A Resilience Quantitative Assessment Framework for Cyber–Physical Systems: Mathematical Modeling and Simulation
Source abstract
Abstract
As cyber threats continue to grow in complexity and persistence, resilience has become a critical requirement for cyber–physical systems (CPSs). Resilience quantitative assessment is essential for supporting secure system design and ensuring reliable operation. Although various methods have been proposed for evaluating CPS resilience, major challenges remain in accurately modeling the interaction between cyber and physical domains and in providing structured guidance for resilience-oriented design. This study proposes an integrated CPS resilience assessment framework that combines cyber-layer anomaly modeling based on Markov chains with mathematical modeling of performance degradation and recovery in the physical domain. The framework establishes a structured evaluation process through parameter normalization and cyber–physical coupling, enabling the generation of resilience curves that clearly represent system performance changes under adverse conditions. A case study involving an industrial controller equipped with a diversity-redundancy architecture is conducted to demonstrate the applicability of the proposed method. Modeling and simulation results indicate that the framework effectively reveals key resilience characteristics and supports performance-informed design optimization.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Infrastructure Resilience and Vulnerability Analysis · Risk and Safety Analysis · Smart Grid Security and Resilience
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Purple Mountain Laboratories, No. 9 Mozhou East Road, Nanjing 211111, China
School of Cyber Science and Engineering, Southeast University, Nanjing 211189, China
China Electric Power Research Institute, No. 8 Nanrui Road, Nanjing 210003, China
Funding
National Key R&D Program of China · Jiangsu Provincial Natural Science Foundation of China
References (45)
Show source-provided references
1. Almulhim, A.I. (2025). Building Urban Resilience Through Smart City Planning: A Systematic Literature Review. Smart Cities (2624-6511), 8.10.3390/smartcities8010022 ↗
2. A survey on cyber resilience: Key strategies, research challenges, and future directions10.1145/3649218 ↗
3. Lee, H., Kim, S., and Kim, H.K. (2022, January 27–29). SoK: Demystifying cyber resilience quantification in cyber-physical systems. Proceedings of the 2022 IEEE International Conference on Cyber Security and Resilience (CSR), Rhodes, Greece.10.1109/CSR54599.2022.9850312 ↗
4. A systems and control perspective of CPS security10.1016/j.arcontrol.2019.04.011 ↗
5. Resilience assessment of complex urban systems to natural disasters: A new literature review10.1016/j.ijdrr.2018.05.015 ↗
6. A review on resilience assessment of energy systems10.1080/23789689.2019.1610600 ↗
7. A survey on cyber-resilience approaches for cyber-physical systems
8. Tiered approach to resilience assessment10.1111/risa.12991 ↗
9. Quantifying organisational resilience: An integrated resource efficiency view10.1080/00207543.2023.2296018 ↗
10. Ross, R., Pillitteri, V., Graubart, R., Bodeau, D., and McQuaid, R. (2021). Developing Cyber-Resilient Systems: A Systems Security Engineering Approach, National Institute of Standards and Technology. Technical report.10.6028/NIST.SP.800-160v2r1 ↗
11. Bodeau, D.J., Graubart, R.D., McQuaid, R.M., and Woodill, J. (2018). Cyber Resiliency Metrics Catalog, The MITRE Corporation.
12. Bodeau, D.J., Graubart, R.D., McQuaid, R.M., and Woodill, J. (2018). Cyber Resiliency Metrics, Measures of Effectiveness, and Scoring, The MITRE Corporation.
13. Stouffer, K., Stouffer, K., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V., Lightman, S., Hahn, A., Saravia, S., and Sherule, A. (2023). Guide to Operational Technology (OT) Security, US Department of Commerce, National Institute of Standards and Technology. Technical report.10.6028/NIST.SP.800-82r3 ↗
14. White, G.B., and Sjelin, N. (2024). The NIST Cybersecurity Framework (CSF) 2.0, National Institute of Standards and Technology. Technical report.
15. Juma, A.H., Arman, A.A., and Hidayat, F. (2023, January 6–7). Cybersecurity assessment framework: A systematic review. Proceedings of the 2023 10th International Conference on ICT for Smart Society (ICISS), Bandung, Indonesia.10.1109/ICISS59129.2023.10291832 ↗
16. Cybersecurity in the EU: How the NIS2-directive stacks up against its predecessor10.1016/j.clsr.2023.105890 ↗
17. Wu, J. (2024). Cyber Resilience System Engineering Empowered by Endogenous Security and Safety, Springer.10.1007/978-981-97-0116-2 ↗
18. Computational red teaming: Past, present and future10.1109/MCI.2010.939578 ↗
19. Yulianto, S., Soewito, B., Gaol, F.L., and Kurniawan, A. (2023, January 8–9). Metrics and Red Teaming in Cyber Resilience and Effectiveness: A Systematic Literature Review. Proceedings of the 2023 29th International Conference on Telecommunications (ICT), Toba, Indonesia.10.1109/ICT60153.2023.10374053 ↗
20. Snyder, D., and Heitzenrater, C. (2024). Enhancing Cybersecurity and Cyber Resiliency of Weapon Systems: Expanded Roles Across a System’s Life Cycle, RAND Corporation. Technical report.
21. Strom, B.E., Applebaum, A., Miller, D.P., Nickels, K.C., Pennington, A.G., and Thomas, C.B. (2018). Mitre ATT&CK: Design and Philosophy, The MITRE Corporation. Technical Report.
22. Xiong, T., Lina, G., Guifen, Z., and Donghong, Q. (2021, January 28–31). A intrusion detection algorithm based on improved slime mould algorithm and weighted extreme learning machine. Proceedings of the 2021 4th International Conference on Artificial Intelligence and Big Data (ICAIBD), Chengdu, China.10.1109/ICAIBD51990.2021.9458967 ↗
23. Enhancing cybersecurity resilience through advanced red-teaming exercises and MITRE ATT&CK framework integration: A paradigm shift in cybersecurity assessment10.1016/j.csa.2024.100077 ↗
24. Fink, G.A., Griswold, R.L., and Beech, Z.W. (2014, January 19–21). Quantifying cyber-resilience against resource-exhaustion attacks. Proceedings of the 2014 7th International Symposium on Resilient Control Systems (ISRCS), Denver, CO, USA.10.1109/ISRCS.2014.6900093 ↗
25. Evaluating resilience of water distribution networks to operational failures from cyber-physical attacks10.1061/(ASCE)EE.1943-7870.0001665 ↗
26. Kott, A., and Linkov, I. (2019). Cyber Resilience of Systems and Networks, Springer.10.1007/978-3-319-77492-3 ↗
27. Resilience assessment framework for fast response process systems10.1016/j.psep.2022.05.016 ↗
28. Cyber-physical resilience: Definition and assessment metric10.1109/TSG.2017.2776279 ↗
29. Resilience analysis of cyber-physical systems: A review of models and methods10.1111/risa.14089 ↗
30. Towards a cyber resilience quantification framework (CRQF) for IT infrastructure10.1016/j.comnet.2024.110446 ↗
31. Systems resilience assessments: A review, framework and metrics10.1080/00207543.2021.1971789 ↗
32. Almaleh, A. (2023). Measuring resilience in smart infrastructures: A comprehensive review of metrics and methods. Appl. Sci., 13.10.3390/app13116452 ↗
33. Quantitative measurement of cyber resilience: Modeling and experimentation10.1145/3703159 ↗
34. Redundancy planning for cost efficient resilience to cyber attacks10.1109/TDSC.2022.3151462 ↗
35. Modelling and evaluation of the security of cyber-physical systems using stochastic Petri nets10.1049/iet-cps.2018.0008 ↗
36. Chen, C., Wu, W., Zhou, H., and Shen, G. (2011, January 23–25). A Semi-Markov Survivability Evaluation Model for Intrusion Tolerant Real-Time Database Systems. Proceedings of the 2011 7th International Conference on Wireless Communications, Networking and Mobile Computing, Wuhan, China.10.1109/wicom.2011.6040583 ↗
37. Kotenko, I., Saenko, I., and Lauta, O. (2018, January 27–29). Analytical modeling and assessment of cyber resilience on the base of stochastic networks conversion. Proceedings of the 2018 10th International Workshop on Resilient Networks Design and Modeling (RNDM), Longyearbyen, Norway.10.1109/RNDM.2018.8489830 ↗
38. Hausken, K., Welburn, J.W., and Zhuang, J. (2024). A Review of Attacker–Defender Games and Cyber Security. Games, 15.10.3390/g15040028 ↗
39. Resilience assessment of critical infrastructures using dynamic Bayesian networks and evidence propagation10.1016/j.ress.2023.109691 ↗
40. Monitoring and defense of industrial cyber-physical systems under typical attacks: From a systems and control perspective10.1109/TICPS.2023.3317237 ↗
41. Xing, W., and Shen, J. (2024). Security Control of Cyber–Physical Systems under Cyber Attacks: A Survey. Sensors, 24.10.3390/s24123815 ↗
42. Weisman, M.J., Kott, A., and Vandekerckhove, J. (2023, January 22–24). Piecewise linear and stochastic models for the analysis of cyber resilience. Proceedings of the 2023 57th Annual Conference on Information Sciences and Systems (CISS), Baltimore, MD, USA.10.1109/CISS56502.2023.10089725 ↗
43. Analysis of operating system diversity for intrusion tolerance10.1002/spe.2180 ↗
44. Khan, M., and Babay, A. (2023, January 25–29). Making intrusion tolerance accessible: A cloud-based hybrid management approach to deploying resilient systems. Proceedings of the 2023 42nd International Symposium on Reliable Distributed Systems (SRDS), Marrakesh, Morocco.10.1109/SRDS60354.2023.00033 ↗
45. Shoker, A., Rahli, V., Decouchant, J., and Esteves-Verissimo, P. (2023, January 20–23). Intrusion resilience systems for modern vehicles. Proceedings of the 2023 IEEE 97th Vehicular Technology Conference (VTC2023-Spring), Florence, Italy.10.1109/VTC2023-Spring57618.2023.10200532 ↗