A Resilience Recovery Method for Complex Traffic Network Security Based on Trend Forecasting

Abstract

Due to the rapid development of information technology, a huge and complex traffic network has been established across various sectors including aviation, aerospace, vehicles, ships, electric power, and industry. However, because of the complexity and diversity of its structure, the complex traffic network is vulnerable to be attacked and faces serious security challenges. Therefore, this paper innovatively proposes a traffic network resilience recovery method based on resilience trend forecasting. In this paper, the risk value is introduced into the analysis of network fault propagation process, and the Susceptible, Infectious, Recovered, Dead-Risk (SIRD-R) fault propagation model is established. The resilience model of traffic network, which encompasses real-time resilience and overall resilience, is constructed through the integration of network resilience bearing capacity and resilience recovery capacity. Then, the resilience of complex traffic network is forecasted by using long short-term memory network, and the resilience recovery strategy of complex traffic network based on forecasting is proposed. Finally, the effectiveness and scalability of the proposed method are demonstrated through experimental analysis conducted on a diverse range of complex traffic networks, affirming its applicability in real-world scenarios.

This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

1. Introduction

In recent years, the rapid advancement of computer and communication technology has led to a widespread pursuit of intelligence and digitalization as key developmental objectives across various disciplines. In aviation, aerospace, ships, vehicles [1], electric power, industrial production and other fields, information and network construction have been carried out. Based on the complex and changeable environment scenarios faced by different fields, the complex traffic network is constructed for research and analysis. As a representation of national critical infrastructure, the constructed complex traffic network has emerged as the foremost priority in the construction of national infrastructure and is considered vital to both national security and development [2]. Consequently, it has become a prime target for state-level hacker attacks [3]. In December 2015, hackers planted a virus in the Ukrainian network, paralyzing the country’s national traffic network. In May 2017, more than 150 countries, including Ukraine, Russia, Spain, France, and the United Kingdom, suffered WannaCry ransomware attacks, damaging traffic networks and other important industrial facilities. Between March 2019 and May 2020, Venezuela was hit by multiple cyberattacks that paralyzed large areas of its national traffic network and brought the country to a near collapse. After the traffic network is attacked, its failure state continues to spread in the network, resulting in the continuous transmission and infection of neighboring nodes, and eventually the overall collapse of the network, which has a great impact on the national social economy.

In recent years, due to the lack of security prevention of the complex traffic network, there are numerous cases of network node equipment failure caused by external attacks, resulting in network collapse and serious harm, facing great security challenges. The security risks faced by the traffic network have seriously threatened human production and life, restricted the development of social economy, and become one of the major issues related to the national economy and people’s livelihood.

Traffic network is a large complex network, and its equipment systems show complex cross-interconnection characteristics. In the event of virus attacks causing the failure of one or more device nodes within the network, this state of failure can propagate to other network nodes through their interconnections, ultimately leading to a complete breakdown of the entire network. Therefore, it is imperative to investigate the propagation of failures in traffic networks following virus attacks and develop optimization methods for enhancing network resilience. This will serve to bolster security against virus attacks, mitigate economic losses, and prevent potential major accidents.

The rest of this paper is structured as follows. Section 2 introduces the related works of network resilience research. Section 3 presents the methods of the traffic network resilience modeling, prediction, and optimization. Section 4 analyzes the results of resilience modeling and optimization of traffic networks through practical case experiments. Section 5 summarizes the full text.

2. Related Works

Faced with the security challenges of the traffic network, researchers proposed the concept of network resilience, which refers to a network’s ability to deliver and sustain an acceptable level of service in the event of an attack [4]. The term “resilience” originates from Latin, signifying rebound, and was initially employed within materials science [5]. Subsequently, its application has been progressively broadened across various industries. In the face of increasingly complex and frequent network attacks, network resilience has been used in the security research of traffic network [6]. Network resilience not only represents the ability of the network to cope with attacks, but also reflects the ability of the network to respond to the performance degradation caused by attacks and the ability of the network to recover the normal working state after attacks [7].

In recent years, domestic and foreign researchers have made some progress in the study of network resilience measurement modeling. Li et al. used the ratio of system performance within the maximum allowable recovery time of network interruption to normal state performance as a measure of network resilience [5]. Galinec et al. incorporated the value of system security performance into the model and built a network resilience measurement model by evaluating the known and unknown of related parameters [8]. Based on the barrel theory, Ahmadian et al. took the resilience of the lowest component as the resilience of the network and built a network resilience measurement model [9]. Wang et al. used topological information such as network node degree distribution, link degree distribution, and connection weights to establish a quantitative model of network resilience [10]. Zhang et al. used data such as network load data and load change rate to give a quantitative expression of network resilience and verify it [11]. Ceequeti et al. studied the propagation of attacks through the connection mode among network nodes and proposed a measurement method of network resilience [12]. Wang et al. conducted research from the perspective of physical laws and combined three dimensions of robustness, adaptability, and recoverability in network resilience modeling to build a traffic network resilience measurement model [13].

In addition, many researchers have paid much attention to the recovery of network resilience, which is mainly divided into two aspects: prevention and restoration [14]. In terms of prevention, Imteaj et al. proposed an index of network demand satisfaction rate, which was combined with the index to redistribute network node load, thereby enhancing network resilience [15]. Wang et al. reconstructed network nodes based on backward/forward traffic calculation to improve network resilience [16]. Liu et al. built a network weak dependence model to improve network resilience [17]. Bartos et al. estimate the attack probability and build a blacklist for reconnaissance and monitoring, so as to prevent the deterioration of network resilience [18]. In terms of recovery, Amini et al. realized the resilience recovery of the single-lattice network by rebuilding the failed connection of nodes [19]. Hong et al. proposed a method for random maintenance of all failed nodes according to a certain probability of repair [20]. Gong et al. combined the node load recovery coefficient to form a recovery scheme considering the resilience distance and realized the optimal recovery of network resilience [21]. Laishram et al. introduced two attributes, core strength and core influence, and proposed kCore maximum resilience algorithm to improve network resilience [22].

However, there are still some problems that need to be solved in the study of network resilience of traffic network. First of all, the existing network resilience measurement methods are only an incomplete and inadequate evaluation of network resilience. Secondly, the current recovery strategies on the network resilience of the traffic network are usually analyzed from a certain aspect, lacking comprehensive research and analysis.

In order to address the aforementioned issues, this paper conducts resilience modeling, forecasting, and recovery research on the traffic network. It establishes the traffic network SIRD-R failure propagation model and network resilience model, forecasts the resilience change trend of the traffic network, and proposes the resilience recovery strategy of the traffic network based on forecasting.

3. Resilience Modeling and Optimization Method of Traffic Network

3.1. Traffic Network Failure Propagation Analysis

When certain nodes within the traffic network are subjected to attacks and subsequently fail, the resulting impact on network connectivity can trigger a chain reaction, leading to the propagation of local failures throughout the entire network. This cascade effect may ultimately result in widespread functional impairment or even complete collapse of the network, a phenomenon commonly referred to as cascade failure propagation [23]. The cascade failure propagation process of the network is shown in Figure 1.

[figure(s) omitted; refer to PDF]

Figure 1(a) shows the initial state of the network. When the network is attacked, one of the nodes is in a failed state, as shown in Figure 1(b). Due to the failure of this node, the function of the node cannot be carried out normally, and the adjacent node is affected by this node and also fails, as shown in Figure 1(c). Similarly, the failure state of a node further spreads to neighboring nodes, and finally, the overall function of the entire network fails and the network crashes, as shown in Figure 1(d).

The SIRD model is employed to examine the process of failure propagation within the traffic network, with the node devices categorized into four distinct states [24]. Failure state I: The node in this state has failed and has the ability to propagate the failure state to other nodes. Susceptible state S: At present, the node device in this state has not been propagated failure, but there is a certain possibility of failure propagation. Recovery state R: The node device in this state recovers from the failure state due to the security protection and recovery means of the device itself. Breakdown state D: In this state, the node device cannot be recovered from the failure state, resulting in the collapse of the node device.

The four state transitions are shown in Figure 2.

[figure(s) omitted; refer to PDF]

In Figure 2, the propagation rate of $S$ state to $I$ state is $\beta$, the recovery rate from $I$ state to $R$ state is $\mu$, and the node device collapse rate from $I$ state to $D$ state is recorded as $\lambda$.

The formula of the SIRD model of failure propagation is as follows, at the time interval $\mathrm{\Delta }t$, the changes of $S$, $I$, $R$ and D states $\mathrm{\Delta }S$, $\mathrm{\Delta }I$, $\mathrm{\Delta }R$ and $\mathrm{\Delta }D$ are as follows:$$\begin{array}{c}\text{(1)}& \frac{\mathrm{\Delta }S}{\mathrm{\Delta }t}=-\beta S,\frac{\mathrm{\Delta }I}{\mathrm{\Delta }t}=\beta S-\mu I-\lambda I,\\ \frac{\mathrm{\Delta }R}{\mathrm{\Delta }t}=\mu I,\\ \frac{\mathrm{\Delta }D}{\mathrm{\Delta }t}=\lambda I.\end{array}$$

When $\mathrm{\Delta }t⟶0$, the above equation can be rewritten as a differential equation.$$\begin{array}{c}\text{(2)}& \frac{dS}{dt}=-\beta S,\frac{dI}{dt}=\beta S-\mu I-\lambda I,\\ \frac{dR}{dt}=\mu I,\\ \frac{dD}{dt}=\lambda I.\end{array}$$

In the SIRD failure propagation model of traffic network, the state conversion rate of each node in the network is assumed to be consistent, with uniform values for $\beta$, $\mu$, and $\lambda$. However, in real-world traffic networks, variations in node characteristics such as location, type, and security measures result in differing propagation rates ($\beta$), recovery rates ($\mu$), and crash rates ($\lambda$) following an attack.

Therefore, node risk value f is introduced in the calculation of the conversion rate of each node state, as shown in Figure 3, and the risk value f is used to represent the impact of the heterogeneity of network nodes on the failure propagation, forming the SIRD-R model, as shown in Figure 4.

[figure(s) omitted; refer to PDF]

In the SIRD-R model, nodes with lower risk values exhibit improved security protection measures, resulting in a decreased failure propagation rate, an increased recovery rate, and a reduced collapse rate. The specific formula is as follows:$$\begin{array}{c}\text{(3)}& \frac{dS}{dt}=-f{\beta }_{0}S,\frac{dI}{dt}={f\beta }_{0}S-1-f{\mu }_{0}I-f{\lambda }_{0}I,\\ \frac{dR}{dt}={\mu }_{0}I,\\ \frac{dD}{dt}=f{\lambda }_{0}I.\end{array}$$

In the formula, ${\beta }_0$, ${\mu }_0$, and ${\lambda }_0$ are defined as the basic propagation rate, recovery rate, and collapse rate of the network. Combined with the risk value f of each node, the analysis of each state of the network node is realized.

3.2. Traffic Network Resilience Measurement Modeling

After analyzing the failure propagation process of the traffic network, the resilience of the traffic network is further modeled. The concept of network resilience refers to the capacity of a network to return to its normal state, either through internal adjustments or external interventions, following the emergence and propagation of a failure node subsequent to an attack.

In the study on resilience modeling of traffic network, the classic model is the resilience triangle model proposed by Bruneau [25]. In subsequent studies, Bruneau’s resilience triangle model was further refined and network resilience was defined as the percentage of total network losses over a period of time [26]. Another network resilience model is the resilience measuring quotient model, which includes fault response and recovery measures [27]. The network resilience triangle model holds that the performance of the network is a cliff-like decline after the attack, but in reality, there is a certain time process when the overall performance of the network drops to the lowest point after the attack. The network resilience quotient model holds that there is a constant minimum level of network performance over a period of time, which does not exist in reality due to constant failure propagation in the network.

Therefore, this paper explores a resilience modeling method, which divides network resilience into two parts: real-time resilience and overall resilience. In the real-time resilience measurement, the resilience of the network at the current moment and the change of the resilience are given. In the overall resilience research and analysis, the overall resilience measurement results after the network recovers from the attack are given.

3.2.1. Real-Time Resilience

According to the failure propagation analysis of traffic network, the state of each node in the network can be obtained. The nodes in the $S$ and $R$ states are not failed or recovered, that is, available nodes. The nodes in the $I$ and D states are failed or crashed, that is, unavailable nodes.

Based on previous researches, the network performance function $Kt$ is used to express the working performance status of the traffic network at different times [28]. The calculation formula $Kt$ is as follows:$$\begin{array}{}\text{(4)}& Kt=\frac{{{\displaystyle \sum }}_{i\in N}{W}_{i}t\times A_{i}t}{{{\displaystyle \sum }}_{i\in N}{W}_{i}t},\end{array}$$where N is the set of all nodes in the network, $W_{i}t$ is the relative weight of the node at time t, and $A_{i}t$ is the available capability of the node under attack failure propagation.

According to the SIRD-R failure propagation model, the formula $A_{i}t$ is as follows:$$\begin{array}{}\text{(5)}& A_{i}t=\begin{array}{cc}0,& I,D\text{\hspace{0.17em}state}\\ 1,& S,R,\text{\hspace{0.17em}state}.\end{array}\end{array}$$

The relative weight of a node $W_{i}t$ can be expressed as the degree centrality of the network node.$$\begin{array}{}\text{(6)}& W_{i}t=\frac{1}{N-1}{\displaystyle \sum }_{j=1}^N{a}_{ij}i\ne j,\end{array}$$where $N$ is the total number of nodes in the network and $a_{ij}$ is the connection edge between nodes $ij$.

The network performance function $Kt$ after the traffic network is attacked is obtained through experiments, as shown in Figure 5.

[figure(s) omitted; refer to PDF]

As shown in Figure 6, the ratio of the network performance under attack $Kt$ to the network performance under normal circumstances $K_{0}t$ at time t is taken as the network resilience $Et$ at the time t. The formula is as follows:$$\begin{array}{}\text{(7)}& Et=\frac{{{\displaystyle \int }}_{T=t}^{t+\mathrm{\Delta }t}Kt}{{{\displaystyle \int }}_{T=t}^{t+\mathrm{\Delta }t}{K}_{0}t}.\end{array}$$

[figure(s) omitted; refer to PDF]

3.2.2. Overall Resilience

The overall resilience of the traffic network is to evaluate the ability of the network to withstand and recover from attacks. As shown in Figure 7, the capability of the network to withstand attacks is shown as the value of real-time resilience at the lowest point, while the recover capability of the network is shown as the value of real-time resilience when the time approaches infinity.

[figure(s) omitted; refer to PDF]

Therefore, the network resilience bearing capacity of the traffic network $E_{\text{withstand}}$ is the minimum value of real-time resilience, and the formula is as follows:$$\begin{array}{}\text{(8)}& E_{\text{withstand}}=\min Et.\end{array}$$

The network resilience recovery capacity $E_{\text{recover}}$ is the real-time resilience at time T of the experimental simulation cutoff time, and the formula is as follows:$$\begin{array}{}\text{(9)}& E_{\text{recover}}=ET.\end{array}$$

The overall resilience of the network E can be expressed by the area integral of the resilience curve $ET$ during the whole time, calculated by the formula.$$\begin{array}{}\text{(10)}& E={\int }_{t=0}^{T}Et.\end{array}$$

After E is normalized, the above formula becomes as follows:$$\begin{array}{}\text{(11)}& E=\frac{{{\displaystyle \int }}_{t=0}^{T}Et}{{\displaystyle {\int }_{t=0}^{T}1}}.\end{array}$$

By further simplifying the above formula, the final formula of the overall resilience E of the traffic network is as follows:$$\begin{array}{}\text{(12)}& E=\frac{1}{T}{\int }_{t=0}^{T}Et.\end{array}$$

3.3. Traffic Network Resilience Forecasting

The evolution of network resilience varies under different attack scenarios in the traffic network. Therefore, it is necessary to forecast and analyze the trend of the traffic network resilience in order to promptly discern any shifts in network resilience and implement timely remedial measures.

The resilience of traffic networks is characterized by dynamic and time-varying data. For such data forecasting with time structure, recurrent neural network (RNN) shows better performance than traditional neural network because of its internal loop structure, which can retain the previous information and use it in the subsequent calculation. However, due to its long time deep connections, RNNs will encounter the problem of gradient disappearance during backpropagation training, making RNN unable to deal with long-term dependent data. Long short-term memory network (LSTM) is an improved RNN model, which introduces the concept of self-loop to generate a path of long-term continuous gradient flow, and introduces a gating mechanism to control the information flow to solve the problem that RNN cannot handle long-term dependence [29].

Therefore, according to the traffic network resilience model, LSTM algorithm is used to forecast the resilience change trend of traffic network. Firstly, the resilience data of traffic network are loaded, the data are preprocessed, the number of observations is set to forecast the next moment each time, and the data are divided into training data and test data. Then, the LSTM network model parameters are set up, and the LSTM network forecasting model is constructed. Then, the LSTM network forecasting model is trained. Finally, the target data is forecasted after the LSTM network forecasting model is trained.

3.4. Resilience Recovery Strategy of Traffic Network Based on Forecasting

During the initial stage of failure propagation in a traffic network attack, the limited number of failure nodes may initially escape notice. However, as failures spread across a wider area, appropriate measures will be implemented and increased attention will be directed toward the situation. Through analysis and forecasting of the dynamic trends in traffic network resilience, it is possible to identify the evolving patterns of network resilience. This enables proactive measures to be implemented in advance for optimizing network resilience and enhancing the overall resilience of the traffic network. The network resilience recovery strategy based on forecasting can be divided into two methods: node protection based on forecasting and node recovery based on forecasting. The traffic network resilience recovery model architecture based on forecasting is shown in Figure 8.

[figure(s) omitted; refer to PDF]

3.4.1. Node Protection Based on Forecasting

After forecasting the traffic network resilience, protective measures are taken for nodes in the network that have not failed, so that the node risk value is reduced, the failure propagation rate is reduced, the recovery rate is increased, and the collapse rate is reduced, so as to improve the network resilience.

3.4.2. Node Recovery Based on Forecasting

Based on the forecasting of the traffic network resilience, recovery measures are taken to restore the nodes in the failed state to the normal working state, so as to restrain the failure propagation of the nodes in the network and improve the network resilience.

4. Experimental Results and Analysis

The traffic network data studied in this paper are Gold Coast, a city in southern Queensland, Australia. The traffic network data contain 4807 nodes and 11,140 connected edges.

4.1. Modeling Results and Analysis of Network Resilience

SIRD model is used to plot the dynamic changes of four types of nodes under node fault propagation attack in traffic network. β is defined as 0.3, μ is 0.1, λ is 0.02, and the failure number of attacked nodes is set to 1 at the initial moment. The results are shown in Figure 9.

[figure(s) omitted; refer to PDF]

As can be seen from Figure 9, the failed node devices in the network first rose rapidly, then slowly fell, and finally, there are no failed nodes in the stable state.

By using SIRD-R failure propagation model, the dynamic changes of four types of traffic network nodes are drawn. $\beta 0$ is defined as 0.3, μ0 as 0.1, and λ0 as 0.02. The risk value f of each node is generated by random simulation, and the number of failures of attacked nodes at the initial moment is set to 1, as shown in Figure 10.

[figure(s) omitted; refer to PDF]

By comparing Figures 9 with 10, it can be seen that under the same $\beta$, $\mu$, and λ, the entire failure propagation time process becomes longer due to the introduction of node risk value. Because some nodes have better security protection measures and lower risk value, the peak value of nodes in failure state is reduced. However, some nodes have weaker security protection measures and higher risk value, and the final number of recovered nodes is also reduced.

The real-time resilience of the traffic network is obtained by the method of Section 2, as shown in Figure 11.

[figure(s) omitted; refer to PDF]

As can be seen from Figure 11, in the initial stage of the network attack, the failure state spreads rapidly among nodes, and the real-time resilience of the network decreases rapidly. After a prolonged period of cascading failure propagation, the majority of nodes have transitioned to a failed state, while certain nodes have been able to recover from this state as a result of implemented security protection measures. At this time, the real-time resilience of the network begins to recover. However, because some nodes in the network fail to recover but collapse, the real-time resilience of the network can not return to the resilience performance before the final stability.

Through experiments, the network resilience bearing capacity $E_{\text{withstand}}$, network resilience recovery capacity $E_{\text{recover}}$, and overall network resilience E of the traffic network are shown in Table 1.

Table 1

Traffic network bearing capacity, recovery capacity, and overall resilience.

$E_{\text{withstand}}$	$E_{\text{recover}}$	E
0.4014	0.7678	0.7474

Select different values for the experimental simulation cutoff time T, and obtain the results of network resilience bearing capacity $E_{\text{withstand}}$, network resilience recovery capability $E_{\text{recover}}$, and overall network resilience E, as shown in Table 2.

Table 2

Overall resilience of traffic network under different cutoff time T (the value of $E_{\text{withstand}}$ is unchanged at 0.4014).

$T$	$E_{\text{recover}}$	$E$
30	0.5618	0.5725
50	0.6992	0.5981
80	0.7517	0.6471
120	0.7644	0.6847
160	0.7670	0.7051
200	0.7676	0.7175
250	0.7678	0.7276
300	0.7678	0.7343
400	0.7678	0.7427

It can be seen from Table 2 that with the increase of experimental simulation time, the network resilience recovery ability and the overall network resilience have improved. When the experimental simulation time is relatively short, the improvement of network resilience recovery ability and overall network resilience is more significant, while when the experimental simulation time is longer, the improvement of network resilience recovery ability and overall network resilience continues to decline. This is because when the experimental simulation time is short, the entire network failure propagation process of the traffic network cannot be effectively simulated, and the network resilience performance results at this time cannot represent the entire network failure propagation process. With the increase of simulation time, the evolution of the failure propagation process of the network is more perfect, and the resilience performance of the network is closer to the actual situation.

4.2. Experimental Analysis of Network Resilience Forecasting and Optimization Results

LSTM algorithm is used to forecast the traffic network resilience, and the forecasting results are shown in Figure 12.

[figure(s) omitted; refer to PDF]

In order to evaluate the forecasting degree of LSTM algorithm, the mean relative error (MRE), mean square error (MSE), and R2 determination coefficient are used to evaluate.

MRE is the average of the relative difference between the real value and the forecasted value, which can reflect the error between the forecasted value and the actual value, and its calculation formula is as follows:$$\begin{array}{}\text{(13)}& \text{MRE}=\frac{1}{n}{\displaystyle \sum }_{i=1}^n\frac{y_{i0}-y_i}{y_i},\end{array}$$where $y_i$ is the actual resilience result, $y_{i0}$ is the forecasted resilience result, and n is the total number of data.

The MSE is computed as the average of the sum of squares between the forecasted and actual values, serving as a measure to quantify the discrepancy between forecasted outcomes and true values. Its calculation formula can be expressed as follows:$$\begin{array}{}\text{(14)}& \text{MSE}=\frac{1}{n}{\displaystyle \sum }_{i=1}^n{y_{i0}-y_i}^2.\end{array}$$

R2 coefficient reflects the accuracy of the forecasted fitting data. The R2 coefficient ranges from 0 to 1. The closer the value is to 1, the better the forecasted data are fitted. The calculation formula is as follows:$$\begin{array}{}\text{(15)}& \mathrm{R}2=1-\frac{{{\displaystyle \sum }}_{i=1}^n{y_{i0}-y_i}^2}{{{\displaystyle \sum }}_{i=1}^n{{\overline{y}}_i-y_i}^2},\end{array}$$where ${\overline{y}}_i$ is the mean value of actual resilience results.

MRE, MSE, and R2 determination coefficient are used to evaluate the forecasting accuracy of LSTM algorithm on traffic network resilience. The evaluation results are shown in Table 3.

Table 3

Resilience forecasting accuracy of traffic network based on LSTM algorithm.

MRE	MSE	R2 coefficient
0.00639	0.00016	0.96842

As can be seen from Table 3, the MRE is 0.00639, the MSE is 0.00016, and the R2 coefficient is 0.96842. The error of the resilience forecasting results of the traffic network using the LSTM algorithm is very small, and the R2 coefficient is close to 1, so the resilience forecasting result is very good.

CNN, RNN, and LSTM algorithms are, respectively, used to forecast the traffic network resilience, and the resilience forecasting results under different algorithms are compared as shown in Figure 13. The forecasting accuracy is shown in Table 4.

[figure(s) omitted; refer to PDF]

Table 4

Comparison of traffic networks’ resilience forecasting accuracy with different algorithms.

Algorithm	MRE	MSE	R2 coefficient
LSTM	0.00639	0.00016	0.96842
RNN	0.00898	0.00051	0.91152
CNN	0.01859	0.00082	0.85833

It can be seen from Figure 13 and Table 4 that the CNN algorithm has the worst forecasting effect on the traffic network resilience and the largest forecasting error. The forecasting result of RNN algorithm is better than CNN algorithm but worse than LSTM algorithm, and the forecasting error is in the middle position. The resilience forecasting result of LSTM algorithm is closest to the actual elastic result, and its forecasting error is the smallest. Therefore, using LSTM algorithm to forecast the traffic network resilience can achieve better expected results.

The traffic network resilience under different attacks in different scenarios is further forecasted. The forecasting results are shown in Figure 14, and the forecasting accuracy is shown in Table 5.

[figure(s) omitted; refer to PDF]

Table 5

Forecasting accuracy of traffic network resilience under different conditions.

	MRE	MSE	R2 coefficient
E1: 0.3, 0.1, 0.02	0.00639	0.00016	0.96842
E2: 0.5, 0.1, 0.02	0.00593	0.00020	0.97014
E3: 0.5, 0.3, 0.02	0.01057	0.00048	0.87830
E4: 0.3, 0.3, 0.02	0.00666	0.00028	0.87052
E5: 0.3, 0.1, 0.05	0.02395	0.00052	0.88427
E6: 0.5, 0.1, 0.05	0.02560	0.00110	0.87663

As can be seen from Figure 14 and Table 5, the resilience forecasting results of traffic network under different conditions are very close to the actual results, the forecasting errors are very small, and the R2 coefficients are close to 1.

The network resilience of the node protection based on forecasting under different protection rates is shown in Figure 15 and Table 6.

[figure(s) omitted; refer to PDF]

Table 6

Traffic network resilience under different protection rates.

Protection rates	$E_{\text{withstand}}$	$E_{\text{recover}}$	$E$	Time cost (%)
No protection	0.4241	0.7666	0.7310	100
0.3	0.5423	0.8470	0.8143	94.9
0.4	0.5928	0.8792	0.8572	79.5
0.5	0.6470	0.8952	0.8796	72.2

It can be seen from Figure 15 and Table 6 that the node protection strategy based on forecasting can effectively improve the traffic network resilience, and the resilience bearing capacity, resilience recovery capacity, and overall resilience of traffic network are all improved. And with the improvement of the protection rate, the resilience bearing capacity, resilience recovery capacity, and overall resilience continue to improve. The node protection strategy based on forecasting is mainly to take protective measures for the nodes that have not failed in the network, reduce the possibility of nodes becoming failed, and prevent the spread of network node failures. However, it cannot recover the failed nodes, so the network resilience cannot recover to the initial 100% state. In addition, with the improvement of the protection rate, the time cost is also constantly reduced.

The network resilience of the node recovery based on forecasting under different recovery rates is shown in Figure 16 and Table 7.

[figure(s) omitted; refer to PDF]

Table 7

Traffic network resilience under different recovery rates.

Recovery rates	$E_{\text{withstand}}$	$E_{\text{recover}}$	$E$	Time cost (%)
No recovery	0.3996	0.7668	0.7282	100
0.1	0.6310	0.9992	0.8942	41.1
0.3	0.7168	0.9998	0.8999	22.9
0.5	0.7494	1.0000	0.9117	16.4

It can be seen from Figure 16 and Table 7 that the node recovery strategy based on forecasting can significantly improve the traffic network resilience, and the network resilience bearing capacity, resilience recovery capacity, and overall network resilience have been significantly improved. With the improvement of the recovery rate, the network resilience bearing capacity, resilience recovery capacity, and overall network resilience have been continuously improved. The node recovery strategy based on forecasting is mainly to take recover measures for failed nodes in the network and restore the nodes from the failed state to the normal working state, so as to inhibit the failure propagation of network nodes and improve the traffic network resilience. Therefore, the network resilience can be restored to the initial 100% state with sufficient time. In addition, with the improvement of the recovery rate, the time cost is greatly reduced.

The network resilience of the node recovery based on forecasting under different time advance is shown in Figure 17 and Table 8.

[figure(s) omitted; refer to PDF]

Table 8

Traffic network resilience under different time advance.

Time forecasting advance	$E_{\text{withstand}}$	$E_{\text{recover}}$	E	Time cost (%)
No forecasting	0.4094	0.7676	0.7261	100
0.5	0.5309	0.9982	0.9278	52.8
0.3	0.6748	0.9982	0.9354	38.6
0.1	0.7490	0.9982	0.9559	31.7

It can be seen from Figure 17 and Table 8 that with the decrease of the time forecasting advance, the network resilience bearing capacity and the overall network resilience continue to increase. The reduction of the time forecasting advance means that the security risks of the traffic network resilience can be discovered earlier, and the recovery strategy can be adopted earlier. As the earlier intervention of the recovery, the network node failure propagation can be greatly inhibited, the deterioration degree of the network resilience can be greatly slowed down, and the resilience bearing capacity can be significantly improved. However, the earlier intervention caused by the reduction of time forecasting advance has little effect on the final recovery degree of the network, and the resilience recovery capacity is almost unchanged. In addition, time costs continue to decrease as problems are identified earlier and optimization measures are taken.

Further, the results of network resilience optimization with and without node risk values are analyzed, as shown in Figure 18 and Table 9 below. It can be seen from the figure and table that the network resilience results have been effectively improved after combining the node risk value.

[figure(s) omitted; refer to PDF]

Table 9

Traffic network resilience with or without node risk values.

	$E_{\text{withstand}}$	$E_{\text{recover}}$	E
With node risk value	0.442	0.9902	0.8976
No node risk value	0.4116	0.9318	0.8103

The computational complexity of this method is O(n). The scalability of the network resilience optimization method under different network scales is analyzed, as shown in Table 10 below. It can be seen that when the network scale ranges from 20 nodes to 8000 nodes, the method can effectively improve the network resilience, and the increase of algorithm simulation experiment time is also within a reasonable range, which proves the effectiveness and scalability of the method for different network scales.

Table 10

Resilience optimization of different network scales.

Network scale (number of nodes)	Unoptimization	After-optimization	Simulation time
20	0.6872	0.8972	0.23
50	0.6895	0.9010	0.24
100	0.6942	0.9017	0.30
300	0.7057	0.9216	0.35
800	0.7033	0.9124	0.37
1000	0.7261	0.9354	0.38
3000	0.7141	0.9121	0.80
5000	0.7434	0.9538	1.30
8000	0.7762	0.9615	2.37

Then, the network resilience optimization experiments are carried out in aviation network, industrial network, power network, and other complex networks. The network resilience optimization method is based on trend forecasting and combines the node protection and node recovery strategies. The results are shown in Table 11.

Table 11

Resilience optimization of different networks.

	Unoptimization	After-optimization
Traffic network	0.7261	0.9354
Aviation network	0.7389	0.9519
Industrial network	0.6748	0.9186
Power network	0.7440	0.9263

As can be seen from Table 11, the network resilience optimization method proposed in this paper can achieve good results in a variety of complex network applications, which proves the effectiveness, scalability, and adaptability of the method.

5. Conclusion

With the ongoing advancement of computer technology, digitalization and networking have emerged as prevailing trends in contemporary society. However, this development has led to a progressively intricate traffic infrastructure that poses numerous security challenges. Aiming at the incompleteness and inadequacy of the resilience modeling, forecasting, and recovery of complex traffic network, the following research is carried out in this paper. This paper conducts an initial analysis of the failure propagation process of network nodes following a traffic network attack, and introduces the risk value to establish the SIRD-R failure propagation model. Then, the resilience bearing capacity and resilience recovery capacity of traffic network are analyzed comprehensively, and the network resilience model of traffic network is established from two aspects: real-time resilience and overall resilience. Furthermore, the traffic network’s resilience is forecasted using LSTM networks to enable advanced perception and early warning capabilities. Finally, based on the resilience forecasting of traffic network, the resilience recovery strategy of traffic network based on the forecasting is proposed to realize the proactive optimization of the traffic network resilience in advance. This study aims to disrupt the causal chain of fault diffusion within the network, enhance the resilience of complex traffic networks, and bolster the protective capacity of traffic networks against potential attacks. Ultimately, this will enable effective network security emergency response, ensure uninterrupted network operation, and mitigate economic losses or major accidents.

Funding

This work was supported by Beijing Natural Science Foundation (L222005); National Key Research and Development Program (2022YFB3103602); CCF-NSFOCUS Kun-Peng Scientific Research Fund (CCF-NSFOCUS202215); Industrial Internet Innovation and Development Project (TC210804R) and (CEIEC-2022-ZM02-0252); and Fundamental Research Funds for the Central Universities.

References

[1] S. Hong, T. Yue, H. Liu, "Vehicle Energy System Active Defense: A Health Assessment of Lithium-Ion Batteries," International Journal of Intelligent Systems, vol. 37 no. 12, pp. 10081-10099, DOI: 10.1002/int.22309, 2022.

[2] Y. Lu, W. Wang, R. Bai, "Hyper-Relational Interaction Modeling in Multi-Modal Trajectory Prediction for Intelligent Connected Vehicles in Smart Cites," Information Fusion, vol. 114,DOI: 10.1016/j.inffus.2024.102682, 2025.

[3] S. Yin, S. Wang, M. Yang, X. Guo, N. Zhang, "Exploration of the Construction Path of an Energy Ecosystem Adapted to the Power Internet of Things," IOP Conference Series: Earth and Environmental Science, vol. 631 no. 1,DOI: 10.1088/1755-1315/631/1/012124, 2021.

[4] Q. Yang, Y. N. Zhang, Y. Q. Zhou, L. B. Bai, "A Review of Complex Network Theory and Its Application in the Resilience of Public Transportation Systems," China Journal of Highway and Transport, vol. 35 no. 4, pp. 215-229, 2022.

[5] L. Huang, H. Huang, Y. Wang, "Resilience Analysis of Traffic Network Under Emergencies: A Case Study of Bus Transit Network," Applied Sciences, vol. 13 no. 15,DOI: 10.3390/app13158835, 2023.

[6] S. Hong, Y. Zeng, "A Health Assessment Framework of Lithium-Ion Batteries for Cyber Defense," Applied Soft Computing, vol. 101 no. 49,DOI: 10.1016/j.asoc.2020.107067, 2021.

[7] C. Zhang, J. Oh, K. Park, "Evaluation of Sewer Network Resilience Index under the Perspective of Ground Collapse Prevention," Water Science and Technology, vol. 85 no. 1, pp. 188-205, DOI: 10.2166/wst.2021.503, 2022.

[8] D. Galinec, W. Steingartner, "Combining Cybersecurity and Cyber Defense to Achieve Cyber Resilience," IEEE 14th International Scientific Conference on Informatics (INFORMATICS), pp. 87-93, DOI: 10.1109/informatics.2017.8327227, .

[9] N. Ahmadian, G. J. Lim, J. Cho, S. Bora, "A Quantitative Approach for Assessment and Improvement of Network Resilience," Reliability Engineering & System Safety, vol. 200 no. 5,DOI: 10.1016/j.ress.2020.106977, 2020.

[10] L. Wang, X. Xue, X. Zhou, "A New Approach for Measuring the Resilience of Transport Infrastructure Networks," Complexity, vol. 2020 no. 7,DOI: 10.1155/2020/7952309, 2020.

[11] C. Zhang, X. Xu, H. Dui, "Resilience Measure of Network Systems by Node and Edge Indicators," Reliability Engineering & System Safety, vol. 202,DOI: 10.1016/j.ress.2020.107035, 2020.

[12] R. Cerqueti, G. Ferraro, A. Iovanella, "Measuring Network Resilience Through Connection Patterns," Reliability Engineering & System Safety, vol. 188, pp. 320-329, DOI: 10.1016/j.ress.2019.03.030, 2019.

[13] J. Wang, F. Liao, J. Wu, H. Sun, W. Wang, Z. Gao, "Measurement of Functional Resilience of Transport Network: The Case of the Beijing Subway Network," Transport Policy, vol. 140, pp. 54-67, DOI: 10.1016/j.tranpol.2023.06.016, 2023.

[14] X. Gao, L. Liu, X. Zhu, "Research on the Main Threat and Prevention Technology of Computer Network Security," IOP Conference Series Earth and Environmental Science, .

[15] A. Imteaj, V. Akbari, M. Amini, "A Novel Scalable Reconfiguration Model for the Postdisaster Network Connectivity of Resilient Power Distribution Systems," vol. 23 no. 3,DOI: 10.3390/s23031200, .

[16] H. Wang, H. Jiang, J. Han, C. Cai, "Multi-Objective Distribution Network Reconfiguration Based on Backward/Forward Sweep-Based Power Flow Calculation," 2021 3rd Asia Energy and Electrical Engineering Symposium (AEEES), pp. 481-485, 2021.

[17] R. R. Liu, D. A. Eisenberg, T. P. Seager, Y. C. Lai, "The “Weak” Interdependence of Infrastructure Systems Produces Mixed Percolation Transitions in Multilayer Networks," Scientific Reports, vol. 8 no. 1,DOI: 10.1038/s41598-018-20019-7, 2018.

[18] V. Bartos, M. Zadnik, S. M. Habib, E. Vasilomanolakis, "Network Entity Characterization and Attack Prediction," Future Generation Computer Systems, vol. 97, pp. 674-686, DOI: 10.1016/j.future.2019.03.016, 2019.

[19] M. H. Amini, K. G. Boroojeni, S. S. Iyengar, F. Blaabjerg, P. M. Pardalos, A. M. Madni, "A Panorama of Future Interdependent Networks: From Intelligent Infrastructures to Smart Cities," Studies in Systems, Decision and Control,DOI: 10.1007/978-3-319-74412-4_1, 2018.

[20] S. Hong, Y. Wang, "Attack and Repair Strategies for Computer Network about Viruses," International Conference on Machine Learning for Cyber Security, pp. 500-510, DOI: 10.1007/978-3-030-62223-7_43, .

[21] J. Gong, Y. Wang, "Evaluation of Active Distribution Network Recovery Plan Based on Resilience Indices," 2023 8th Asia Conference on Power and Electrical Engineering, pp. 214-220, DOI: 10.1109/acpee56931.2023.10135744, .

[22] R. Laishram, A. E. Sariyüce, T. Eliassi-Rad, A. Pinar, S. Soundarajan, "Measuring and Improving the Core Resilience of Networks," Proceedings of the 2018 World Wide Web Conference, Proceedings of the 2018 World Wide Web Conference on World Wide Web WWW’18, pp. 609-618, DOI: 10.1145/3178876.3186127, .

[23] D. Li, Q. Wang, X. Zhang, X. Fan, "Predicting the Cascading Failure Propagation Path in Complex Networks Based on Attention-LSTM Neural Networks," IEEE International Symposium on Circuits and Systems, 2023.

[24] B. Zhong, "Simulation and Simulation of Virus Transmission in Virtual Network Based on Time Series Network," Lecture Notes on Data Engineering and Communications Technologies, vol. 98, pp. 608-615, DOI: 10.1007/978-3-030-89511-2_78, 2022.

[25] S. L. Wang, Z. Y. Guo, X. D. Huang, J. H. Zhang, "A Three-Stage Model of Quantifying and Analyzing Power Network Resilience Based on Network Theory," Reliability Engineering & System Safety, vol. 241,DOI: 10.1016/j.ress.2023.109681, 2024.

[26] M. Bai, Q. Liu, "Evaluating Urban Fire Risk Based on Entropy-Cloud Model Method Considering Urban Safety Resilience," Fire, vol. 6 no. 2,DOI: 10.3390/fire6020062, 2023.

[27] L. Zhen, T. Lu, S. C. Xu, W. Y. Mei, W. D. Sheng, M. Hong, "A Systematic Research on System Recovery Based on Improved Genetic Algorithm and Quotient Resilience Model Under Attack and Damage," International Journal of Computational Intelligence Systems, vol. 15 no. 1,DOI: 10.1007/s44196-022-00158-6, 2022.

[28] X. Dong, J. Hu, Y. Cui, "Overview of Botnet Detection Based on Machine Learning," 3rd International Conference on Mechanical, Control and Computer Engineering (ICMCCE), pp. 476-479, DOI: 10.1109/icmcce.2018.00106, .

[29] V. Goyal, R. Raj, "Using LSTM, DNN, and ARIMA Approaches to Predict the Trends in the Stock Market," 8th International Conference on Advanced Computing and Communication Systems (ICACCS), pp. 918-922, DOI: 10.1109/icaccs54159.2022.9785150, .