## 3 CPS Resilience Quantitative Assessment Framework
### Cyber Layer: Security Architecture and Modeling
#### 3.3.2 Markov Process Modeling  
Based on the diversity-redundancy security architecture introduced in the previous section, we construct a Markov model to describe the probabilistic behavior of the system under sustained cyber threats. We consider a setting in which three redundant execution units (e.g., controllers, processing modules, or computing nodes) operate in parallel within the CPS. The system output is determined through majority voting. If an inconsistency is detected among the execution results, the system initiates fault isolation and failover and engages in dynamic recovery procedures targeting the abnormal units. Figure 6: Schematic diagram of diversity-redundancy security architecture for enhancing the system’s ability to autonomously detect, withstand, and recover from failures or intrusions. Under this architecture, the state space of the system can be defined based on the functional status of the individual execution units after experiencing cyber attacks. Specifically, when the majority of execution units remain operational, the system is considered available. Conversely, unfavorable states include degraded and failed modes, which can be further divided into detectable (aware) and undetectable (unaware) categories, depending on whether inconsistencies in outputs are observable. The system states are defined as follows:  
* Available state: The majority of execution units are functioning correctly. * Degraded state: The majority of execution units have failed, and their outputs are inconsistent. * Detectable failure state: The majority of units have failed, but their outputs are consistent, allowing detection. * Undetectable failure state: All execution units have failed and generate identical (erroneous) outputs, leading to a silent failure. Based on the above classification, we construct a continuous-time Markov chain (CTMC) model for the proposed diversity-redundancy security architecture. As shown in Figure 7, the model consists of 13 distinct steady states. Among them are the following:  
* States 1-4 represent system availability. * States 5, 7, 9, 12, and 13 represent detectable failures. * States 6, 8, and 10 correspond to degraded but observable states. * State 11 denotes the undetectable failure (stealthy failure) state. The model's transitions are governed by several parameters, including the following:  
* \(\lambda_{i}\): Failure rate of the i-th execution unit due to cyber attack-induced disruption. * \(\mu_{1}\): Mean time to recovery when one unit fails with abnormal output. * \(\mu_{2}\): Recovery rate when two units fail with consistent abnormal output vectors (which may include functional outputs, alerts, performance metrics, etc.). * \(\mu_{3}\): Recovery rate when all three units fail and produce identical abnormal outputs--indicating an undetectable, stealthy failure. * \(\mu_{4}\): Recovery rate when all three units fail but their outputs are mutually inconsistent--resulting in an observable degraded state. * \(\sigma\): The uncertainty coefficient that quantifies the likelihood of abnormal output consistency among failed execution units. It reflects how often two faulty nodes produce the same incorrect output vector under adverse conditions. To evaluate the resilience of the proposed architecture under persistent cyber threats, we solve the steady-state probabilities of the CTMC model introduced above. Assuming  
Figure 7: A continuous-time Markov chain model for the proposed diversity-redundancy security architecture, consists of 13 distinct steady states. where  
\[