## 4 Framework Dimensions and Measurement
### Preventive Capacity Index (P)  
The Preventive Capacity Index (P) quantifies a system's ability to proactively intercept threats before they materialize into incidents, serving as a foundational component of the Resilience Capacity (RC) model. It emphasizes anticipating and mitigating risks through architectural design, defense mechanisms, and threat intelligence to minimize the attack surface and disrupt adversarial tactics early.  
The index, denoted as \(P(t)\), integrates sub-dimensions into a cohesive metric reflecting proactive defense capabilities, capturing both static structural properties and dynamic operational conditions. It is expressed as follows:  
\[P(t)=\frac{1}{1+e^{-\lambda AD(t)}}\cdot\prod_{i=1}^{n}(1-p_{i}^{k_{i}})\cdot \log_{2}\bigg{(}1+\frac{TIQ(t)}{VW(t)}\bigg{)} \tag{3}\]  
Here, \(\lambda\) is the learning rate for architectural diversity \(AD(t)\) (values in \((0,1)\)), \(k_{i}\) is the number of variant components in the \(i\)-th defense layer, \(p_{i}\) is the failure probability of components in that layer, \(TIQ(t)\) is the threat intelligence quality index, and \(VW(t)\) represents the vulnerability window exposure volume. The multiplicative structure ensures balanced system improvement.  
The architectural diversity term, \(\frac{1}{1+e^{-\lambda AD(t)}}\), uses a sigmoidal function for nonlinear scaling of defensive effectiveness with structural variation. \(AD(t)\) is defined as follows:  
\[AD(t)=\frac{1}{3}\bigg{[}\frac{N_{p}(t)}{N_{total}}+\frac{\ln(1+f_{update})}{ \ln 10}+\frac{1}{1+e^{-0.1\Delta t_{adjust}}}\bigg{]} \tag{4}\]  
where \(N_{p}(t)\) is the number of variant components, \(N_{total}\) is the total, \(f_{update}\) is policy update frequency (updates/hour), and \(\Delta t_{adjust}\) is system adjustment time (seconds). This aggregates component variation (measurable via system inventories or CMDBs by calculating variant-to-total component ratios), policy update velocity (logarithmic scaling for diminishing returns), and adjustment responsiveness (exponential decay rewarding rapid reconfiguration).  
The defense mechanism multiplier, \(\prod_{i=1}^{n}(1-p_{i}^{k_{i}})\), models layered defenses as probabilistic barriers, where diversified components exponentially decrease failure probability, grounded in reliability theory. Practically, efficacy is measured by indicators like virus signature database synchronization rates (from EDR/antivirus logs) and asset vulnerability scanning coverage (comparing reports from tools like Nessus or OpenVAS with CMDB asset counts).  
The threat intelligence efficiency term, \(\log_{2}\Big{(}1+\frac{TIQ(t)}{VW(t)}\Big{)}\), reflects bounded growth of intelligence-driven defense, with logarithmic form for diminishing returns as vulnerability windows shrink, based on information theory. This is assessed via metrics like timeliness and accuracy of threat feeds (from SIEMs or threat intelligence platforms).  
Operationalizing P relies on measurable indicators using mature, accessible technologies. This practical approach, leveraging common data sources (log management, security device reports) and allowing flexible tool implementation (e.g., Nessus or Qualys for scanning), ensures the index is actionable. The focus on easily collected metrics (update compliance, scan coverage) minimizes overhead while the multiplicative interaction in \(P(t)\) promotes holistic improvement, aligning with observations that balanced preventive investments yield greater resilience.