Network elasticity index detection method and nonvolatile storage medium

Abstract

The invention discloses a network elasticity index detection method and a nonvolatile storage medium. The method comprises the following steps: acquiring a plurality of initial detection results of a target network elasticity index of a to-be-detected network system; based on the plurality of initial detection results, respectively calculating a plurality of initial basic probability distributions; calculating a plurality of average conflict factors based on the plurality of initial basic probability distributions; under the condition that the average conflict factor is greater than a preset overall conflict threshold value, performing discount processing on the plurality of initial basic probability distributions to obtain a plurality of target basic probability distributions; fusing the plurality of target basic probability distributions to obtain fused basic probability distributions corresponding to the target network elasticity indexes; and based on the fusion basic probability distribution, determining a target detection result of the target network elasticity index. According to the method and the device, the technical problem of low detection accuracy and reliability caused by isomerism and conflict of a multi-source evaluation result in the current network elasticity evaluation is solved.

Description

Technical Field

[0001] This invention relates to the field of network security assessment technology, and more specifically, to a method for detecting network resilience indicators and a non-volatile storage medium. Background Technology

[0002] In the rapid evolution of current network technologies, network systems face increasingly complex and diverse security threats, leading to a growing demand for accurate assessments of network resilience. Network resilience, as a key indicator measuring a network system's ability to prevent, withstand, recover from, and adapt to disturbances such as attacks, failures, and natural disasters, directly impacts the secure and stable operation of the network system and the reliability of critical services. Currently, network resilience assessments typically rely on various tools. These tools may be based on different technical principles, applicable to different scenarios, and their outputs may contain noise. When different assessment tools are executed, due to differences in their inherent principles, scenario limitations, data noise, and the fault tolerance of the tools themselves, the resulting assessment results often exhibit heterogeneity, uncertainty, and conflict, posing challenges to the decision-making and integration of network resilience assessments.

[0003] To address the challenge of multi-source data fusion in network resilience assessment, current fusion methods, while capable of integrating multi-source information to some extent, primarily target scenarios where tools have completely independent characteristics. They neglect overlaps and conflicts between assessment tools, generally assuming that the outputs of each tool are independent and have equal reliability. For example, when evaluating "system fatigue resistance," one tool might collect system response latency based on high-precision metrics, while another estimates performance based solely on lightweight heartbeat detection. The former's historical accuracy is higher than the latter's. If both are given equal weight during fusion, the assessment results will be severely distorted by the less reliable tool, leading to a decrease in accuracy.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a method for detecting network resilience indicators and a non-volatile storage medium, to at least solve the technical problem of low detection accuracy and reliability caused by heterogeneity and conflict in current network resilience assessments of multi-source assessment results.

[0006] According to one aspect of the present invention, a method for detecting a network resilience index is provided, comprising: acquiring multiple initial detection results of a target network resilience index of a network system to be detected, wherein the initial detection results include compliant or non-compliant, and each initial detection result corresponds to a network resilience assessment tool; calculating multiple initial basic probability distributions based on the multiple initial detection results, wherein each initial basic probability distribution corresponds to a network resilience assessment tool, and the initial basic probability distribution characterizes the degree of trust in the initial detection results; calculating an average conflict factor of the multiple network resilience assessment tools based on the multiple initial basic probability distributions, wherein the average conflict factor characterizes the overall conflict degree of the multiple network resilience assessment tools; when the average conflict factor is greater than a preset overall conflict threshold, discounting the multiple initial basic probability distributions based on a preset discount coefficient to obtain multiple target basic probability distributions; fusing the multiple target basic probability distributions to obtain a fused basic probability distribution corresponding to the target network resilience index; and determining the target detection result of the target network resilience index based on the fused basic probability distribution.

[0007] Optionally, based on multiple initial detection results, multiple initial basic probability distributions are calculated, including: acquiring multiple historical detection data for each of the multiple network resilience assessment tools, wherein the historical detection data is in triplet form and includes indicator type, tool detection result, and actual indicator status; determining multiple performance indicators for each of the multiple network resilience assessment tools based on the multiple historical detection data for each of the multiple network resilience assessment tools, wherein the performance indicators characterize the comparison between the tool detection result and the actual indicator status, and the multiple performance indicators include true positive indicators, true negative indicators, false positive indicators, and false negative indicators; calculating the credibility weights for each of the multiple network resilience assessment tools based on the multiple performance indicators for each of the multiple network resilience assessment tools; determining multiple original basic probability distributions based on the multiple initial detection results and the multiple performance indicators for each of the multiple network resilience assessment tools; and calibrating the multiple original basic probability distributions based on the credibility weights for each of the multiple network resilience assessment tools to obtain multiple initial basic probability distributions.

[0008] Optionally, based on multiple initial detection results and multiple performance indicators of each of the multiple network resilience assessment tools, multiple original basic probability distributions are determined, including: calculating the true positive rate of each of the multiple network resilience assessment tools based on their respective true positive and false positive indicators; calculating the true negative rate of each of the multiple network resilience assessment tools based on their respective true negative and false negative indicators; determining the probability distribution calculation method corresponding to each of the multiple initial detection results; and calculating multiple original basic probability distributions based on the probability distribution calculation method corresponding to each of the multiple initial detection results, the true positive rate of each of the multiple network resilience assessment tools, and the true negative rate of each of the multiple network resilience assessment tools.

[0009] Optionally, based on multiple performance metrics of each of the multiple network resilience assessment tools, the credibility weights of each of the multiple network resilience assessment tools are calculated, including: calculating the precision of each of the multiple network resilience assessment tools based on their respective true positive and false positive metrics; calculating the recall of each of the multiple network resilience assessment tools based on their respective true positive and false negative metrics; and calculating the credibility weights of each of the multiple network resilience assessment tools based on their respective precision and recall.

[0010] Optionally, based on multiple initial basic probability distributions, the average conflict factor of multiple network resilience assessment tools is calculated, including: based on multiple initial basic probability distributions, calculating the conflict factor between any two network resilience assessment tools to obtain multiple initial conflict factors; and calculating the average conflict factor based on the multiple initial conflict factors and the credibility weights of the multiple network resilience assessment tools.

[0011] Optionally, before calculating the average conflict factor of multiple network resilience assessment tools based on multiple initial basic probability distributions, the process includes: calculating the conflict factor between any two network resilience assessment tools based on multiple initial basic probability distributions to obtain multiple initial conflict factors; determining the target conflict factor among the multiple initial conflict factors that exceeds a preset local conflict threshold; determining the network resilience assessment tool with the lower credibility weight among the two network resilience assessment tools corresponding to the target conflict factor as the network resilience assessment tool to be processed; and discounting the initial basic probability distribution corresponding to the network resilience assessment tool to be processed to obtain a new initial basic probability distribution.

[0012] Optionally, based on the fusion of the basic probability distribution, the target detection result of the target network resilience index is determined. Where the fusion of the basic probability distribution includes a first proposition confidence level, a second proposition confidence level, and a third proposition confidence level, and the first proposition is a compliant proposition, the second proposition is a non-compliant proposition, and the third proposition is an uncertain proposition, the determination includes: if the first proposition confidence level is not less than a first preset confidence level threshold and the difference between the first proposition confidence level and the second proposition confidence level is greater than a first preset gap threshold, the target detection result is determined to be compliant; or if the second proposition confidence level is not less than the first preset confidence level threshold and the difference between the second proposition confidence level and the first proposition confidence level is greater than a first preset gap threshold, the target detection result is determined to be non-compliant; or if the first proposition confidence level is not less than the second preset confidence level threshold, the first proposition confidence level is less than the first preset confidence level threshold, and so on. If the confidence level of the first proposition is greater than that of the second proposition and the confidence level of the third proposition is less than the preset tolerance threshold, the target detection result is determined to be "prone to meeting the standard"; or if the confidence level of the second proposition is not less than the second preset confidence threshold, the confidence level of the second proposition is less than the first preset confidence threshold, the confidence level of the second proposition is greater than that of the first proposition and the confidence level of the third proposition is less than the preset tolerance threshold, the target detection result is determined to be "prone to not meeting the standard"; or if the confidence level of the first proposition is less than that of the second preset confidence threshold and the confidence level of the second proposition is less than the second preset confidence threshold, the target detection result is determined to be "uncertain"; or if the difference between the confidence level of the first proposition and the confidence level of the second proposition is less than the second preset gap threshold, the target detection result is determined to be "uncertain"; or if the confidence level of the third proposition is not less than the preset tolerance threshold, the target detection result is determined to be "uncertain".

[0013] According to another aspect of the present invention, a non-volatile storage medium is also provided, the non-volatile storage medium including a stored program, wherein, when the program is running, the device where the non-volatile storage medium is located is controlled to execute any of the above-described network resilience index detection methods.

[0014] According to another aspect of the present invention, a computer device is also provided, the computer device including a processor, the processor being configured to run a program, wherein the program executes any of the above-described methods for detecting network resilience indicators.

[0015] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements a method for detecting any of the above-described network resilience indicators.

[0016] In this embodiment of the invention, a network resilience index detection method is employed. This involves acquiring multiple initial detection results of the target network resilience index for the network system under test. Each initial detection result is either compliant or non-compliant, and each initial detection result corresponds to a network resilience assessment tool. Based on these multiple initial detection results, multiple initial basic probability distributions are calculated. Each initial basic probability distribution corresponds to a network resilience assessment tool, and the initial basic probability distribution represents the degree of trust in the initial detection results. Based on these multiple initial basic probability distributions, an average conflict factor is calculated for the multiple network resilience assessment tools. The average conflict factor represents the overall conflict level of the multiple network resilience assessment tools. When the number of collisions exceeds a preset overall conflict threshold, multiple initial basic probability distributions are discounted based on a preset discount coefficient to obtain multiple target basic probability distributions. These multiple target basic probability distributions are then fused to obtain a fused basic probability distribution corresponding to the target network resilience index. Based on the fused basic probability distribution, the target detection result of the target network resilience index is determined. This effectively addresses the uncertainty and conflict in network resilience assessment results, thereby improving the accuracy and robustness of fusion in network resilience assessment. This solves the technical problem of low detection accuracy and reliability caused by heterogeneity and conflict in current network resilience assessments of multi-source assessment results. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0018] Figure 1 A hardware block diagram of a computer terminal for implementing a method for detecting network resilience indicators is shown.

[0019] Figure 2 This is a flowchart illustrating a method for detecting network resilience indicators according to an embodiment of the present invention.

[0020] Figure 3 This is a flowchart illustrating a multi-source decision fusion method for network resilience assessment provided by an optional embodiment of the present invention;

[0021] Figure 4 This is a schematic diagram of an algorithm for a multi-source decision fusion method for network resilience assessment provided by an optional embodiment of the present invention. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0025] Network resilience refers to the ability of a network to maintain critical functions or quickly restore business continuity when faced with emergencies such as attacks, equipment failures, and natural disasters.

[0026] According to an embodiment of the present invention, a method for detecting network resilience indicators is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0027] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal for implementing a method for detecting network resilience indicators is shown. Figure 1As shown, the computer terminal 10 may include one or more processors (shown as 102a, 102b, ..., 102n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0028] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10. As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0029] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the network resilience index detection method in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned network resilience index detection method of the application. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0030] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10.

[0031] Figure 2 This is a flowchart illustrating a method for detecting network resilience metrics according to an embodiment of the present invention, as shown below. Figure 2 As shown, the method includes the following steps:

[0032] Step S201: Obtain multiple initial detection results of the target network resilience index of the network system to be tested. The initial detection results include whether the target is met or not, and each initial detection result corresponds to a network resilience assessment tool.

[0033] In this step, raw test feedback for specific resilience indicators of the network system can be collected from multiple different network resilience testing tools. Each testing tool runs independently, and based on its design principles and testing mechanisms, it quantitatively evaluates the resilience capability of the network system, outputting a "compliant" or "non-compliant" result. For example, if the target network resilience indicator is "fatigue resistance," each testing tool will determine whether the network system's performance in the fatigue resistance test meets the safety indicators based on its specific testing standards and datasets, and then give a "compliant" or "non-compliant" judgment. The aforementioned testing tools may include, but are not limited to, behavior analysis-based systems, network traffic monitoring tools, and testing software. Each tool may produce heterogeneous test results due to differences in its testing methods, data sources, and analysis algorithms.

[0034] Step S202: Based on multiple initial detection results, calculate multiple initial basic probability distributions respectively. Each initial basic probability distribution corresponds to a network resilience assessment tool, and the initial basic probability distribution represents the degree of trust in the initial detection results.

[0035] In this step, the initial basic probability distribution (BPA) refers to the initial function mapping corresponding to each network resilience assessment tool, which quantifies the level of trust in the output results of each assessment tool. The BPA mapping is a core component of DS evidence theory, used to transform the actual test results of network resilience assessment tools into trust assignments for various propositions within the indicator identification framework. This preserves the uncertainty information in the assessment results, making network resilience assessment more closely reflect complex real-world environments. In this embodiment, the BPA mapping not only reflects the historical performance of the assessment tools but also considers the uncertainty and conflict risks of the tools, serving as the basis for subsequent decision fusion.

[0036] Specifically, a framework for identifying resilience assessment metrics can be defined as follows: Where A indicates that the evaluation result indicator meets the standard. This indicates that the evaluation results indicators did not meet the standards. Risk item D represents a cognitive gap caused by unclear tool output, insufficient information, execution errors, or conflicts, making it impossible to clearly determine the indicator status. Identification Framework Any subset below represents a potential prediction of the evaluation indicator results. The process of calculating the initial basic probability distribution is as follows: First, based on historical evaluation data, extract multiple performance indicators for each evaluation tool, including true positive, true negative, false positive, and false negative indicators, and calculate the confidence weight of each evaluation tool based on these. Second, based on the above performance indicators, and according to the initial detection results output by different evaluation tools, i.e., whether they meet the standards or not, use corresponding mathematical formulas to establish the original probability distribution of each evaluation tool. This quantifies the level of trust in these test results. Finally, by combining the confidence weights of the assessment tool with the original probability distribution, the confidence values ​​in the original BPA are dynamically adjusted to obtain a confidence-calibrated BPA mapping, i.e., the initial basic probability distribution. .

[0037] Step S203: Based on multiple initial basic probability distributions, calculate the average conflict factor of multiple network resilience assessment tools, whereby the average conflict factor characterizes the overall conflict level of multiple network resilience assessment tools.

[0038] In this step, the conflict factor is a key parameter within the Dempster-Shafer (DS) evidence theory framework, used to quantify the degree of contradiction between evidence provided by different assessment tools. It is correlated with the Jousselme evidence distance and can reveal potential risks arising from differences and uncertainties in information sources during multi-source fusion, thereby affecting the final fusion result and ensuring its robustness and accuracy. Specifically, the average conflict factor characterizes the overall conflict level of multiple network resilience assessment tools. To calculate the average conflict factor of multiple network resilience assessment tools, it is first necessary to determine the initial conflict factor between each tool and other tools based on the differences between the initial basic probability distributions. Subsequently, based on the overall credibility weight of each assessment tool, the consistency conflict level of all tools, i.e., the average conflict factor, was calculated by weighted averaging. .

[0039] Step S204: When the average conflict factor is greater than the preset overall conflict threshold, multiple initial basic probability distributions are discounted based on the preset discount coefficient to obtain multiple target basic probability distributions.

[0040] In this step, the preset overall conflict threshold can be: The value can be adjusted according to the risk tolerance of the actual assessment scenario. If the evaluation results are deemed to have systematic high conflict, a discount factor will be introduced. (in As a weight for the credibility of the tool, (This is the discount strength coefficient, which can be set according to actual needs) for the initial basic probability distribution. After applying a discount, the basic probability distribution of the target is obtained. Its expression is as follows:

[0041]

[0042] Step S205: The basic probability distributions of multiple targets are fused to obtain the fused basic probability distribution corresponding to the target network resilience index.

[0043] In this step, a modified Dempster rule is used for step-by-step fusion. This is for scenarios with low overall conflict, i.e., average conflict factor. The initial basic probability distribution can be directly fused using the traditional Dempster rule; however, in scenarios with high overall conflict, i.e. At that time, a discount mechanism is introduced to reduce the influence of conflict tool evidence, using a discounted target base probability allocation. This method of fusion avoids the serious distortion of fusion results caused by highly conflicting evidence.

[0044] The BPAs of each assessment tool are merged, and this process is repeated until all BPAs are merged to obtain the fused basic probability distribution. This reflects the reliability of the target network's resilience index after conflict resolution. Furthermore, if the fused basic probability distribution... The total trust level may deviate from 1 due to calculation error, which can also affect the fusion result. Normalization and correction are performed, and the correction formula is as follows:

[0045]

[0046] Step S206: Based on the fusion of the basic probability distribution, determine the target detection result of the target network resilience index.

[0047] In this step, based on the basic probability distribution of fusion , and This paper establishes a multi-level decision-making rule system for network resilience assessment results. By quantifying thresholds, it differentiates between high-confidence, medium-confidence, and low-confidence decisions, determining the final state of each network resilience indicator to support decision-makers in making risk-tolerance-based judgments. Through comparative analysis of the fusion of basic probability distributions, preset confidence thresholds, and preset gap thresholds, the target detection result for the target network resilience indicator can be determined. For example, it can include meeting the standard, failing to meet the standard, tending to meet the standard, tending to fail to meet the standard, or being uncertain. Through this multi-level decision-making rule system, this embodiment can not only process and fuse multi-source, heterogeneous, and noisy assessment information, but also flexibly adjust the decision level based on changes in the confidence level of the fused evidence, ensuring the accuracy of network resilience assessment results and the robustness of decisions.

[0048] Through the above steps, the uncertainty and conflict in network resilience assessment results are effectively addressed, thereby improving the accuracy and robustness of fusion in network resilience assessment. This solves the technical problem of low detection accuracy and reliability caused by heterogeneity and conflict in current network resilience assessment results from multiple sources.

[0049] As an optional embodiment, multiple initial basic probability distributions are calculated based on multiple initial detection results, including: acquiring multiple historical detection data for each of multiple network resilience assessment tools, wherein the historical detection data is in triplet form and includes indicator type, tool detection result, and actual indicator status; determining multiple performance indicators for each of the multiple network resilience assessment tools based on the multiple historical detection data for each of the multiple network resilience assessment tools, wherein the performance indicators characterize the comparison between the tool detection result and the actual indicator status, and the multiple performance indicators include true positive indicators, true negative indicators, false positive indicators, and false negative indicators; calculating the credibility weights for each of the multiple network resilience assessment tools based on the multiple performance indicators for each of the multiple network resilience assessment tools; determining multiple original basic probability distributions based on the multiple initial detection results and the multiple performance indicators for each of the multiple network resilience assessment tools; and calibrating the multiple original basic probability distributions based on the credibility weights for each of the multiple network resilience assessment tools to obtain multiple initial basic probability distributions.

[0050] Alternatively, if the evaluation tool has no historical data or very little data, the Delphi method can be used. Multiple experts in the field of network resilience evaluation are invited to infer and score the inherent characteristics of the evaluation tool, such as its technical principles, type, detection methods, and applicable scenarios. Finally, the average of the expert opinions is used as the initial credibility weight of the evaluation tool. If the evaluation tools have historical data, a historical evaluation database is established for each tool, recording the triplet "Indicator Type - Tool Detection Result - Actual Indicator Status," such as "Does the system have fatigue resistance? - Meets the standard - Does it not meet the standard?" The actual indicator status is the "standard answer" of the network resilience indicator confirmed through manual auditing, attack and defense drills, etc. Subsequently, based on the historical data, relevant performance indicators such as TP (True Positive), TN (True Negative), FP (False Positive), and FN (False Negative) can be calculated for each evaluation tool. TP refers to the number of times the evaluation tool determines the target network resilience indicator as "meets the standard," and the indicator actually does; TN represents the number of times the evaluation tool considers the network resilience indicator as "does not meet the standard," and the indicator actually does not; FP refers to the number of times the evaluation tool incorrectly reports the network resilience indicator as "meets the standard," but the indicator actually does not; and FN refers to the number of times the evaluation tool should have reported the network resilience indicator as "meets the standard" but incorrectly marked it as "does not meet the standard."

[0051] Furthermore, based on multiple performance metrics, reliability metrics for each evaluation tool can be calculated, including precision and recall, and the credibility weights of different network resilience evaluation tools can be determined accordingly. Subsequently, the initial test results are used to determine the appropriate BPA type for the assessment tool, resulting in... , and The original basic probability distribution function is composed of these. This indicates that the current assessment tool clearly supports the credibility of the network resilience indicator "meeting the standard." This indicates that the current assessment tool clearly supports the credibility of the network resilience indicator being "unsatisfactory." This indicates that the current evidence is insufficient to clearly determine whether something meets the standard or not, and that there are ambiguities, conflicts, missing information, unreliable tools, or abnormal execution, resulting in a level of "unknown" or "determined judgment," and meets the following conditions: Credibility Indicators or The core concept reflects the probability that the tool determines the evaluation indicator to be met when it actually meets the standard, or the probability that the tool determines the evaluation indicator to be unmet when it actually fails to meet the standard. Potential misjudgment risks are minimized by assigning them to the minimum boundary values. The remaining probabilities are allocated to explicit counter-evidence or supporting indicators. Finally, dynamic BPA calibration is performed based on the tool credibility model. By deeply integrating credibility weights into the original basic probability distribution, a precise mapping mechanism of "tool comprehensive credibility - evaluation indicator result trustworthiness" is constructed, i.e., the initial basic probability distribution. The expression for the initial basic probability distribution is as follows:

[0052]

[0053] in, The preset base uncertainty coefficient (usually between 0.05 and 0.2) can be set according to the "cost of misjudgment" and "tool credibility distribution" of the evaluation scenario. Its purpose is to provide a baseline guarantee for the trust allocation of low-credibility tools, preventing the BPA of low-credibility tools from being over-compressed. Through this mapping mechanism, the calibrated BPA exhibits significant tool credibility correlation characteristics: the higher the credibility of the tool's output, the higher the proportion of trust in A or ¬A retained, maximizing the retention of effective information in the initial BPA; conversely, through... This introduces more uncertainty, tilting trust towards uncertainty D. This dynamic adjustment logic precisely achieves the goal of "strengthening information from high-reliability tools and weakening information from low-reliability tools," providing evidence that is both discriminative and robust for network resilience assessment decisions.

[0054] As an optional embodiment, based on multiple initial detection results and multiple performance indicators of multiple network resilience assessment tools, multiple original basic probability distributions are determined, including: calculating the true positive rate of each of the multiple network resilience assessment tools based on their respective true positive and false positive indicators; calculating the true negative rate of each of the multiple network resilience assessment tools based on their respective true negative and false negative indicators; determining the probability distribution calculation method corresponding to each of the multiple initial detection results; and calculating multiple original basic probability distributions based on the probability distribution calculation method corresponding to each of the multiple initial detection results, the true positive rate of each of the multiple network resilience assessment tools, and the true negative rate of each of the multiple network resilience assessment tools.

[0055] Optionally, firstly, based on historical assessment data, the historical accuracy of each assessment tool corresponding to the assessment indicator can be extracted, including the probability that the assessment tool judges the target as "met" and actually meets the target (true positive rate, TPR) and the probability that the assessment tool judges the target as "not met" and actually does not meet the target (true negative rate, TNR). The expression is as follows:

[0056]

[0057]

[0058] Secondly, calculate the first type of risk correction term. This is used to control the indirect risk of "tools missing the mark of compliance" when assessment tools determine compliance, and to avoid over-reliance on "compliance" results. This is a preset minimum risk threshold to avoid underestimating risk due to the limitations of historical data. Simultaneously, a second risk correction term is calculated. This is used to control the indirect risk of "tools misjudging compliance" when the assessment tool determines "non-compliance," and to avoid over-reliance on "non-compliance" results. The same is the preset minimum risk threshold.

[0059] Finally, based on the initial detection results, the performance of each evaluation tool within the evaluation indicator identification framework can be calculated. The original basic probability distribution There are two possible scenarios:

[0060] If the initial test result is "meets the standard" as determined by the assessment tool, This reflects the degree to which the tool's judgment is "up to standard and reliable." This reflects the risks of "direct misjudgment by the tool and overall unreliability." The original basic probability distribution of the clear counter-evidence that "the evaluation indicators actually fail to meet the standards" is as follows:

[0061]

[0062] If the initial test result is "unqualified" by the assessment tool, This reflects the degree to which the tool's judgment is substandard and unreliable. This reflects the risks of "direct misjudgment and indirect unreliability of the tools." The original basic probability distribution, which only reflects explicit support for "actual achievement of evaluation indicators", is as follows:

[0063]

[0064] As an optional embodiment, based on multiple performance metrics of each of the multiple network resilience assessment tools, the credibility weights of each of the multiple network resilience assessment tools are calculated, including: calculating the precision of each of the multiple network resilience assessment tools based on their respective true positive and false positive metrics; calculating the recall of each of the multiple network resilience assessment tools based on their respective true positive and false negative metrics; and calculating the credibility weights of each of the multiple network resilience assessment tools based on their respective precision and recall.

[0065] Optionally, precision is the percentage of assessment results that the tool judges as "meeting the standard" but actually meet the standard. Calculating precision reveals the accuracy of the assessment tool's positive judgments, helping to avoid over-reliance on the tool's positive feedback and preventing false alarms. Its calculation formula is as follows:

[0066]

[0067] Recall measures a tool's ability to accurately identify all actually compliant network resilience metrics, revealing the tool's coverage and sensitivity in detecting "compliance" situations, ensuring the comprehensiveness and reliability of the evaluation results. Its calculation formula is as follows:

[0068]

[0069] Taking into account both precision and recall, the credibility weight of the evaluation tool is calculated. The calculation method is as follows:

[0070]

[0071] The credibility weight not only integrates the tool's performance in terms of accuracy and comprehensiveness, but also provides a balance point by reconciling the relationship between precision and recall, in order to assess the tool's relative importance and trustworthiness in fusion decision-making.

[0072] As an optional embodiment, the average conflict factor of multiple network resilience assessment tools is calculated based on multiple initial basic probability distributions, including: calculating the conflict factor between any two network resilience assessment tools based on multiple initial basic probability distributions to obtain multiple initial conflict factors; and calculating the average conflict factor based on the multiple initial conflict factors and the credibility weights of the multiple network resilience assessment tools.

[0073] Optionally, for any two network resilience assessment tools and By analyzing their initial basic probability distributions, the initial conflict factor can be calculated using the Jousselme evidence distance formula. This involves quantifying the degree of contradiction in the evidence between the two tools. Among them, The calculation formula is as follows:

[0074]

[0075] This is the Jaccard similarity matrix, used to measure focal elements (in this optional embodiment, it is...). and The similarity between them. Considering that the focal elements are mutually exclusive and complete, we set... It is a 3×3 identity matrix.

[0076] Subsequently, to avoid conflicts between low-reliability tools interfering with the overall judgment, a weighted average conflict factor of n evaluation tools was calculated based on their reliability weights. As an overall conflict assessment indicator, its calculation formula is as follows:

[0077]

[0078] in, and They are respectively and The credibility weight.

[0079] As an optional embodiment, before calculating the average conflict factor of multiple network resilience assessment tools based on multiple initial basic probability distributions, the method includes: calculating the conflict factor between any two network resilience assessment tools based on multiple initial basic probability distributions to obtain multiple initial conflict factors; determining the target conflict factor that exceeds a preset local conflict threshold among the multiple initial conflict factors; determining the network resilience assessment tool with the lower credibility weight among the two network resilience assessment tools corresponding to the target conflict factor as the network resilience assessment tool to be processed; and discounting the initial basic probability distribution corresponding to the network resilience assessment tool to be processed to obtain a new initial basic probability distribution.

[0080] Optionally, before determining whether to apply a discount based on the overall average conflict factor, a local conflict assessment can be performed first. First, based on multiple initial basic probability distributions, the conflict factor between any two network resilience assessment tools can be calculated. This yields multiple initial conflict factors. Similarly, this calculation utilizes the Jousselme evidence distance formula, which quantifies the degree of contradiction between evidence provided by different tools, providing a direct basis for subsequent conflict control. From the calculated initial conflict factors, those exceeding a preset local conflict threshold are identified. The target conflict factor is determined. The local conflict threshold is set based on the risk tolerance of the specific evaluation scenario. Network resilience evaluation tools are selected based on credibility weights, ensuring that evidence from high-credibility tools is prioritized in the decision-making process, while evidence from low-credibility tools is subject to more rigorous review and processing. Finally, the initial basic probability distribution corresponding to the network resilience evaluation tools to be processed is discounted by introducing a discount coefficient. The BPA is adjusted in the same way as the discounting process based on the overall average conflict factor to obtain a new initial basic probability distribution, and then the overall average conflict factor is calculated again. The purpose of the discounting process is to reduce the influence of conflicting evidence in decision fusion, avoid bias in the overall decision due to abnormal or erroneous outputs of individual tools, and ensure the reliability and objectivity of the fused information.

[0081] As an optional implementation, after each network resilience metric detection, the current performance of each evaluation tool can be assessed by comparing the actual detection status of the network resilience metric with the final target detection result. Based on the comparison result, new triplet data is constructed, triggering the update of the tool's historical detection data so that its latest performance can be reflected in subsequent credibility weight calculations. The latest detection results are added to the historical detection library of the corresponding tool, and the BPA calibration model is retrained based on the adjusted weights to ensure the comprehensiveness and timeliness of historical data. By continuously updating historical detection data, the credibility weights can be recalculated based on the latest tool performance after each network resilience evaluation, and the BPA calibration model can be trained and optimized based on the adjusted weights, realizing closed-loop feedback and iterative optimization of the credibility of network resilience evaluation tools.

[0082] As an optional embodiment, the target detection result of the target network resilience index is determined based on the fused basic probability distribution. Where the fused basic probability distribution includes a first proposition confidence level, a second proposition confidence level, and a third proposition confidence level, and the first proposition is a compliant proposition, the second proposition is a non-compliant proposition, and the third proposition is an uncertain proposition, the determination includes: if the first proposition confidence level is not less than a first preset confidence level threshold and the difference between the first proposition confidence level and the second proposition confidence level is greater than a first preset gap threshold, the target detection result is determined to be compliant; or if the second proposition confidence level is not less than the first preset confidence level threshold and the difference between the second proposition confidence level and the first proposition confidence level is greater than a first preset gap threshold, the target detection result is determined to be non-compliant; or if the first proposition confidence level is not less than the second preset confidence level threshold and the first proposition confidence level is less than the first preset confidence level threshold... If the confidence level of the first proposition is greater than the confidence level of the second proposition and the confidence level of the third proposition is less than the preset tolerance threshold, the target detection result is determined to be "prone to meeting the standard"; or if the confidence level of the second proposition is not less than the second preset confidence threshold, the confidence level of the second proposition is less than the first preset confidence threshold, the confidence level of the second proposition is greater than the confidence level of the first proposition and the confidence level of the third proposition is less than the preset tolerance threshold, the target detection result is determined to be "prone to not meeting the standard"; or if the confidence level of the first proposition is less than the second preset confidence threshold and the confidence level of the second proposition is less than the second preset confidence threshold, the target detection result is determined to be "uncertain"; or if the difference between the confidence level of the first proposition and the confidence level of the second proposition is less than the second preset gap threshold, the target detection result is determined to be "uncertain"; or if the confidence level of the third proposition is not less than the preset tolerance threshold, the target detection result is determined to be "uncertain".

[0083] Optionally, the first proposition To meet the standards, the second question. For substandard propositions, third propositions This is an uncertain proposition. In high-confidence decision-making, if the confidence level of the first proposition is higher than a first preset confidence threshold... Furthermore, the difference in trust level between the second proposition and the third proposition is greater than the first preset gap threshold. The target detection result is "meets the standard"; conversely, if the confidence level of the second proposition is higher than that of the target, the target detection result is "meets the standard". And the difference in confidence level between it and the first proposition exceeds If so, it is judged as "not up to standard". The minimum trust threshold used to define "absolute dominance" This is used to define the minimum confidence gap between two propositions in a high-confidence scenario. This decision-making model is applicable when one state holds an absolute advantage in the fusion result, ensuring the accuracy and reliability of the evaluation results.

[0084] In moderate confidence decision-making, if the confidence level of the first proposition is within the second preset confidence threshold... The confidence level of the first proposition is greater than that of the second proposition, while the confidence level of the third proposition is lower than that of the preset tolerance threshold. If the target detection result is "prone to meeting the standard", then the target detection result is judged as "prone to meeting the standard"; similarly, if the confidence level of the second proposition is within the second preset confidence level threshold... The second proposition's confidence level is greater than the first proposition's confidence level, while the third proposition's confidence level is lower than the preset tolerance threshold. If so, it is judged as "prone to failing to meet the standard". Among them, The minimum trust threshold for moderate confidence scenarios. This represents the highest tolerance level for uncertainty under a moderate confidence scenario. This method is applicable to situations where the assessment results have a certain degree of bias, but the uncertainty remains manageable. It requires decision-makers to exercise caution when using this method and to consider retesting or supplementing information in the future.

[0085] In low-confidence decision-making, if the confidence levels of both the first and second propositions are lower than... Or, the difference in trust levels between the first and second propositions is less than the second preset gap threshold. Or, the confidence level of the third proposition is greater than or equal to If so, the target detection result is determined to be "uncertain". This is used to define the maximum confidence gap between the two propositions "meets the standard" and "does not meet the standard" in low-confidence scenarios. This means that the conflict or uncertainty between the evidence after fusion is high and insufficient to support a clear judgment of "meets the standard" or "does not meet the standard". At this time, it is necessary to initiate a supplementary evaluation or investigation process to obtain more data or evidence until the conditions for a higher confidence decision can be met.

[0086] In conjunction with the above optional embodiments, a multi-source decision fusion method for network resilience assessment is also provided. Figure 3 This is a flowchart illustrating a multi-source decision fusion method for network resilience assessment provided by an optional embodiment of the present invention. Figure 3As shown, this method includes the following steps: First, by combining historical evaluation data and expert experience, a quantifiable model of the credibility of the network resilience evaluation tool is pre-constructed to provide a reliability benchmark for the fusion of multi-source evaluation results. Second, evidence modeling of the evaluation results is conducted, establishing a basic probability allocation function (BPA) mapping between heterogeneous network resilience evaluation evidence and the evaluation indicator identification framework, and dynamically calibrating the BPA based on the credibility of the evaluation tool. Third, the BPA of the multi-source evaluation results is fused based on DS evidence theory, and the high conflict problem of the tool evaluation results is solved by improving the synthesis rules, generating a fused comprehensive basic probability allocation function to support the final decision. Fourth, a multi-level confidence decision rule system is constructed, and the historical evaluation database of the tool is updated based on the decision results to achieve closed-loop feedback and iterative optimization of the credibility of the network resilience evaluation tool. In the above method, Figure 4 This is a schematic diagram of an algorithm for a multi-source decision fusion method for network resilience assessment provided by an optional embodiment of the present invention. Figure 4 As shown, this algorithm aims to optimize multi-source decision fusion for network resilience assessment by quantifying tool credibility and conflict control. First, by evaluating the precision and recall of each tool, its credibility weight is calculated, laying the foundation for evidence modeling. Then, the tool's detection results are converted into basic probability assignments (BPAs) and calibrated according to the credibility weights to generate a calibrated initial BPA. Based on this, the algorithm calculates the conflict factor between any two tools, discounting highly conflicting evidence to ensure information quality. The calculation of the average conflict factor provides a quantitative indicator of the overall conflict level, guiding the selection of fusion strategies. An improved Dempster rule is then applied to the fusion process, combining conflict control and tool weights to produce a comprehensive basic probability assignment, supporting the final decision. Furthermore, a closed-loop feedback mechanism dynamically updates the tool's historical database and credibility weights by comparing the actual detection status with the fusion results, enabling the algorithm's self-optimization and iteration, ensuring the continuous accuracy and reliability of network resilience assessment results.

[0087] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0088] Through the above description of the embodiments, those skilled in the art can clearly understand that the network resilience index detection method according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0089] Embodiments of the present invention may provide a computer device. Optionally, in this embodiment, the computer device may be located in at least one of a plurality of network devices in a computer network. The computer device includes a memory and a processor.

[0090] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the network resilience index detection method and apparatus in this embodiment of the invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned network resilience index detection method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to a computer terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0091] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: acquiring multiple initial detection results of the target network resilience index of the network system under test, wherein each initial detection result is either compliant or non-compliant, and each initial detection result corresponds to a network resilience assessment tool; calculating multiple initial basic probability distributions based on the multiple initial detection results, wherein each initial basic probability distribution corresponds to a network resilience assessment tool, and the initial basic probability distribution represents the degree of trust in the initial detection results; calculating the average conflict factor of the multiple network resilience assessment tools based on the multiple initial basic probability distributions, wherein the average conflict factor represents the overall conflict level of the multiple network resilience assessment tools; when the average conflict factor is greater than a preset overall conflict threshold, discounting the multiple initial basic probability distributions based on a preset discount coefficient to obtain multiple target basic probability distributions; fusing the multiple target basic probability distributions to obtain the fused basic probability distribution corresponding to the target network resilience index; and determining the target detection result of the target network resilience index based on the fused basic probability distribution.

[0092] Optionally, the processor may also execute program code for the following steps: calculating multiple initial basic probability distributions based on multiple initial detection results, including: acquiring multiple historical detection data for each of the multiple network resilience assessment tools, wherein the historical detection data is in triplet form and includes indicator type, tool detection result, and actual indicator status; determining multiple performance indicators for each of the multiple network resilience assessment tools based on the multiple historical detection data for each of the multiple network resilience assessment tools, wherein the performance indicators characterize the comparison between the tool detection result and the actual indicator status, and the multiple performance indicators include true positive indicators, true negative indicators, false positive indicators, and false negative indicators; calculating the credibility weights for each of the multiple network resilience assessment tools based on the multiple performance indicators for each of the multiple network resilience assessment tools; determining multiple original basic probability distributions based on the multiple initial detection results and the multiple performance indicators for each of the multiple network resilience assessment tools; and calibrating the multiple original basic probability distributions based on the credibility weights for each of the multiple network resilience assessment tools to obtain multiple initial basic probability distributions.

[0093] Optionally, the processor may also execute program code that performs the following steps: determining multiple original basic probability distributions based on multiple initial detection results and multiple performance indicators of multiple network resilience assessment tools, including: calculating the true positive rate of each of the multiple network resilience assessment tools based on their respective true positive and false positive indicators; calculating the true negative rate of each of the multiple network resilience assessment tools based on their respective true negative and false negative indicators; determining the probability distribution calculation method corresponding to each of the multiple initial detection results; and calculating multiple original basic probability distributions based on the probability distribution calculation method corresponding to each of the multiple initial detection results, the true positive rate of each of the multiple network resilience assessment tools, and the true negative rate of each of the multiple network resilience assessment tools.

[0094] Optionally, the processor may also execute program code that performs the following steps: calculating the reliability weights of multiple network resilience assessment tools based on multiple performance metrics of each tool, including: calculating the precision of each tool based on the true positive and false positive metrics of each tool; calculating the recall of each tool based on the true positive and false negative metrics of each tool; and calculating the reliability weights of each tool based on the precision and recall of each tool.

[0095] Optionally, the processor may also execute program code that performs the following steps: calculating the average conflict factor of multiple network resilience assessment tools based on multiple initial basic probability distributions, including: calculating the conflict factor between any two network resilience assessment tools based on multiple initial basic probability distributions to obtain multiple initial conflict factors; and calculating the average conflict factor based on the multiple initial conflict factors and the credibility weights of the multiple network resilience assessment tools.

[0096] Optionally, the processor may also execute program code that performs the following steps: before calculating the average conflict factor of multiple network resilience assessment tools based on multiple initial basic probability distributions, the steps include: calculating the conflict factor between any two network resilience assessment tools based on multiple initial basic probability distributions to obtain multiple initial conflict factors; determining the target conflict factor among the multiple initial conflict factors that exceeds a preset local conflict threshold; determining the network resilience assessment tool with the lower credibility weight among the two network resilience assessment tools corresponding to the target conflict factor as the network resilience assessment tool to be processed; and discounting the initial basic probability distribution corresponding to the network resilience assessment tool to be processed to obtain a new initial basic probability distribution.

[0097] Optionally, the processor may also execute program code for the following steps: determining the target detection result of the target network resilience index based on the fused basic probability distribution, wherein, when the fused basic probability distribution includes a first proposition confidence level, a second proposition confidence level, and a third proposition confidence level, and the first proposition is a qualified proposition, the second proposition is a unqualified proposition, and the third proposition is an uncertain proposition, the following steps are included: determining the target detection result as qualified when the first proposition confidence level is not less than a first preset confidence level threshold and the difference between the first proposition confidence level and the second proposition confidence level is greater than a first preset gap threshold; or determining the target detection result as unqualified when the second proposition confidence level is not less than the first preset confidence level threshold and the difference between the second proposition confidence level and the first proposition confidence level is greater than a first preset gap threshold; or determining the target detection result as unqualified when the first proposition confidence level is not less than the second preset confidence level threshold and the first proposition confidence level is less than a first preset gap threshold. If the first preset trust threshold, the first proposition trust threshold is greater than the second proposition trust threshold, and the third proposition trust threshold is less than the preset tolerance threshold, the target detection result is determined to be "prone to meeting the standard"; or if the second proposition trust threshold is not less than the second preset trust threshold, the second proposition trust threshold is less than the first preset trust threshold, the second proposition trust threshold is greater than the first proposition trust threshold, and the third proposition trust threshold is less than the preset tolerance threshold, the target detection result is determined to be "prone to not meeting the standard"; or if the first proposition trust threshold is less than the second preset trust threshold, and the second proposition trust threshold is less than the second preset trust threshold, the target detection result is determined to be "uncertain"; or if the difference between the first proposition trust threshold and the second proposition trust threshold is less than the second preset gap threshold, the target detection result is determined to be "uncertain"; or if the third proposition trust threshold is not less than the preset tolerance threshold, the target detection result is determined to be "uncertain".

[0098] This invention provides a scheme for detecting network resilience indicators. It involves acquiring multiple initial detection results of the target network resilience indicator for the network system under test, where each initial detection result is either compliant or non-compliant, and each initial detection result corresponds to a network resilience assessment tool. Based on these initial detection results, multiple initial basic probability distributions are calculated, where each initial basic probability distribution corresponds to a network resilience assessment tool, and the initial basic probability distribution represents the degree of trust in the initial detection results. Based on these initial basic probability distributions, an average conflict factor is calculated for the multiple network resilience assessment tools, where the average conflict factor represents the overall conflict level of the multiple network resilience assessment tools. If the average conflict factor exceeds a preset overall conflict threshold... In this case, based on a preset discount coefficient, multiple initial basic probability distributions are discounted to obtain multiple target basic probability distributions. These multiple target basic probability distributions are then fused to obtain the fused basic probability distribution corresponding to the target network resilience index. Based on the fused basic probability distribution, the target detection result of the target network resilience index is determined. This effectively addresses the uncertainty and conflict in network resilience assessment results, thereby improving the accuracy and robustness of fusion in network resilience assessment. This solves the technical problem of low detection accuracy and reliability caused by heterogeneity and conflict in current network resilience assessments of multi-source assessment results.

[0099] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a non-volatile storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0100] Embodiments of the present invention also provide a non-volatile storage medium. Optionally, in this embodiment, the aforementioned non-volatile storage medium can be used to store the program code executed by the network resilience index detection method provided in the above embodiments.

[0101] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0102] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: acquiring multiple initial detection results of the target network resilience index of the network system to be tested, wherein the initial detection results include compliance or non-compliance, and one initial detection result corresponds to one network resilience assessment tool; calculating multiple initial basic probability distributions based on the multiple initial detection results, wherein one initial basic probability distribution corresponds to one network resilience assessment tool, and the initial basic probability distribution characterizes the degree of trust in the initial detection results; calculating the average conflict factor of the multiple network resilience assessment tools based on the multiple initial basic probability distributions, wherein the average conflict factor characterizes the overall conflict degree of the multiple network resilience assessment tools; when the average conflict factor is greater than a preset overall conflict threshold, discounting the multiple initial basic probability distributions based on a preset discount coefficient to obtain multiple target basic probability distributions; fusing the multiple target basic probability distributions to obtain the fused basic probability distribution corresponding to the target network resilience index; and determining the target detection result of the target network resilience index based on the fused basic probability distribution.

[0103] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: calculating multiple initial basic probability distributions based on multiple initial detection results, including: acquiring multiple historical detection data for each of multiple network resilience assessment tools, wherein the historical detection data is in triplet form and includes indicator type, tool detection result, and actual indicator status; determining multiple performance indicators for each of the multiple network resilience assessment tools based on the multiple historical detection data for each of the multiple network resilience assessment tools, wherein the performance indicators characterize the comparison between the tool detection result and the actual indicator status, and the multiple performance indicators include true positive indicators, true negative indicators, false positive indicators, and false negative indicators; calculating the credibility weights for each of the multiple network resilience assessment tools based on the multiple performance indicators for each of the multiple network resilience assessment tools; determining multiple original basic probability distributions based on the multiple initial detection results and the multiple performance indicators for each of the multiple network resilience assessment tools; and calibrating the multiple original basic probability distributions based on the credibility weights for each of the multiple network resilience assessment tools to obtain multiple initial basic probability distributions.

[0104] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: determining multiple original basic probability distributions based on multiple initial detection results and multiple performance indicators of multiple network resilience assessment tools, including: calculating the true positive rate of each of the multiple network resilience assessment tools based on the true positive index and the false positive index of each of the multiple network resilience assessment tools; calculating the true negative rate of each of the multiple network resilience assessment tools based on the true negative index and the false negative index of each of the multiple network resilience assessment tools; determining the probability distribution calculation method corresponding to each of the multiple initial detection results based on the multiple initial detection results; and calculating multiple original basic probability distributions based on the probability distribution calculation method corresponding to each of the multiple initial detection results, the true positive rate of each of the multiple network resilience assessment tools, and the true negative rate of each of the multiple network resilience assessment tools.

[0105] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: calculating the reliability weights of multiple network resilience assessment tools based on multiple performance metrics of each tool, including: calculating the precision of each tool based on the true positive and false positive metrics of each tool; calculating the recall of each tool based on the true positive and false negative metrics of each tool; and calculating the reliability weights of each tool based on the precision and recall of each tool.

[0106] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: calculating the average conflict factor of multiple network resilience assessment tools based on multiple initial basic probability distributions, including: calculating the conflict factor between any two network resilience assessment tools based on multiple initial basic probability distributions to obtain multiple initial conflict factors; and calculating the average conflict factor based on the multiple initial conflict factors and the respective credibility weights of the multiple network resilience assessment tools.

[0107] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: before calculating the average conflict factor of multiple network resilience assessment tools based on multiple initial basic probability distributions, the steps include: calculating the conflict factor between any two network resilience assessment tools based on multiple initial basic probability distributions to obtain multiple initial conflict factors; determining a target conflict factor among the multiple initial conflict factors that exceeds a preset local conflict threshold; determining the network resilience assessment tool with the lower confidence weight among the two network resilience assessment tools corresponding to the target conflict factor as the network resilience assessment tool to be processed; and discounting the initial basic probability distribution corresponding to the network resilience assessment tool to be processed to obtain a new initial basic probability distribution.

[0108] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: determining the target detection result of the target network resilience index based on the fused basic probability distribution, wherein, when the fused basic probability distribution includes a first proposition confidence level, a second proposition confidence level, and a third proposition confidence level, and the first proposition is a qualified proposition, the second proposition is a unqualified proposition, and the third proposition is an uncertain proposition, the following steps are included: determining the target detection result as qualified when the first proposition confidence level is not less than a first preset confidence level threshold and the difference between the first proposition confidence level and the second proposition confidence level is greater than a first preset gap threshold; or determining the target detection result as unqualified when the second proposition confidence level is not less than the first preset confidence level threshold and the difference between the second proposition confidence level and the first proposition confidence level is greater than a first preset gap threshold; or determining the target detection result as unqualified when the first proposition confidence level is not less than the second preset confidence level threshold and the first proposition confidence level is greater than a first preset gap threshold; or determining the target detection result as unqualified when the first proposition confidence level is not less than the second preset confidence level threshold and the first proposition confidence level is greater than a first preset gap threshold. If the proposition confidence level is less than the first preset confidence level threshold, the first proposition confidence level is greater than the second proposition confidence level, and the third proposition confidence level is less than the preset tolerance threshold, the target detection result is determined to be "prone to meeting the standard"; or if the second proposition confidence level is not less than the second preset confidence level threshold, the second proposition confidence level is less than the first preset confidence level threshold, the second proposition confidence level is greater than the first proposition confidence level, and the third proposition confidence level is less than the preset tolerance threshold, the target detection result is determined to be "prone to not meeting the standard"; or if the first proposition confidence level is less than the second preset confidence level threshold and the second proposition confidence level is less than the second preset confidence level threshold, the target detection result is determined to be "uncertain"; or if the difference between the first proposition confidence level and the second proposition confidence level is less than the second preset gap threshold, the target detection result is determined to be "uncertain"; or if the third proposition confidence level is not less than the preset tolerance threshold, the target detection result is determined to be "uncertain".

[0109] Embodiments of the present invention also provide a computer program product, including a computer program. Optionally, in this embodiment, when the computer program is executed by a processor, it can: acquire multiple initial detection results of a target network resilience index of a network system to be tested, wherein the initial detection results include compliance or non-compliance, and one initial detection result corresponds to one network resilience assessment tool; calculate multiple initial basic probability distributions based on the multiple initial detection results, wherein one initial basic probability distribution corresponds to one network resilience assessment tool, and the initial basic probability distribution characterizes the degree of trust in the initial detection results; calculate the average conflict factor of the multiple network resilience assessment tools based on the multiple initial basic probability distributions, wherein the average conflict factor characterizes the overall conflict degree of the multiple network resilience assessment tools; when the average conflict factor is greater than a preset overall conflict threshold, discount the multiple initial basic probability distributions based on a preset discount coefficient to obtain multiple target basic probability distributions; fuse the multiple target basic probability distributions to obtain a fused basic probability distribution corresponding to the target network resilience index; and determine the target detection result of the target network resilience index based on the fused basic probability distribution.

[0110] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0111] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0112] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0113] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0114] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0115] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0116] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for detecting network resilience indicators, characterized in that, include: Multiple initial detection results of the target network resilience index of the network system to be tested are obtained, wherein the initial detection results include whether the target is met or not, and one initial detection result corresponds to one network resilience assessment tool; Based on the multiple initial detection results, multiple initial basic probability distributions are calculated respectively, wherein each initial basic probability distribution corresponds to one of the network resilience assessment tools, and the initial basic probability distribution represents the degree of trust in the initial detection results; Based on the multiple initial basic probability distributions, the average conflict factor of the multiple network resilience assessment tools is calculated, wherein the average conflict factor characterizes the overall conflict degree of the multiple network resilience assessment tools; When the average conflict factor is greater than the preset overall conflict threshold, the multiple initial basic probability distributions are discounted based on the preset discount coefficient to obtain multiple target basic probability distributions. The multiple target basic probability distributions are fused to obtain the fused basic probability distribution corresponding to the target network resilience index; Based on the fusion basic probability distribution, the target detection result of the target network resilience index is determined.

2. The method according to claim 1, characterized in that, Based on the multiple initial detection results, multiple initial basic probability distributions are calculated, including: Obtain multiple historical test data from each of the aforementioned network resilience assessment tools, wherein the historical test data is in triplet form and includes indicator type, tool test result, and actual indicator status; Based on the historical detection data of each of the plurality of network resilience assessment tools, a plurality of performance indicators are determined for each of the plurality of network resilience assessment tools. The performance indicators characterize the comparison between the detection results of the tools and the actual indicator status. The plurality of performance indicators include true positive indicators, true negative indicators, false positive indicators and false negative indicators. Based on the various performance indicators of each of the plurality of network resilience assessment tools, calculate the credibility weight of each of the plurality of network resilience assessment tools; Based on the multiple initial detection results and the multiple performance indicators of the multiple network resilience assessment tools, multiple original basic probability distributions are determined; Based on the credibility weights of the various network resilience assessment tools, the various original basic probability distributions are calibrated to obtain the various initial basic probability distributions.

3. The method according to claim 2, characterized in that, Based on the multiple initial detection results and the multiple performance indicators of the multiple network resilience assessment tools, multiple original basic probability distributions are determined, including: Based on the true positive index and false positive index of each of the plurality of network resilience assessment tools, the true positive rate of each of the plurality of network resilience assessment tools is calculated respectively; Based on the true negative index and false negative index of each of the plurality of network resilience assessment tools, the true negative rate of each of the plurality of network resilience assessment tools is calculated respectively; Based on the multiple initial detection results, determine the probability distribution calculation method corresponding to each of the multiple initial detection results; Based on the probability distribution calculation method corresponding to each of the multiple initial detection results, the true positive rate of each of the multiple network resilience assessment tools, and the true negative rate of each of the multiple network resilience assessment tools, the multiple original basic probability distributions are calculated.

4. The method according to claim 2, characterized in that, The calculation of the credibility weights of each of the plurality of network resilience assessment tools based on their respective performance metrics includes: Based on the true positive index and false positive index of each of the plurality of network resilience assessment tools, the accuracy of each of the plurality of network resilience assessment tools is calculated respectively; Based on the true positive index and false negative index of each of the plurality of network resilience assessment tools, the recall rate of each of the plurality of network resilience assessment tools is calculated respectively; Based on the precision and recall of each of the plurality of network resilience assessment tools, the credibility weight of each of the plurality of network resilience assessment tools is calculated.

5. The method according to claim 2, characterized in that, The calculation of the average conflict factor of multiple network resilience assessment tools based on the multiple initial basic probability distributions includes: Based on the multiple initial basic probability distributions, the conflict factor between any two of the network resilience assessment tools is calculated to obtain multiple initial conflict factors. The average conflict factor is calculated based on the plurality of initial conflict factors and the respective credibility weights of the plurality of network resilience assessment tools.

6. The method according to claim 2, characterized in that, Before calculating the average conflict factor of the multiple network resilience assessment tools based on the multiple initial basic probability distributions, the process includes: Based on the multiple initial basic probability distributions, the conflict factor between any two of the network resilience assessment tools is calculated to obtain multiple initial conflict factors. Identify the target conflict factor that exceeds a preset local conflict threshold among the plurality of initial conflict factors; The network resilience assessment tool with the lower credibility weight among the two network resilience assessment tools corresponding to the target conflict factor is selected as the network resilience assessment tool to be processed. The initial basic probability distribution corresponding to the network resilience assessment tool to be processed is discounted to obtain a new initial basic probability distribution.

7. The method according to any one of claims 1 to 6, characterized in that, The step of determining the target network resilience index based on the fused basic probability distribution includes the following: when the fused basic probability distribution includes a first proposition confidence level, a second proposition confidence level, and a third proposition confidence level, and the first proposition is a qualified proposition, the second proposition is a non-qualified proposition, and the third proposition is an uncertain proposition: If the confidence level of the first proposition is not less than the first preset confidence level threshold and the difference between the confidence level of the first proposition and the confidence level of the second proposition is greater than the first preset gap threshold, the target detection result is determined to be satisfactory. Alternatively, if the confidence level of the second proposition is not less than the first preset confidence level threshold and the difference between the confidence level of the second proposition and the confidence level of the first proposition is greater than the first preset gap threshold, the target detection result is determined to be substandard. Alternatively, if the first proposition confidence level is not less than the second preset confidence level threshold, the first proposition confidence level is less than the first preset confidence level threshold, the first proposition confidence level is greater than the second proposition confidence level, and the third proposition confidence level is less than the preset tolerance threshold, the target detection result is determined to be a tendency to meet the standard. Alternatively, if the second proposition confidence level is not less than the second preset confidence level threshold, the second proposition confidence level is less than the first preset confidence level threshold, the second proposition confidence level is greater than the first proposition confidence level, and the third proposition confidence level is less than the preset tolerance threshold, the target detection result is determined to be a tendency to fail to meet the standard. Alternatively, if the confidence level of the first proposition is less than the second preset confidence level threshold and the confidence level of the second proposition is less than the second preset confidence level threshold, the target detection result is determined to be uncertain; Alternatively, if the difference between the first proposition confidence level and the second proposition confidence level is less than a second preset gap threshold, the target detection result is determined to be uncertain; Alternatively, if the confidence level of the third proposition is not less than the preset tolerance threshold, the target detection result is determined to be uncertain.

8. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored program, wherein, when the program is executed, it controls the device where the non-volatile storage medium is located to perform the network resilience index detection method according to any one of claims 1 to 7.

9. A computer device, characterized in that, include: Memory and processor The memory stores computer programs; The processor is configured to execute a computer program stored in the memory, wherein when the computer program is executed, the processor performs the network resilience indicator detection method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the method for detecting network resilience indicators according to any one of claims 1 to 7.

Images