A Methodology for Quantitative Measurement of Cyber Resilience (QMOCR)

Author(s):

Alexander Kott, Michael J Weisman, Joachim Vandekerckhove, Jason E Ellis, Travis W Parker, Brian J Murphy, and Sidney Smith

Abstract:

This report describes a methodology for measuring—quantitatively and experimentally—the cyber resilience of a system when subjected to a cyber attack. We use the term Quantitative Measurement of Cyber Resilience (QMOCR) to refer to this methodology. The methodology is an outcome of the eponymous research project performed by the US Army Combat Capabilities Development Command Army Research Laboratory during the period of April 2021 through March 2023 in collaboration with the Pennsylvania State University Applied Research Laboratory and the University of California, Irvine. Resilience continues to gain attention as a key property of cyber and cyber-physical systems, for the purposes of cyber defense. A key challenge in the field of cyber resilience is quantifying or measuring resilience. Developers and buyers of a system must be able to quantify the cyber resilience of the system they develop or purchase. We recommend application of the QMOCR methodology especially when an actual system, its prototype, or a working, executable model (physical, digital, or digital–physical) is available.