## 3 CPS Resilience Quantitative Assessment Framework
### Physical Domain: System Performance Modeling  
#### 3.2.1 Performance Curve and Resilience Stages  
This section discusses the stages and quantitative assessment methods of CPS resilience from the perspective of system performance. In the context of cyber resilience, a system's ability to recover to an acceptable performance level following degradation is a key indicator of its overall resilience. Such degradation may result from random natural failures--as studied in traditional reliability engineering--or from deliberate cyber attacks.  
System performance over time is commonly represented by a performance curve, which depicts how key performance indicators evolve in response to disruptions and recovery efforts. This curve provides a temporal profile of system behavior, capturing both the immediate impact of adverse events and the subsequent restoration trajectory. A typical performance curve for a disrupted system is illustrated in Figure 3, showing the temporal response of a disrupted system. Based on this curve, the resilience process can be divided into four key stages:  
Figure 3: A typical performance resilience curve for a disrupted system. \(t_{a}\) denotes the time at which the adverse condition occurs, \(t_{t}\) represents the initiation of the recovery process, and \(t_{c}\) marks the point at which the system restores to its previous condition. The time intervals between these points, along with the corresponding changes in system performance, can be used to characterize key resilience indicators such as rapidity and robustness.  
Figure 2: Proposed CPS resilience assessment framework.  
* Prevention Stage: The system operates under normal conditions, employing measures such as intrusion detection, anomaly monitoring, and system hardening to maintain stable performance and minimize exposure to threats.
* Withstanding Stage: Under adverse conditions, performance begins to degrade. The system's ability to maintain partial functionality during this phase reflects its robustness and fault tolerance.
* Recovery Stage: Following the disruption, the system engages recovery mechanisms--such as redundancy activation, reconfiguration, or manual intervention--to restore performance. The speed and efficiency of this process are key resilience indicators.
* Adaptation Stage: The system adjusts to the new environment by updating configurations, learning from the incident, or strengthening defenses. This adaptive capacity supports long-term resilience enhancement.  
These stages form the basis for understanding resilience as a time-dependent, performance-driven process. Common metrics include the area under the performance curve, recovery time, and minimum performance during disruption. Such indicators provide an intuitive means of comparing resilience across systems and scenarios.  
However, most existing approaches generate performance curves through experiments or simulations based on physical control models. While effective in specific contexts, these methods are often system-specific and highly dependent on the chosen performance indicators. They typically lack a unified modeling framework and struggle to account for the complex interdependence between cyber and physical domains in CPSs.  
To overcome these limitations, the next subsection presents a mathematical modeling approach for generating generic performance curves. This model also lays the groundwork for integrating physical dynamics with cyber-layer disruptions.