Center for disease control network resilience assessment and attack adaptive response system based on digital twinning

Abstract

The present application relates to the technical field of digital twinning, in particular to a disease control center network elasticity evaluation and attack adaptive response system based on digital twinning. It comprises: a digital twinning modeling unit for constructing a digital twinning model containing a business-network correlation matrix and a business tolerance threshold; an elasticity evaluation unit for generating the elasticity coefficient of each network node or link; an attack detection unit for monitoring attacks and generating an alarm containing the attack type; a response strategy generation unit for generating a candidate response strategy according to the attack type and the elasticity coefficient; a strategy evaluation and admission unit for simulating the execution of the candidate strategy in the twinning model, calculating the business interruption risk index, and allowing deployment to the physical network when the preset risk threshold condition is met. The system realizes multi-dimensional quantitative evaluation of network elasticity through a digital twinning model, and guarantees the continuous operation of disease control business during the attack response process through a strategy simulation admission mechanism.

Description

Technical Field

[0001] This invention relates to the field of digital twin technology, and more specifically, to a network resilience assessment and attack adaptive response system for disease control centers based on digital twins. Background Technology

[0002] The network of disease control centers carries critical functions such as epidemic data reporting, infectious disease monitoring and early warning, and emergency command and dispatch. Its network security is directly related to the efficiency of handling public health emergencies. In recent years, cyberattacks targeting medical and disease control institutions have occurred frequently, including denial-of-service attacks, APT penetration attacks, and data theft attacks, which seriously affect the continuity of disease control operations and data integrity.

[0003] Currently, protection solutions for CDC networks mainly fall into two categories. One category is protection solutions based on traditional network security equipment, such as deploying firewalls, intrusion detection systems, and web application firewalls, which identify attacks through static rules or signature databases and execute preset blocking, rate limiting, or isolation policies. The other category is dynamic defense solutions based on network resilience assessment, which have emerged in recent years. These solutions evaluate network resilience by monitoring network status indicators (such as bandwidth, latency, and packet loss rate) and trigger emergency response strategies when an attack occurs.

[0004] However, existing solutions have significant drawbacks. First, traditional protection solutions only consider the characteristics of the attack itself when implementing response strategies, without assessing the actual impact of the strategy on disease control service nodes. Second, existing resilience assessment methods mostly focus on network layer indicators (such as connectivity and throughput), lacking a comprehensive quantification of the resilience of the disease control service layer and data layer, and thus failing to accurately reflect the impact of cyberattacks on core disease control services. Third, existing response strategies lack pre-verification mechanisms and are often deployed directly to the physical network; if the strategy is inappropriate, it may actually exacerbate the risk of service interruption.

[0005] Therefore, there is an urgent need to design a network resilience assessment and attack adaptive response system for disease control centers based on digital twins. Summary of the Invention

[0006] The purpose of this invention is to provide a digital twin-based network resilience assessment and attack adaptive response system for disease control centers, in order to solve the problems mentioned in the background art.

[0007] To achieve the above objectives, the present invention aims to provide a network resilience assessment and attack adaptive response system for disease control centers based on digital twins, comprising:

[0008] A digital twin modeling unit is used to construct a digital twin model of the physical network of the disease control center. The digital twin model includes a business-network association matrix, which records the dependency relationships and dependency strength coefficients between disease control business nodes and network resources, and stores the business tolerance threshold of each disease control business node.

[0009] The resilience assessment unit is used to assess the resilience of the collected real-time operational data of the disease control center's physical network based on the digital twin model, and generate resilience coefficients for each network node and / or each network link.

[0010] An attack detection unit is used to monitor attack behaviors in the physical network in real time and generate an attack alarm containing the attack type when an attack is detected.

[0011] A response strategy generation unit is used to respond to the attack alarm and generate at least one candidate response strategy based on the attack type and the resilience coefficient.

[0012] The strategy evaluation and admission unit is used to simulate the execution of the candidate response strategy in the digital twin model. Based on the simulation execution results and the service-network correlation matrix, it calculates the interruption time of each affected disease control service node, and calculates the service interruption risk index based on the ratio of the interruption time to the service tolerance threshold of the disease control service node. When the service interruption risk index meets the preset risk threshold condition, the candidate response strategy is allowed to be deployed to the physical network.

[0013] As a further improvement to this technical solution, the business tolerance threshold is pre-configured according to the disease control business specifications, and the business tolerance threshold of different disease control business nodes is independently configured according to the business specifications; the business tolerance threshold represents the maximum interruption time that the corresponding disease control business node can withstand.

[0014] As a further improvement to this technical solution, the elasticity coefficient is generated in the elasticity evaluation unit as follows:

[0015] The elasticity score is calculated from three dimensions: network layer, data layer, and business layer, and then weighted and combined to obtain the elasticity coefficient.

[0016] Among them, the network layer resilience score is based on network topology connectivity and link throughput, the data layer resilience score is based on the completeness and real-time performance of epidemic data reporting, and the business layer resilience score is based on the availability of disease control business function nodes.

[0017] As a further improvement to this technical solution, the attack detection unit includes multiple traffic probes and log collection probes deployed in the physical network. The attack detection unit can identify attack types based on rule matching and anomaly detection algorithms. The attack types include at least denial-of-service attacks, APT penetration attacks, and data theft attacks.

[0018] As a further improvement to this technical solution, the strategy evaluation and admission unit includes a side effect simulation module and a strategy admission control module;

[0019] The side effect simulation module is used to simulate the execution of the candidate response strategy in the digital twin model. Based on the simulation results and the business-network correlation matrix, it determines the disease control business nodes affected by the candidate response strategy and calculates the interruption time of each affected disease control business node by using different interruption time conversion methods for different types of candidate response strategies. The candidate response strategies include at least rate limiting strategies.

[0020] The strategy access control module receives the interruption time output by the side effect simulation module, calculates the business interruption risk index based on the ratio of the interruption time to the business tolerance threshold of the corresponding disease control business node, compares the business interruption risk index with a preset risk threshold, and uses the business interruption risk index being less than or equal to the preset risk threshold as the preset access condition. If the condition is met, deployment is allowed; otherwise, an adjustment instruction is sent to the response strategy generation unit.

[0021] As a further improvement to this technical solution, the interruption time in the side effect simulation module is obtained in the following specific way:

[0022] Simulate the available bandwidth after rate limiting in a digital twin model;

[0023] Calculate the actual bandwidth obtained after rate limiting based on the minimum bandwidth requirement of each affected disease control service node;

[0024] When the actual bandwidth obtained is lower than the minimum bandwidth requirement, the equivalent interruption time is calculated by multiplying the bandwidth shortfall ratio by the rate-limiting duration.

[0025] As a further improvement to this technical solution, when the policy admission control module refuses to deploy the current candidate response policy, it sends an adjustment instruction to the response policy generation unit, triggering the response policy generation unit to generate a new candidate response policy with modified parameters, and the side effect simulation module and the policy admission control module re-simulate and compare the new candidate response policy.

[0026] As a further improvement to this technical solution, the response strategy generation unit includes a strategy knowledge base. When the candidate response strategy is rejected and its parameter adjustment cannot satisfy the business interruption risk index being less than or equal to a preset risk threshold, the response strategy generation unit retrieves one or more alternative response strategies from the strategy knowledge base and sends them to the side effect simulation module and the strategy admission control module in order of priority for verification.

[0027] As a further improvement to this technical solution, in the strategy evaluation and admission unit, when all candidate response strategies fail to meet the requirement that the business interruption risk index is less than or equal to the preset risk threshold, a manual intervention alarm is issued and the automatic response process is suspended.

[0028] As a further improvement to this technical solution, the digital twin modeling unit dynamically adjusts the modeling accuracy and update frequency of each network node and each network link in the digital twin model based on the elasticity coefficient generated by the elasticity evaluation unit.

[0029] Among them, network nodes or links with elasticity coefficients lower than the preset elasticity threshold adopt the high-fidelity model, while network nodes or links with elasticity coefficients higher than the preset elasticity threshold adopt the reduced-order model.

[0030] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0031] This digital twin-based system for assessing the resilience of disease control center networks and for adaptive attack response enables multi-dimensional quantitative assessment of network resilience by constructing a digital twin model that includes a business-network correlation matrix and business tolerance thresholds. Through a policy-simulated admission mechanism, the system pre-calculates a business interruption risk index in the twin model and compares it with the tolerance threshold, thereby enabling adaptive and secure deployment of attack response strategies. This approach effectively handles network attacks while maximizing the continuous operation of critical disease control services. Attached Figure Description

[0032] Figure 1 This is a flowchart illustrating the overall process of the present invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] Example: Please refer to Figure 1As shown, a digital twin-based network resilience assessment and attack adaptive response system for disease control centers is provided, comprising a digital twin modeling unit, a resilience assessment unit, an attack detection unit, a response strategy generation unit, and a strategy assessment and access unit. The strategy assessment and access unit further includes a side effect simulation module and a strategy access control module.

[0035] The overall system operation logic is as follows: The digital twin modeling unit first constructs a digital twin model containing a business-network correlation matrix and a business tolerance threshold. The resilience assessment unit dynamically generates resilience coefficients for each network node and link based on this model. The attack detection unit monitors attack behavior in the physical network in real time and generates attack alarms. In response to the alarm, the response strategy generation unit generates candidate response strategies based on the attack type and the current resilience coefficients, and sends the strategy to the strategy evaluation and admission unit. Within this unit, the side effect simulation module simulates the execution of candidate strategies in the digital twin model and calculates the interruption time for each affected disease control business node. The strategy admission control module calculates the business interruption risk index based on the ratio of the interruption time to the business tolerance threshold, and uses whether the index is less than or equal to 1 as an admission condition to determine whether to deploy the strategy to the physical network. If the strategy is rejected, the system automatically triggers parameter adjustment or alternative strategy retrieval, forming an iterative verification closed loop.

[0036] Through the division of labor and cooperation among the above modules and units, this invention achieves a complete automated process from network state awareness and attack response decision-making to policy side effect quantification verification and access control. The specific processes of the above unit modules are as follows:

[0037] To achieve accurate modeling of the dependencies between services and network resources in the physical network of disease control centers, and to provide a data foundation for subsequent side effect assessment, this invention establishes a digital twin modeling unit. This module uses acquisition probes deployed in the physical network to periodically obtain network topology information, link status parameters, server operating status, and service configuration data of each disease control service node, constructing a digital twin model that is synchronized with the physical network in real time.

[0038] The core data structure of the digital twin model is a business-network association matrix. This matrix records the mapping relationship between each disease control business function node (such as the infectious disease direct reporting system, emergency command system, epidemic data analysis system, and cross-agency data exchange gateway) and the underlying network resources (including links, switch ports, server processes, and storage volumes). Each row in the matrix corresponds to a business node, each column corresponds to a network resource, and each matrix element is a dependency strength coefficient, a real number between 0 and 1, representing the degree of dependence of the business node on the network resource—1 indicates complete dependence (the business will be completely interrupted if the resource is unavailable), 0 indicates no dependence, and values ​​between 0 and 1 indicate partial dependence. This matrix not only contains static mapping information (such as a business running on a certain server) but also dynamic weights (such as the proportion of bandwidth a business is currently using on a certain link, or the proportion of connections on a certain port).

[0039] Furthermore, the digital twin modeling unit stores a business tolerance threshold for each disease control business node. This threshold represents the maximum interruption time that the business node can withstand, measured in seconds. The tolerance thresholds for different business nodes are pre-configured according to disease control business specifications. For example, the emergency video conferencing system is extremely sensitive to interruptions, and its tolerance threshold can be set to 1 second; the infectious disease direct reporting system has higher requirements and can be set to 5 seconds; while the batch reporting task of epidemic data has a certain tolerance for delays and can be set to 300 seconds. The technical effect of this setting is that it transforms the abstract disease control business continuity requirements into quantifiable dependency strength coefficients and tolerance thresholds, enabling the digital twin model not only to simulate network layer communication behavior but also to directly map the availability status of the business layer, providing a precise mathematical basis for subsequent resilience assessment and side effect simulation.

[0040] To dynamically assess the resilience of the CDC network and provide a basis for adaptive response decisions, this invention includes a resilience assessment unit. This module, based on a twin model constructed by a digital twin modeling unit, performs resilience assessments on real-time operational data of the collected physical network using a fixed-period or event-driven approach triggered by an attack detection unit.

[0041] Specifically, the resilience assessment unit calculates resilience scores from three dimensions: the network layer, the data layer, and the business layer.

[0042] The network layer resilience score is based on network topology connectivity and link throughput. It calculates a normalized score by measuring the packet loss rate, round-trip time and remaining bandwidth of each link and using a weighted average method.

[0043] The data layer resilience score is based on the completeness and real-time performance of epidemic data reporting. It calculates a score that reflects the health of the data stream by monitoring the backlog length of the data reporting queue, the reporting success rate, and the average latency.

[0044] The business layer resilience score is based on the availability of disease control business function nodes. It evaluates the online status and response performance of each business node through heartbeat detection and interface call success rate.

[0045] Then, the resilience assessment unit weights and combines the scores from the three dimensions according to preset weights (e.g., network layer weight 0.3, data layer weight 0.4, and service layer weight 0.3) to obtain the resilience coefficient for each network node and each network link. The value range of the resilience coefficient is from 0 to 1, with the closer to 1 indicating stronger resilience. This setting breaks through the limitation of traditional network assessments that only focus on communication performance, incorporating the data integrity and service availability specific to disease control services into the assessment system, so that the resilience coefficient can truly reflect the network's ability to ensure the continuous operation of disease control services under attacks or failures.

[0046] Furthermore, to promptly detect attacks against the CDC network and provide signals for triggering response strategies, an attack detection unit was established. This module deploys multiple traffic probes and log collection probes in the physical network, located at the mirror ports of the core switch, before and after the perimeter firewall, and inside critical server hosts.

[0047] The attack detection unit adopts a dual-engine architecture that combines rule matching and anomaly detection:

[0048] The rule matching engine uses a publicly available threat intelligence signature database to identify known attack types, including denial-of-service attacks, characteristic traffic of APT penetration attacks, data theft behaviors, etc.

[0049] The anomaly detection engine uses a baseline model built on historical traffic data to detect abnormal behavior that deviates from the baseline using statistical methods or lightweight machine learning algorithms.

[0050] When an attack is detected, the attack detection unit generates an attack alert, which includes at least information such as the attack type, the attack source IP, the attack target, and the attack strength. Through multi-probe deployment and dual-engine detection, it can comprehensively cover different areas and attack types within the CDC network, providing a reliable prerequisite for the timely triggering of subsequent response strategies.

[0051] To automatically generate appropriate candidate response strategies based on the attack situation and the current network resilience status, a response strategy generation unit is set up. Upon receiving an attack alert from the attack detection unit, this module first obtains the current resilience coefficients from the resilience assessment unit, particularly the resilience coefficients of the attacked areas. Then, the response strategy generation unit matches candidate response strategies from a pre-built strategy knowledge base based on the attack type and resilience coefficients.

[0052] The strategy knowledge base stores various response strategy templates. Each template includes the strategy type (such as link switching, node isolation, traffic rate limiting, service restart, data synchronization strategy adjustment, etc.), applicable attack types, default parameters, and expected effects after strategy execution.

[0053] The matching process employs multi-factor decision-making:

[0054] For example, when a DDoS attack is detected and the elasticity coefficient is higher than 0.7, a traffic rate limiting strategy can be prioritized; when the elasticity coefficient is lower than 0.3, more aggressive strategies such as node isolation or link switching are directly triggered.

[0055] If no directly matching template is found in the knowledge base, the response policy generation unit invokes an online policy generator based on reinforcement learning. Taking the current network state as input, it outputs a new candidate response policy with specific parameters. This dynamic integration of the network's current resilience and health status makes policy selection more intelligent and adaptable.

[0056] To quantitatively assess the side effects of candidate response strategies on disease control service continuity before deploying them to the physical network, this invention incorporates a side effect simulation module within the strategy evaluation and admission unit. This module receives candidate response strategies output by the response strategy generation unit and simulates their execution in a digital twin model.

[0057] The simulation execution process includes: modifying the state of the corresponding network resources in the twin model according to the action type of the policy. For example, for the "isolate server S1" policy, all ports of server S1 in the twin model are marked as unreachable; for the "limit link L1 to 50% of the original bandwidth" policy, the maximum available bandwidth parameter of link L1 in the twin model is modified to 50% of the original value; for the "restart service process P" policy, the process of stopping and restarting the process is simulated, and the restart time is recorded.

[0058] After the simulation is completed, the side effect simulation module iterates through all disease control business nodes based on the business-network correlation matrix, checking whether the set of network resources on which each business node depends becomes unavailable or experiences performance degradation due to policy execution. For each affected business node, the downtime is calculated.

[0059] The calculation method for interruption time varies depending on the policy type: For isolation policies, the interruption time is equal to the duration the policy remains in effect (usually the preset isolation duration or until manual removal); for restart policies, the interruption time is equal to the actual time required for the restart process (obtainable through historical records or prediction models); for rate-limiting policies, this invention proposes an equivalent interruption time conversion method—first, simulate the available bandwidth after rate limiting, then calculate the actual bandwidth that the affected service node can obtain after rate limiting based on the minimum bandwidth requirement of each affected service node, and when the actual obtained bandwidth is lower than the minimum bandwidth requirement, multiply the bandwidth gap ratio by the rate-limiting duration to obtain the equivalent interruption time.

[0060] The specific calculation formula is as follows: Let the minimum bandwidth requirement of the service node be... The actual bandwidth obtained after the speed limit is The speed limit lasts for [duration]. Then when At that time, the equivalent interruption time ;when hour, .

[0061] This quantifies the side effects of response strategies into specific "interruption times," and in particular, it proposes an equivalent conversion formula for rate-limiting strategies, enabling a unified measurement of the impact of different types of strategies on the business and providing a comparable numerical basis for subsequent access decisions.

[0062] After obtaining the interruption time of each affected service node, in order to determine whether to allow the candidate response strategy to enter the physical network for execution, the present invention further sets up a policy admission control module in the policy evaluation and admission unit.

[0063] This module receives the list of interruption times output by the side effect simulation module and reads the service tolerance threshold corresponding to each affected service node from the digital twin model. Then, for each affected service node... The policy access control module calculates its business interruption risk index. The calculation formula is: ,in The interruption time calculated by the side effect simulation module. This is the service tolerance threshold for this service node.

[0064] This ratio reflects the proportion of actual downtime relative to the business's tolerable limit: when When the interruption time does not exceed the tolerance threshold, it indicates that the business continuity is still within an acceptable range; when At this point, it indicates that the disruption has exceeded the tolerance limit and will have an unacceptable impact on disease control operations. Next, the policy access control module calculates the comprehensive business interruption risk index. This invention adopts the most stringent criterion, namely, taking the maximum value of the risk index among all affected business nodes: .

[0065] The rationale for this design is that an unacceptable disruption to any critical business function within the CDC network could lead to serious consequences; therefore, the "weakest link" principle must be adopted. The policy access control module sets the preset access conditions as follows: In other words, the policy is only allowed to be deployed if the downtime of all affected services does not exceed its tolerance threshold. If the condition is met, the policy admission control module sends the candidate response policy to the execution engine of the physical network; if the condition is not met, it sends an adjustment instruction to the response policy generation unit, requesting the generation of a new candidate response policy.

[0066] The following example illustrates a specific speed-limiting policy:

[0067] Assuming that link L1 is rate-limited to 50% of its original bandwidth, the current total traffic of link L1 in the twin model is 100Mbps, of which 60Mbps is attack traffic and 40Mbps is normal service traffic. Link L1 carries service nodes B01 (infectious disease direct reporting system, normal traffic 20Mbps, minimum bandwidth requirement 10Mbps) and B03 (batch reporting of epidemic data, normal traffic 20Mbps, minimum bandwidth requirement 15Mbps).

[0068] After the rate limit is applied, the maximum available bandwidth is 50 Mbps. Assuming the rate limiter fairly drops all traffic, the bandwidth available for normal services is... ;

[0069] The bandwidth obtained by B01 is This just meets the minimum bandwidth requirement, therefore ;

[0070] The bandwidth obtained by B03 is Below the minimum bandwidth requirement If the speed limit lasts for 10 minutes (600 seconds), then the equivalent interruption time is... Second;

[0071] B03's business tolerance threshold seconds, therefore Comprehensive risk index If the admission criteria are met, the speed limit policy can be implemented.

[0072] If the equivalent interruption time exceeds 300 seconds, then The strategy was rejected.

[0073] By using quantified risk indices and rigid access thresholds, the traditional passive "execute first, observe later" response system has been transformed, achieving a safe response closed loop of "pre-verification and access control," thus avoiding unexpected interruptions to critical disease control services due to inappropriate response strategies.

[0074] To handle automatic iterative optimization after a candidate response strategy is rejected, this invention further integrates an iterative verification mechanism into the policy admission control module. When the policy admission control module... After rejecting the current candidate response strategy and sending an adjustment instruction to the response strategy generation unit, the response strategy generation unit modifies the parameters of the original strategy according to the adjustment instruction.

[0075] For example, if the original policy is "isolate server S1", it can be adjusted to "isolate only suspicious ports on server S1"; if the original policy is "limit link L1 to 50%", it can be adjusted to "limit to 60% or 40%". The newly generated candidate response policy is sent to the side effect simulation module for simulation again, and the risk index is recalculated by the policy admission control module.

[0076] This process iterates until the admission criteria are met or the preset maximum number of iterations is reached. In each iteration, the policy admission control module can also record the relationship between parameter adjustments and changes in the risk index, which can be used to optimize subsequent policy adjustments. This allows for the automatic exploration of feasible ranges for policy parameters without human intervention, preserving defensive effectiveness as much as possible while ensuring business security, thus improving the success rate and efficiency of adaptive response.

[0077] When adjusting parameters fails to yield a strategy that meets the admission criteria, this solution provides an alternative strategy retrieval mechanism. The response strategy generation unit is configured with a strategy knowledge base, which stores not only strategy templates but also the historical execution effects of each strategy under different network conditions (including risk index, attack blocking rate, etc.). When adjustment commands fail to generate an admissible strategy within a preset number of iterations, the response strategy generation unit retrieves alternative response strategies from the knowledge base that are similar to the current attack type and resilience coefficient, prioritizing them from low to high based on historical success rate or risk index.

[0078] Then, the candidate strategies are sent to the strategy evaluation and admission unit for verification in order of priority. Once a strategy that meets the requirements is found... The strategy is to stop searching and deploying. If all alternative strategies fail to meet the access criteria, the strategy evaluation and access control unit sends a manual intervention alert to the security management interface and suspends the automatic response process, awaiting manual decision-making by the security administrator.

[0079] Through knowledge base retrieval and priority sorting, the system can quickly switch to other feasible defense solutions when strategy adjustments fail; while the final human intervention mechanism serves as a safety net, ensuring that human experts can still make judgments and intervene in extremely complex situations, thus balancing automation efficiency and security.

[0080] To optimize the computational resource consumption of digital twin models, this invention adds a dynamic modeling accuracy adjustment function to the digital twin modeling unit. This module dynamically adjusts the modeling accuracy and update frequency of each network node and network link in the digital twin model based on the elasticity coefficients generated by the elasticity evaluation unit.

[0081] Specifically, for network nodes or links with resilience coefficients lower than the preset resilience threshold, it indicates that they are currently in a vulnerable state and require high-fidelity monitoring. Therefore, a high-fidelity model is adopted, which updates their state parameters at the highest frequency (e.g., every 1 second) to simulate their internal queues, processing delays and other micro-behaviors in detail.

[0082] For network nodes or links whose resilience coefficient is higher than the preset resilience threshold, it indicates that their health status is good and the modeling overhead can be appropriately reduced. Therefore, a reduced-order model is adopted, that is, the status is updated at a lower frequency (such as every 30 seconds) and some minor details are ignored.

[0083] For cases where the elastic coefficient is equal to the preset elastic threshold, a high-fidelity model or a reduced-order model can be selected according to actual needs. This invention does not impose specific limitations.

[0084] The preset elastic threshold can be set to 0.5. In practical applications, it can be adjusted between 0.3 and 0.7 based on network size, computing resource constraints, and real-time service requirements. This threshold can be calibrated through offline simulation or field testing to balance modeling accuracy and computational overhead.

[0085] In this way, a dynamic balance between simulation accuracy and resource consumption is achieved in the edge network environment of disease control centers with limited computing resources. Computing power is concentrated on the weakest links that need the most monitoring, which not only ensures the accuracy of flexible assessment and side effect simulation, but also avoids the waste of resources caused by full-scale high-precision modeling.

[0086] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention.

Claims

1. A network resilience assessment and attack adaptive response system for disease control centers based on digital twins, characterized in that: include: A digital twin modeling unit is used to construct a digital twin model of the physical network of the disease control center. The digital twin model includes a business-network association matrix, which records the dependency relationships and dependency strength coefficients between disease control business nodes and network resources, and stores the business tolerance threshold of each disease control business node. The resilience assessment unit is used to assess the resilience of the collected real-time operational data of the disease control center's physical network based on the digital twin model, and generate resilience coefficients for each network node and / or each network link. An attack detection unit is used to monitor attack behaviors in the physical network in real time and generate an attack alarm containing the attack type when an attack is detected. A response strategy generation unit is used to respond to the attack alarm and generate at least one candidate response strategy based on the attack type and the resilience coefficient. The strategy evaluation and admission unit is used to simulate the execution of the candidate response strategy in the digital twin model, calculate the interruption time of each affected disease control service node based on the simulation execution results and the service-network correlation matrix, and calculate the service interruption risk index based on the ratio of the interruption time to the service tolerance threshold of the disease control service node. When the service interruption risk index meets the preset admission conditions, the candidate response strategy is allowed to be deployed to the physical network.

2. The network resilience assessment and attack adaptive response system for disease control centers based on digital twins as described in claim 1, characterized in that: The business tolerance threshold is pre-configured according to the disease control business specifications, and the business tolerance threshold of different disease control business nodes is configured independently according to the business specifications; the business tolerance threshold represents the maximum interruption time that the corresponding disease control business node can withstand.

3. The disease control center network resilience assessment and attack adaptive response system based on digital twins as described in claim 2, characterized in that: In the elasticity assessment unit, the elasticity coefficient is generated specifically as follows: The elasticity score is calculated from three dimensions: network layer, data layer, and business layer, and then weighted and combined to obtain the elasticity coefficient. Among them, the network layer resilience score is based on network topology connectivity and link throughput, the data layer resilience score is based on the completeness and real-time performance of epidemic data reporting, and the business layer resilience score is based on the availability of disease control business function nodes.

4. The network resilience assessment and attack adaptive response system for disease control centers based on digital twins as described in claim 3, characterized in that: The attack detection unit includes multiple traffic probes and log collection probes deployed in the physical network. The attack detection unit can identify attack types based on rule matching and anomaly detection algorithms. The attack types include at least denial-of-service attacks, APT penetration attacks, and data theft attacks.

5. The network resilience assessment and attack adaptive response system for disease control centers based on digital twins as described in claim 4, characterized in that: The strategy evaluation and admission unit includes a side effect simulation module and a strategy admission control module; The side effect simulation module is used to simulate the execution of the candidate response strategy in the digital twin model. Based on the simulation results and the business-network correlation matrix, it determines the disease control business nodes affected by the candidate response strategy and calculates the interruption time of each affected disease control business node by using different interruption time conversion methods for different types of candidate response strategies. The candidate response strategies include at least rate limiting strategies. The strategy access control module receives the interruption time output by the side effect simulation module, calculates the business interruption risk index based on the ratio of the interruption time to the business tolerance threshold of the corresponding disease control business node, compares the business interruption risk index with a preset risk threshold, and uses the business interruption risk index being less than or equal to the preset risk threshold as the preset access condition. If the condition is met, deployment is allowed; otherwise, an adjustment instruction is sent to the response strategy generation unit.

6. The network resilience assessment and attack adaptive response system for disease control centers based on digital twins as described in claim 5, characterized in that: For rate-limiting candidate response strategies, the interruption time is obtained in the side-effect simulation module as follows: Simulate the available bandwidth after rate limiting in a digital twin model; Calculate the actual bandwidth obtained after rate limiting based on the minimum bandwidth requirement of each affected disease control service node; When the actual bandwidth obtained is lower than the minimum bandwidth requirement, the equivalent interruption time is calculated by multiplying the bandwidth shortfall ratio by the rate-limiting duration.

7. The network resilience assessment and attack adaptive response system for disease control centers based on digital twins as described in claim 6, characterized in that: When the policy admission control module refuses to deploy the current candidate response policy, it sends an adjustment instruction to the response policy generation unit, triggering the response policy generation unit to generate a new candidate response policy with modified parameters. The side effect simulation module and the policy admission control module then re-simulate and compare the new candidate response policy.

8. The network resilience assessment and attack adaptive response system for disease control centers based on digital twins as described in claim 7, characterized in that: The response strategy generation unit includes a strategy knowledge base. When a candidate response strategy is rejected and its parameters cannot be adjusted to ensure that the business interruption risk index is less than or equal to a preset risk threshold, the response strategy generation unit retrieves one or more alternative response strategies from the strategy knowledge base and sends them to the side effect simulation module and the strategy admission control module in order of priority for verification.

9. The network resilience assessment and attack adaptive response system for disease control centers based on digital twins as described in claim 8, characterized in that: In the strategy evaluation and admission unit, when all candidate response strategies fail to meet the requirement that the business interruption risk index is less than or equal to the preset risk threshold, a manual intervention alarm is issued and the automatic response process is suspended.

10. The network resilience assessment and attack adaptive response system for disease control centers based on digital twins as described in claim 9, characterized in that: The digital twin modeling unit dynamically adjusts the modeling accuracy and update frequency of each network node and each network link in the digital twin model based on the elasticity coefficient generated by the elasticity evaluation unit. Among them, network nodes or links with elasticity coefficients lower than the preset elasticity threshold adopt the high-fidelity model, while network nodes or links with elasticity coefficients higher than the preset elasticity threshold adopt the reduced-order model.

Images