## 3 CPS Resilience Quantitative Assessment Framework
### Integrated CPS Modeling Strategy and Comparative Advantages
#### 3.4.2 Integrated Benchmarking Process  
To evaluate the effectiveness and generality of the proposed CPS resilience modeling framework, we introduce an integrated benchmarking process that unifies the cyber-layer failure modeling with the physical-layer performance evolution. This process follows a structured four-step procedure, enabling quantitative analysis and comparison of CPS resilience under varying design strategies and operational environments. Each step builds upon the previous one to gradually construct a complete resilience profile for the system under study. **Step 1: CTMC parameter settings**  
Based on the CTMC model described in Section 3.3.2, we define the key parameters that govern transitions between discrete cyber-layer states. These parameters include the failure rate (\(\lambda\)), recovery rate (\(\mu\)), and abnormal consistency (\(\sigma\)). Among them, \(\lambda\) characterizes the threat environment, while \(\mu\) and \(\sigma\) reflect design attributes related to restoration mechanisms and the internal consistency of redundant components, respectively. In the benchmark setup, values for \(\mu\) and \(\sigma\) are typically determined based on their theoretical definitions, expert judgment, or controlled testing. For example, \(\mu\) can be derived through white-box fault injection [17], where faults are deliberately introduced into redundant execution units, and the average time required for successful recovery is measured. The abnormal consistency parameter \(\sigma\) is estimated by evaluating the probability that heterogeneous units are simultaneously compromised, which depends largely on the overlap of hardware and software vulnerabilities. Study [43] systematically examined the overlap of vulnerabilities in different operating systems developed by separate vendors. Their findings suggest that when systems are developed by independent teams with distinct codebases and architectures, the probability of shared exploitable vulnerabilities is significantly reduced. There are also many applications of diverse intrusion tolerance systems that prove this viewpoint [44; 45]. Note that anomaly consistency refers to the probability that two redundant execution units simultaneously exhibit consistent faulty behavior, which would lead to an incorrect consensus in majority voting. Achieving this would require an adversary to exploit identical vulnerabilities, construct a highly similar attack chain, and trigger the attacks within a closely aligned time window. Moreover, any inconsistency resulting from partial or unsynchronized attacks could activate the system's recovery mechanisms, preventing the full execution of the attack chain. Therefore, under well-engineered heterogeneous conditions, the value determined is typically very low. **Step 2: CTMC simulation under different conditions**  
Given the inherent complexity of real-world conditions, obtaining precise values for the aforementioned parameters remains a challenging task. To address this, CTMC simulations are performed under multiple threat environments and parameter configurations. For each setting, the steady-state probabilities of all system states are computed, capturing the likelihood of the system being in normal, failed, degraded, or recovering conditions when subjected to various cyber-induced disruptions. These probabilities offer a probabilistic characterization of long-term system behavior for downstream analysis. The CTMC modeling process relies on input parameters estimated through fault injection testing or expert judgment; we conducted a sensitivity analysis to support informed design decisions. In this analysis, each key parameter--failure rate (\(\lambda\)), recovery rate (\(\mu\)), and anomaly consistency (\(\sigma\))--was systematically varied within a reasonable range around its baseline value, while other parameters were held constant. This allowed us to assess how variations in these inputs affect the steady-state probabilities of CTMC states, thereby influencing resilience performance.