption matrix include N Rows 6 columns.

[0165] S423. Using the closed kill chain benefit calculation model, the above-mentioned first damage level set, the above-mentioned first priority set, the above-mentioned first target value set, the above-mentioned first actual consumption matrix, the above-mentioned first allowed consumption matrix, the above-mentioned destruction time set, and the above-mentioned first discovery time set are processed to obtain the above-mentioned closed benefit set.

[0166] In another optional embodiment, based on the first set of implementation node numbers, the above-mentioned kill chain element information set and kill chain execution information set are queried to obtain the first discovery time set, the first allowed consumption matrix, and the first actual consumption matrix, including:

[0167] S4221. Initialize the aforementioned set of first discovery times to an empty set; randomly initialize the aforementioned first allowed consumption matrix and the aforementioned first actual consumption matrix to... N A 6×6 matrix; initialize the value of ja for the first loop iteration to 1.

[0168] S4222. Set the first number ka to the ja-th implementation node number in the first implementation node number set.

[0169] S4223. Set the second number kb to the sequence number of the kill chain element information in the above kill chain element information set, where the corresponding strike node number is equal to ka.

[0170] S4224. The six elements in row ja of the first allowed consumption matrix are sequentially set to the first allowed consumption amount, second allowed consumption amount, third allowed consumption amount, fourth allowed consumption amount, fifth allowed consumption amount and sixth allowed consumption amount of the kill chain element information numbered kb in the kill chain element information set.

[0171] The six elements in row ja of the first actual consumption matrix are sequentially set to the first, second, third, fourth, fifth, and sixth actual consumption values ​​of the kill chain execution information at the kb-th rank in the kill chain execution information set.

[0172] S4225. Insert the first discovery time of the kb-th kill chain execution information in the above kill chain execution information set into the end of the above first discovery time set.

[0173] S4226. Increment the value of ja by 1.

[0174] S4227, Repeat S4222~S4226 until ja is greater than N .

[0175] In yet another optional embodiment, the expression for the above closed kill chain benefit calculation model is:

[0176]

[0177] In the formula, GA i The first of the above closed benefit sets i For each of the above closed-loop benefit values, 1 ≤ i ≤ N and i It is an integer; LA i The first damage level set mentioned above is the [number]th i The above-mentioned damage levels; PA i For the first priority set mentioned above, the first i The aforementioned priority values; VA i For the first set of target values ​​mentioned above, the first... i The aforementioned target values; RA i,l For the first actual consumption matrix mentioned above, the... i Line number l The element values ​​of the column; QA i,l For the first allowed consumption matrix mentioned above, the... i Line number l The element values ​​of the column; ta iFor the set of first discovery times mentioned above, the first i The aforementioned first discovery moments; tb i For the set of destruction moments mentioned above, the first... i The aforementioned moments of destruction.

[0178] It should be noted that on the right side of the expression of the above closed kill chain benefit calculation model, the numerator and denominator represent the benefits and costs of the corresponding kill chain, respectively. The benefit of the closed kill chain is quantified by the ratio of benefits to costs. The higher the ratio, the better the kill chain performs in "destroying high-value targets with lower resource consumption and time cost".

[0179] In another optional embodiment, the above-mentioned processing of the non-closed damage information set, the kill chain execution information set, and the kill chain element information set yields a non-closed benefit set, including:

[0180] S431. Perform a second splitting process on the above non-closed damage information set to obtain a second target value set, a second damage level set, a second priority set, and a second implementation node number set.

[0181] It should be noted that in the second target value set, second damage level set, second priority set, and second implementation node number set after the second split, the target value, damage level, priority value, and implementation node number with sequence number jj are all obtained by splitting the jj-th damage information in the non-closed damage information set, where 1 ≤ jj ≤ M And jj is an integer.

[0182] S432. Based on the first set of implementation node numbers, query the kill chain element information set and the kill chain execution information set to obtain the execution time set, the second allowed consumption matrix, and the second actual consumption matrix.

[0183] The above execution time set includes M A subset of execution times; the aforementioned subset of execution times includes the aforementioned first execution time, the aforementioned second execution time, the aforementioned third execution time, the aforementioned fourth execution time, the aforementioned fifth execution time, and the aforementioned sixth execution time.

[0184] Both the aforementioned second allowed consumption matrix and the aforementioned second actual consumption matrix include M Rows 6 columns.

[0185] S433. Using the non-closed kill chain benefit calculation model, the above-mentioned execution time set, the above-mentioned second priority set, the above-mentioned second allowed consumption matrix, the above-mentioned second actual consumption matrix, the above-mentioned second damage level set, and the above-mentioned second target value set are processed to obtain the above-mentioned non-closed benefit set.

[0186] In another optional embodiment, based on the first set of implementation node numbers, the above-mentioned kill chain element information set and kill chain execution information set are queried to obtain an execution time set, a second allowed consumption matrix, and a second actual consumption matrix, including:

[0187] S4321. Initialize the above execution time set to an empty set; randomly initialize the above second allowed consumption matrix and the above second actual consumption matrix to... M A 6×6 matrix; initialize the value of the second loop count jb to 1.

[0188] S4322. Set the third number kc to the jb-th implementation node number in the second implementation node number set.

[0189] S4323. Set the fourth number kd as the sequence number in the above-mentioned kill chain element information set of the kill chain element information corresponding to the strike node number equal to kc.

[0190] S4324. The six elements of the jb-th row of the second allowed consumption matrix are sequentially set to the first allowed consumption amount, second allowed consumption amount, third allowed consumption amount, fourth allowed consumption amount, fifth allowed consumption amount and sixth allowed consumption amount of the kill chain element information numbered kd in the kill chain element information set.

[0191] The six elements in row jb of the second actual consumption matrix are sequentially set to the first, second, third, fourth, fifth, and sixth actual consumption values ​​of the kill chain execution information in the set of kill chain execution information.

[0192] S4325. Combine the first, second, third, fourth, fifth, and sixth execution times of the kd-th kill chain execution information in the above kill chain execution information set to obtain the above execution time subset.

[0193] Insert the aforementioned subset of execution times at the end of the aforementioned set of execution times.

[0194] S4326. Increment the value of jb by 1.

[0195] S4327. Repeat S4322~S3226 until the set of the second implementation node numbers is empty.

[0196] In yet another optional embodiment, the expression for the above-described non-closed kill chain benefit calculation model is:

[0197]

[0198] In the formula, GB j For the above non-closed benefit set, the first j A non-closed benefit value, 1 ≤ j ≤ M and j It is an integer; tca j , tcb j , tcc j , tcd j and tce j These are the first execution times in the above execution time set. j The first execution time, the second execution time, the third execution time, the fourth execution time, and the fifth execution time of the aforementioned subset of execution times; NN j The number of times that are equal to 0 among the first execution time, the second execution time, the third execution time, the fourth execution time, and the fifth execution time mentioned above; RB j,l For the second actual consumption matrix mentioned above, the first... j Line number l The element values ​​of the column; QB i,l For the second allowed consumption matrix mentioned above j Line number l The element values ​​of the column; LB j The second damage level set mentioned above is the first j The above-mentioned damage levels; PB i For the second priority set mentioned above, the first j The aforementioned priority values; VB j For the second set of objective values ​​mentioned above, the first j The aforementioned target values; k l For the preset first l There are weighted coefficients, and k 1+ k 2+ k 3+ k 4+k 5+ k 6 = 1.

[0199] Optionally, the above k 1. k 2. k 3. k 4. k 5 and k 6 is 1 / 6.

[0200] It should be noted that the above NN j This indicates the number of stages that have been completed in the corresponding kill chain. For example, if the corresponding kill chain execution model has only completed detection and location, and has not yet performed tracking, aiming, attacking, and battlefield assessment, then the first execution time and the second execution time mentioned above are non-zero values, while the third, fourth, fifth, and sixth execution times are all 0. NN j The value is 2, meaning only two stages were completed.

[0201] It should be noted that the exponent term on the right-hand side of the above non-closed kill chain benefit calculation model is always less than 1. This ensures that the non-closed benefit value corresponding to a kill chain with more completed stages is always higher than that corresponding to a kill chain with fewer completed stages. Furthermore, for kill chains with the same number of completed stages, the larger the cost-to-benefit ratio, the smaller the corresponding exponent term. Therefore, it is possible to quantitatively compare the benefit values ​​of kill chains with the same number of completed stages.

[0202] It is evident that in the above non-closed kill chain benefit calculation model, even if the target is not completely destroyed, if as many stages as possible can be completed and high damage can be achieved with low ammunition consumption and short total execution time, high benefits can still be obtained. This model can be used to evaluate the value of a kill chain that "effectively weakens the target even if it is not completely destroyed", and provides a quantitative basis for mission decisions that prioritize weakening high-value targets when resources are limited.

[0203] In another optional embodiment, the above-mentioned processing of the closed benefit set and the non-closed benefit set to obtain the above-mentioned comprehensive benefit value includes:

[0204] S441. Standardize the above closed benefit set and the above non-closed benefit set respectively to obtain the standardized closed benefit set and the standardized non-closed benefit set.

[0205] The above-mentioned standardized closed-loop benefit set includes N A standardized closed-loop benefit value; the above-mentioned standardized non-closed-loop benefit set includes M A standardized non-closed benefit value.

[0206] Preferably, the above standardization process uses the Min-Max standardization method.

[0207] S442. Using the comprehensive benefit calculation model, process the above-mentioned standardized closed benefit set and the above-mentioned standardized non-closed benefit set, wherein the expression of the comprehensive benefit calculation model is:

[0208]

[0209] In the formula, δ i Indicates the first i The delayed penalty factor for a closed kill chain. ts The preset standard completion time; GC The above is the comprehensive benefit value; GAS i The first of the above standardized closed-loop benefit sets i A standardized closed-loop benefit value; GBS j For the above standardized non-closed benefit set, the first... j A standardized non-closed benefit value; α The fusion coefficient is a preset value, and 0 < α <1.

[0210] It should be noted that the above standard completion time needs to be set based on the historical task completion data, such as setting it to the average completion time of similar tasks, such as 30 minutes.

[0211] Preferably, α It is 0.7.

[0212] As can be seen, the kill chain model construction and simulation evaluation method described in the embodiments of the present invention can be implemented as follows:

[0213] (1) By pre-setting a set of five types of node entities including detection, positioning, tracking, aiming and striking, and combining specific kill chain element information, a kill chain model corresponding to different needs can be accurately constructed.

[0214] (2) The kill chain is divided into closed and open categories for separate benefit calculation. For closed kill chains where the target is completely destroyed, the benefit is quantified by the benefit-cost ratio, reflecting the evaluation logic of "low consumption and high efficiency". For open kill chains where the target is not completely destroyed, the benefit is calculated by combining factors such as the number of completed stages, ammunition consumption, and damage level, so as to avoid ignoring the value of kill chains that "effectively weaken the target even if it is not destroyed". Through classification evaluation, the accuracy of kill chain benefit evaluation is improved, providing a scientific reference for the performance demonstration and iteration of equipment development, and improving the scientific nature of action decision-making.

[0215] (3) By standardizing the processing and comprehensive evaluation model, the two types of benefits are integrated to obtain a comprehensive benefit value, thereby achieving a comprehensive measurement of the overall performance of the kill chain.

[0216] Example 2

[0217] Please see Figure 2 , Figure 2 This is a schematic diagram of a kill chain model construction and simulation evaluation device disclosed in an embodiment of the present invention. Figure 2 The described kill chain model construction and simulation evaluation device can be applied to the field of scenario simulation, such as the simulation evaluation of military simulation scenarios. This invention does not limit its application. Figure 2 As shown, the device may include an information acquisition module 201, an adversarial simulation module 202, and a benefit evaluation module 203.

[0218] The aforementioned information acquisition module 201 is used to acquire a set of kill chain element information;

[0219] The aforementioned adversarial simulation module 202 is used to perform adversarial simulation processing based on the aforementioned set of node entities and the aforementioned set of kill chain element information to obtain a global damage information set and a kill chain execution information set.

[0220] The aforementioned benefit evaluation module 203 is used to evaluate and process the aforementioned global damage information set, the aforementioned kill chain execution information set, and the aforementioned kill chain element information set to obtain the kill chain evaluation result.

[0221] As can be seen, the kill chain model construction and simulation evaluation device described in the embodiments of the present invention can perform deep reasoning on high-level natural language intent in combination with domain knowledge, and automatically generate standardized and executable optimal simulation scenarios and corresponding evaluation values.

[0222] Example 3

[0223] Please see Figure 3 , Figure 3 This is a schematic diagram of another kill chain model construction and simulation evaluation device disclosed in an embodiment of the present invention. Figure 3 The described kill chain model construction and simulation evaluation device can be applied to the field of scenario simulation, such as the simulation evaluation of military simulation scenarios. This invention does not limit its application. Figure 3 As shown, the kill chain model construction and simulation evaluation device may include the following parts:

[0224] Memory 301 storing executable program code;

[0225] Processor 302 coupled to memory 301;

[0226] The processor 302 calls the executable program code stored in the memory 301 to execute the steps in the kill chain model construction and simulation evaluation method described in Embodiment 1.

[0227] Example 4

[0228] This invention discloses a computer read storage medium that stores a computer program for electronic data interchange, wherein the computer program causes a computer to execute the steps in the kill chain model construction and simulation evaluation method described in Embodiment 1.

[0229] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0230] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-Erasable Programmable Read-Only Memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0231] Finally, it should be noted that the kill chain model construction and simulation evaluation method and apparatus disclosed in the embodiments of the present invention are merely preferred embodiments of the present invention, and are only used to illustrate the technical solutions of the present invention, not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for constructing and simulating a kill chain model, characterized in that, include: S1, Preset set of node entities; The set of node entities includes a subset of detection node entities, a subset of location node entities, a subset of tracking node entities, a subset of targeting node entities, a subset of attacking node entities, and a subset of evaluation node entities; The subset of detection node entities includes several detection node entities; the subset of positioning node entities includes several positioning node entities; the subset of tracking node entities includes several tracking node entities; the subset of aiming node entities includes several aiming node entities; the subset of attack node entities includes several attack node entities; and the subset of evaluation node entities includes several evaluation node entities. S2. Obtain a kill chain element information set; the kill chain element information set includes P kill chain element information; the kill chain element information includes detection node number, positioning node number, tracking node number, aiming node number, strike node number, evaluation node number, first allowed consumption matrix, second allowed consumption matrix, third allowed consumption matrix, fourth allowed consumption matrix, fifth allowed consumption matrix, and sixth allowed consumption matrix; P is an integer greater than 1; The first allowed consumption matrix, the second allowed consumption matrix, the third allowed consumption matrix, the fourth allowed consumption matrix, the fifth allowed consumption matrix, and the sixth allowed consumption matrix represent the allowed consumption amount of the detection node entity, the positioning node entity, the tracking node entity, the aiming node entity, the strike node entity, and the evaluation node entity during the execution of the corresponding kill chain, respectively. S3. Based on the set of node entities and the set of kill chain element information, perform adversarial simulation processing to obtain a global damage information set and a kill chain execution information set; The global damage information set includes P damage information items; the damage information includes target value, damage level, priority value, destruction time, and implementation node number; the damage level is an integer greater than 0 and less than T, where T is an integer greater than 1; The kill chain execution information set includes P kill chain execution information pieces; the kill chain execution information includes the first detection time, the first actual consumption, the second actual consumption, the third actual consumption, the fourth actual consumption, the fifth actual consumption, the sixth actual consumption, the first execution time, the second execution time, the third execution time, the fourth execution time, the fifth execution time, and the sixth execution time. The first actual consumption and the first execution time represent the actual detection consumption and actual execution time of the detection node entity, respectively. The second actual consumption and the second execution time represent the actual positioning consumption and actual execution time of the positioning node entity, respectively. The third actual consumption and the third execution time represent the actual tracking consumption and actual execution time of the tracking node entity, respectively. The fourth actual consumption and the fourth execution time represent the actual aiming consumption and actual execution time of the aiming node entity, respectively. The fifth actual consumption and the fifth execution time represent the actual attack consumption and actual execution time of the attack node entity, respectively. The sixth actual consumption and the sixth execution time represent the actual evaluation consumption and actual execution time of the evaluation node entity, respectively. S4. Evaluate the global damage information set, the kill chain execution information set, and the kill chain element information set to obtain the kill chain evaluation result.

2. The kill chain model construction and simulation evaluation method according to claim 1, characterized in that, The adversarial simulation processing, based on the set of node entities and the set of kill chain element information, yields a global damage information set and a kill chain execution information set, including: S31, Based on the set of node entities and the set of kill chain element information, a kill chain model set is constructed; the kill chain model set includes a kill chain model corresponding to each kill chain information in the kill chain information set; S32. Perform parallel simulation processing on the kill chain model set to obtain the global damage information set and the kill chain execution information set.

3. The kill chain model construction and simulation evaluation method according to claim 1, characterized in that, The kill chain evaluation results include closed benefit sets, non-closed benefit sets, and comprehensive benefit values; The evaluation process of the global damage information set, the kill chain execution information set, and the kill chain element information set to obtain the kill chain evaluation result includes: S41. Process the global damage information set and the kill chain execution information set to obtain a closed damage information set, a non-closed damage information set, a closed kill chain execution information set, and a non-closed kill chain execution information set; The closed damage information set includes N The damage information; the non-closed damage information set includes M The damage information described above; The closed kill chain execution information set includes N The kill chain execution information set includes: [the set of] kill chain execution information; [the set of] non-closed kill chain execution information. M The kill chain execution information described above; N and M All are non-negative integers; S42. Process the closed damage information set, the kill chain execution information set, and the kill chain element information set to obtain a closed benefit set; S43. Process the non-closed damage information set, the kill chain execution information set, and the kill chain element information set to obtain a non-closed benefit set; S44. Process the closed benefit set and the non-closed benefit set to obtain the comprehensive benefit value.

4. The kill chain model construction and simulation evaluation method according to claim 3, characterized in that, The process of processing the closed damage information set, the kill chain execution information set, and the kill chain element information set to obtain a closed benefit set includes: S421. Perform a first splitting process on the closed damage information set to obtain a first target value set, a first damage level set, a first priority set, a destruction time set, and a first implementation node number set; S422. Based on the first set of implementation node numbers, query the set of kill chain element information and the set of kill chain execution information to obtain the set of first discovery times, the first allowed consumption matrix and the first actual consumption matrix. Both the first allowed consumption matrix and the first actual consumption matrix include N Rows 6 columns; S423. Using a closed kill chain benefit calculation model, process the first damage level set, the first priority set, the first target value set, the first actual consumption matrix, the first allowed consumption matrix, the destruction time set, and the first discovery time set to obtain the closed benefit set.

5. The kill chain model construction and simulation evaluation method according to claim 4, characterized in that, The expression for the closed kill chain benefit calculation model is as follows: In the formula, Let i be the i-th closed-loop benefit value of the closed-loop benefit set, where 1 ≤ i ≤ N and i is an integer; The damage level is the i-th damage level in the first set of damage levels; The priority value is the i-th priority value in the first priority set; The i-th target value in the first target value set; The value of the element in the i-th row and l-th column of the first actual consumption matrix; Let be the value of the element in the i-th row and l-th column of the first allowed consumption matrix; The first discovery time is the i-th of the set of first discovery times; The i-th destruction moment in the set of destruction moments.

6. The kill chain model construction and simulation evaluation method according to claim 4, characterized in that, The process of processing the non-closed damage information set, the kill chain execution information set, and the kill chain element information set to obtain a non-closed benefit set includes: S431. Perform a second splitting process on the non-closed damage information set to obtain a second target value set, a second damage level set, a second priority set, and a second implementation node number set. S432. Based on the first set of implementation node numbers, query the set of kill chain element information and the set of kill chain execution information to obtain the execution time set, the second allowed consumption matrix and the second actual consumption matrix. The execution time set includes M A subset of execution times; the subset of execution times includes the first execution time, the second execution time, the third execution time, the fourth execution time, the fifth execution time, and the sixth execution time; Both the second allowed consumption matrix and the second actual consumption matrix include M Rows 6 columns; S433. Using a non-closed kill chain benefit calculation model, process the execution time set, the second priority set, the second allowed consumption matrix, the second actual consumption matrix, the second damage level set, and the second target value set to obtain the non-closed benefit set.

7. The kill chain model construction and simulation evaluation method according to claim 6, characterized in that, The expression for the non-closed kill chain benefit calculation model is as follows: In the formula, Let j be the j-th non-closed benefit value of the non-closed benefit set, where 1 ≤ j ≤ M and j is an integer; , , , and These are the first execution time, the second execution time, the third execution time, the fourth execution time, and the fifth execution time of the j-th subset of execution times in the set of execution times, respectively. The number of times 0 is equal to the first execution time, the second execution time, the third execution time, the fourth execution time, and the fifth execution time; This is the value of the element in the j-th row and l-th column of the second actual consumption matrix; Let be the value of the element in the j-th row and l-th column of the second allowed consumption matrix; The damage level is the j-th damage level in the second set of damage levels; It is the j-th priority value in the second priority set; The j-th target value in the second target value set; Let l be the preset weighting coefficient, and =1.

8. A kill chain model construction and simulation evaluation device, characterized in that, The device includes an information acquisition module, an adversarial simulation module, and a benefit evaluation module; the device is implemented based on the kill chain model construction and simulation evaluation method as described in any one of claims 1 to 7. The information acquisition module is used to acquire a set of kill chain element information; The adversarial simulation module is used to perform adversarial simulation processing based on the set of node entities and the set of kill chain element information to obtain a global damage information set and a kill chain execution information set. The benefit evaluation module is used to evaluate the global damage information set, the kill chain execution information set, and the kill chain element information set to obtain the kill chain evaluation result.

9. A kill chain model construction and simulation evaluation device, characterized in that, The device includes: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the kill chain model construction and simulation evaluation method as described in any one of claims 1-7.

10. A computer-storable medium, characterized in that, The computer storage medium stores computer instructions, which, when invoked, are used to execute the kill chain model construction and simulation evaluation method as described in any one of claims 1-7.

Images