Research on the Identification of Internet Critical Nodes Based on Multilayer Network Modeling

Abstract

The research goal of cyberspace security situational awareness analysis is to predict the future security development of the target network by acquiring, understanding, and displaying the security elements in the large-scale network environment. Current cyberspace security situational awareness systems are mostly based on traditional single-layer network topology to analyze the security of the target network's operational posture. However, as the scale of the network continues to expand, the network structure becomes more complex, and the information fusion in multiple fields in practical applications deepens, the single-layer topology model can no longer meet the analysis requirements. In this paper, we construct a multilayer network topology model for cyberspace security situational awareness by integrating multidimensional information in the physical device layer network, business application layer network, and user role layer network. Meanwhile, to eliminate the limitations of traditional node importance indicators, a node importance assessment indicator that integrates topological centrality and node dependency factor is proposed in conjunction with model characteristics: multilayer dependency CRITIC indicator ( MDCI ). On the one hand, MDCI fits a variety of evaluation metrics through the CRITIC multi-attribute decision method to comprehensively assess the importance of nodes in network centrality, and on the other hand, MDCI better aggregates the important contributions of nodes in each network layer based on node dependency factor to coordinate multilayer network information. The experimental results show that MDCI has better ordering monotonicity and generates more stable metric sequences, and can effectively cause large-scale failures in multilayer network while destroying fewer physical device components, which can be better adapted to the critical node identification needs of multilayer network.

Research on a Critical Link Discovery Method for Network Security Situational Awareness

“…MDLE e 1 = (LLBME e 1 ) −1 + ∑ e 2 S e 2 (12) In Equation (12), LLBME e 1 characterizes the link-local betweenness mapping entropy in the first-order central domain, and since the values of the entropy-like metrics are negatively correlated with the importance of the link, the inverse is taken here as the primitive score of the link's importance. S e 2 then denotes the score of the importance of the rest of the neighboring links, other than the samedirection dependency links, that are connected to the target endpoint β of link e 1 when link e 1 is a dependent link.…”

“…In previous work [12], we focused on identifying critical nodes in multi-layer network models. To achieve this, we propose a method that combines multi-attribute decision making and node-dependent mechanisms.…”