Quantitative evaluation of APT attack and defense effectiveness based on variable fuzzy sets

Advanced Persistent Threat (APT) represents a high-impact network security threat featured by pertinence, complexity and concealment. Conventional models fail to precisely characterize and quantify the attack-defense effectiveness of APT confrontations. Targeting the unique uncertainty inherent in APT scenarios, this paper proposes the APT-VFSEA, a variable-fuzzy-set-based quantitative evaluation model for APT attack-defense effectiveness. We first design a unified criterion-building method applicable to both APT attack and defense assessment scenarios. Variable fuzzy sets are adopted to handle the metric- and data-related uncertainty during evaluation, and a complete operational evaluation workflow is further established for the proposed model. Validation experiments are carried out based on the CVE-2017-11882 vulnerability, and evaluation outputs are compared against real-world attack-defense observations. Empirical results demonstrate that the APT-VFSEA model can efficiently and accurately assess the effectiveness of APT attack and defense actions.