Abstract:

Cyber resilience emphasizes the system’s ability of perception, resistance, recovery, and adaptation when facing disasters or attacks. Constructing a resilient cyberspace can reduce security collapses and meanwhile mitigate the damage caused by security collapses and recover quickly from them, thereby enhancing the security resilience of cyberspace. The primary task in developing cyber resilience is to assess cyber resilience. This paper first briefly introduced the concept of cyber resilience and the need for resilience assessment. Subsequently, we reviewed the existing research from two aspects: cyber resilience assessment frameworks and assessment methods. For assessment frameworks, a classification method for existing frameworks from the perspective of process-oriented and result-oriented was proposed. For assessment methods, an introduction to existing methods from qualitative and quantitative perspective was provided. Moreover, this paper furthermore discussed the advantages and challenges associated with each type of framework and method. This analysis was important for guiding the application of existing frameworks and methods, as well as for researching new assessment frameworks and methods. Finally, we summarized and discuss the future directions of cyber resilience assessment.

Key words: cyber resilience assessment, process-oriented assessment, result-oriented assessment, area under the curve, network topology