1. Introduction

To achieve precise evaluation of a system or project, it is vitally important to establish a quantitative evaluation index system and a corresponding accurate metric value. Utility is a fundamental metric indicator for characterizing the performance of systems or projects, and is widely used in various kinds of assessment for systems or projects at different levels. In normal physical systems, utility is an "energy” characteristic, which can be computed comprehensively by applying physical principles and parameters. However, it is difficult to characterize the utility of systems that are established on logical association, behavioral evolution, and reasoning [1]. In general, the assessment of such systems is currently limited to rough comparative calculations [2].

1.1. Behavior utility is a descriptive form of system functions

Behaviors [3] are usually interpreted as mannerisms that are manifested and controlled by thoughts, whose existence relies on specific scenarios. Behavior [4] is a kind of action that causes an object to change its present state under rational drives. Locomotory movements of the components of the scenery from one state to another result from the behavioral action. The action of compound behaviors and the resulting locomotory movements comprise behavior utility.

A system [5] is a combination of three elements interacting with each other: environment, structure, and function. There is a close relationship between system behaviors and the elements in a system. A behavioral scene is made up of the connection between the system and its environment, and the structure of the connections of the components of the system. System behavior produces interaction between structures, and integrates the environment with the structure. A system function is property and ability that is exhibited by the interaction between the system and the external environment, and can be described by system behavior utility.

《1.2. Using network behavior utility to describe network services and applications》

1.2. Using network behavior utility to describe network services and applications

A network is a virtual space that performs all kinds of operations and tasks. In a network system, the network objects consist of various hardware and software equipment, along with information processes that support the operations and tasks. The acquisition, transmission, processing, storage, and sharing of network information comprise network behavior, and the performance of the operations and tasks of network behavior comprises the network behavior process. Any network behavior occurring in a network scenario consists of all the components and systems that are providing digitized information (including various hardware and software devices, sessions of information processes, and so on).

Various features of network services and applications are manifested by the evolution of various network behaviors that are oriented toward the objectives of the tasks. In essence, a network application system is intended to implement network behavior organization and control. Thus, the characteristics of network services and applications [6] can be described in terms of behavior utility.

With the aim of calculating the behavior utility of a network system, this paper uses the concept of the differential manifold [7] and tensor analysis [8], to provide mathematic definitions and descriptions of network behavior, behavior path, and behavior utility. The calculating method and the principle of network behavior utility proposed here are based on differential geometry [9–12]. We also provide a calculation framework to measure the network attackdefense confrontation, thus, we offer a mathematical foundation for the quantitative measurement and evaluation of network behavior.

2. Concepts of network behavior utility

Suppose that various types of objects in a network form a nonempty set A, and that A satisfies the following constraints:

• A contains at least two different elements; and

• The elements in A are interrelated in a certain way.

Then A is called a network system, and the elements of A are the components of the network system.

A network scenario is described as a network logical topology with nodes and connections that can be represented as a multidimensional weighted graph in mathematics. For the special multidimensional weighted graph of a network scenario, the network behavior can be described as a transformation connecting points, lines, surfaces, bodies, and other information. The conducting of network service and tasks can be described as a process that compounds the above transformation processes.

2.1. Differential manifolds of network scenarios

An affine space can be established based on the network logic topology. The mapping between different elements in set A can be established as follows:

where is the m-dimensional vector space. The mapping maps any pair of ordered points p, q in A to a vector  , which satisfies the following conditions: 

Hence, a network scenario based on the network logic topology can be described as an m-dimensional affine space, and the scenario of a particular network behavior is a subspace of an m-dimensional affine space. Thus, a network scenario can be described as a differential manifold. In other words, the network logic topology corresponding to the network scenario and its added attributes can be described as m-dimensional differential manifolds.

Suppose a network scenario is an m-dimensional smooth differential manifold M; we can then build a differential geometry description for scenarios, states, and utilities in the network space, as shown in Fig. 1.

《Fig.1》

Fig. 1. Scenario, behavior, state, and utility of the differential geometry description.

Thus, we can give a basic definition and a mathematical description of network behavior, behavior path, and behavior utility based on the differential manifold.

2.2. Network behavior and behavior path

Definition 2.1: Behavior refers to a homeomorphic transformation from one covering to another in the differentiable manifold of the scenario.

Suppose φ: M→M is a smooth homeomorphic mapping of smooth manifold M to itself; then φ is called a behavior of M. A behavior from a ∈ M to b∈M establishes a path space ΩM(a,b):

The self-homeomorphic mapping of each point on the path space ΩM(a,b) can be described as a transformation. Transformations of all points on ΩM(a,b) can be combined into a transformation group called a behavior transformation group.

The homeomorphic transformation from a∈M to b∈M forms a segmented smooth directional curve connecting a; b∈M in the path space ΩM(a,b), as shown in Fig. 2.

Fig. 2. Behavior, behavior path, and displacement.

Definition 2.2: A behavior path is a directed segmented smooth curve that connects the starting point and the ending point of the behavior transformation.

For a behavior path connecting a; b∈M

where  ρ is referred as the behavior path curve. Any point on the path curve is called a point position, and t∈[0,1]  is called the point position parameter.

For any point position on the behavior path, the transformation will cause the point to make an instantaneous movement along the behavior curve path. A behavior path has the following properties:

(1) Parallel movement of the point position. The movement of any point position on the behavior path occurs simultaneously with a parallel movement on the tangential field of the path curve ρ.

For each point position of the path curve, the instantaneous velocity is the tangent of the path curve at that point, and the direction of the instantaneous movement is the instantaneous velocity direction of the point position. Thus, in the tangent space of the differential manifold M, there exists a vector field paralleling the tangent of the path curve. Furthermore, the movement along the path curve can be described as a parallel movement on the vector field.

The parallel movement of the point position establishes the linear isomorphism of the tangent space T_ρ(0)M and the tangent space T_ρ(t)M along the path curve ρ.

(2) Uniqueness of the parallel vector field. There exists a unique vector field, which parallels the tangent of the behavior path curve on the differential manifold.

For path curve described in Eq. (3), we define v₀ as the velocity (i.e., tangent vector) of the path curve ρ at point a (t = 0). Thus, on the manifold M, we can determine the only tangent vector field v(t) parallel to the tangent vector along the path curve based on the starting point moving velocity v₀ of the behavior path. As a component of v(t), vⁱ(t) is the unique solution to the following homogeneous linear ordinary differential equations:

where ; X is the tangent vector field; i, j, and k are the indexes of coordinate component; and is the Christoffel symbol of the point ρ(t).

2.3. The action and utility of network behavior

The instantaneous movement of the point changes with the homeomorphic transformation at any point in the behavior path, thus allowing the action of the behavior to be defined.

Definition 2.3: The action of a certain point on the behavior path is the transformation changing the movement state of the point.

Derive the derivative of t

where l is an coordinate component;  is the Christoffel symbol, which satisfies

Thus, the total derivative of the vector component uⁱ for the parameter t is:

where the first term reflects the variation of the component uⁱ with the parameter t, and the second term reflects the change in the instantaneous basic vector due to the change in the point caused by the point position movement.

In Eq. (13), is the covariance derivative of g_i(t) on ρ'(t). Since g_i（t）is the parallel movement of g_i along ρ, we have

According to Eqs. (13) and (15), the action of point position ρ(t) on the behavior path is

where u(t) is the tangent vector of the behavior path curve ρ at the point ρ(t), and g_i is the instantaneous covariant vector of the point position at time t.

Therefore, for any point position ρ(t) on the behavior path curve ρ, Eq. (16) gives the calculation of the action D[v,ρ'(t)] at the point position.

3.2. Calculation method for network system behavior utility

The tangent vector of the path curve ρ is

When ρ'(t), the corresponding point is the critical point; when ρ'(t)≠0, the corresponding point is a regular point on the curve. If all points on the curve are regular points, the curve becomes a regular curve.

The critical point is the cutoff point of the path space ΩM(a,b) described by Eq. (2). The critical point ρ'(t_c)=0 (t_c is the critical value) has the following features:

• The differential element of utility at the critical point is 0; that is, E_ρ(tc)=0 , because D[v,ρ'(t)]=0.

• Different calculation forms for the differential element of utility are applied around the critical point. We have an infinitesimal positive number ε at t_c to make ΩM^tc-ε  different from ΩM^tc+ε , thus, the calculation forms of vector field ρ'(t) are different. Suppose path curve ρ contains d critical points, denoted by

where c_i is the ith critical value and these critical points divide the behavior interval [a,b] into the following d+1 regular segments:

Thus, the behavior utility calculation on the behavior path can be transformed into a behavior utility problem on a regular segment.

For u(t), suppose   ,  we then have

where R(V,U) is the curvature of operator, which satisfies

Solving the ordinary differential Eqs. (25) and (27), we obtain the unique solution: v(t), u(t).

3.3. Calculation principle of behavior utility

3.3.1. Determination of the critical point of the path curve

From Eq. (3), if c is the critical point for the behavior path curve ρ, then the gradient ▽ρ(c) of ρ at c is 0, and under the local coordinates (χ¹,χ²,…,χ^m) of c, are

If the Hessian matrix of ρ at c is non-degenerate, that is,

then there are m eigenvalues λ_j(1≤j≤m) for Hρ(c). If the number of negative eigenvalues in λ_j is k, then k is called the Morse index of the critical point c.

According to Morse theory, if c ∈ρ^-1[a,b] is the only critical point, then M^b is homotopically equivalent to the CW complex

where represents the disjoint union, S^k is a k-dimensional sphere, and φ :δS^k →M^a represents a homeomorphism.

For the differential manifold of regular segments on the behavior path, we use the homotopically equivalent CW complex description. The Morse index of ci at the critical point is defined as k_i. At the starting point of the path, we have k₀ =0; Morse theory is used to obtain the homotopically equivalent relation of the differential manifold, as shown in Table 1.

《Table 1》

Table 1 Homotopical equivalence of differential manifolds.

When calculating the behavior utility of each regular segment, we use the homotopically equivalent CW complex as the descriptive manifold of M.

3.3.2. The principle of behavior utility on the path

The behavior utility of a path curve ρ is the sum of the behavior utility of all regular segments on it; that is,

where is the behavior utility of the behavior in the regular segment of the path curve.

In an arbitrary regular segment of the path curve, let the path curve be ρ_i , and let . Then from Eq. (4), we have

where ρ'_i(t) is the tangent of the path curve at the point position ρ_i(t), v(t) is a vector field determined by the tangent vector of ρ_i(0) and its parallel ρ_i(t), D[v_i,ρ'_i(t)] is the action of ρ_i(t) on the behavior path, ds_ρi(t) is the infinitesimal movement vector of the point position ρ_i(t).

4. Evaluation framework of the network attackdefense confrontation based on behavior utility

A network system security evaluation can be performed from a variety of perspectives, with different methods of evaluation for each perspective. During the assessment process of the network attack and defense, we are often confronted with the question of whether a given network security defense system has enough ability to resist a certain type of attack. This paper proposes an evaluation framework for such questions by calculating the utility of network attack and defense.

4.1. Identification and recognition of network attack and defense

The essence of network system security is a balance between network attack and defense from the perspective of offensive and defensive confrontation. Network attack and defense can be manifested as network behavior. In certain network scenarios, we can establish behavior utility judgment and identification criteria of the network system security, as shown in Fig. 4.

《Fig.4》

Fig. 4. Utility criteria for network system security.

where E_D is the defense behavior utility and E_A is the attack behavior utility.

A network attack is a process composed of a number of different sessions. For each attack target, we can determine the corresponding attack behavior and attack scenarios. At the same time, there are corresponding defensive goals and behaviors in the corresponding attack scenarios, as shown in Fig. 5.

《Fig.5》

Suppose the given attack A consists of n sessions; the attack behavior corresponding to the ith session is