Quantifying cyber-resilience against resource-exhaustion attacks

Resilience in the information sciences is notoriously difficult to define much less to measure. But in mechanical engi- neering, the resilience of a substance is mathematically defined as the area under the stress vs. strain curve. We took inspiration from mechanics in an attempt to define resilience precisely for information systems. We first examine the meaning of resilience in language and engineering terms and then translate these definitions to information sciences. Then we tested our definitions of resilience for a very simple problem in networked queuing systems. We discuss lessons learned and make recommendations for using this approach in future work.