Cyber Potential Metaphorical Map Method Based on GMap

Abstract

Cyberspace maps facilitate the understanding of complex, abstract cyberspace. Due to the exponential growth of the Internet, the complexity of cyberspace has escalated dramatically. Traditional cyberspace maps are primarily for professionals and thus remain challenging for non-professionals to interpret. Ordinary users often find themselves overwhelmed by the vast amount of information and the complexity of cyberspace. This renders traditional visualization tools inadequate for the general public, thereby highlighting the urgent need for more intuitive and accessible representations. This study uses the metaphor of cyberspace as a familiar geographical space to simplify the understanding of its internal relationships. Based on Autonomous System (AS) connectivity data, a “node-link” model is created to illustrate cyber interactions and dependencies, forming a foundation for analysis. The GMap algorithm visualizes AS connectivity data of countries, converting it into an intuitive map that clearly illustrates the cyber composition and dynamics. Cyber potential and national influence are considered to enhance map practicality and accuracy. A cyber-geography metaphor model integrates scientific and geographical elements, improving readability. The optimized GMap algorithm includes a holisticcyberspace strength index, showing both connectivity and relative country strength in cyberspace. This metaphorical approach aims to reduce information complexity, making cyberspace more comprehensible to the general public.

1. Introduction

In the current era of information explosions, cyberspace has become an integral part of human society. Cyberspace maps have long served as crucial tools for understanding and interpreting cyberspace, since its early stages of development [1]. Employing cyberspace maps to model, analyze, and represent cyberspace facilitates has resulted in more precise insights into the complex interconnections within cyberspace structures, data flows, and information dissemination. Research on cyberspace mapping has garnered significant attention and acknowledgment within the fields of surveying and information science, leading to numerous pivotal findings. However, the inherent characteristics of virtualization and boundlessness in cyberspace pose challenges for traditional mapping approaches, such as map projections, symbol design, and visualization techniques. Therefore, it is essential to adopt metaphorical methods to transform abstract and complex aspects of cyberspace into more intuitive and comprehensible visual forms, thus enhancing users’ cognition and understanding of cyberspace.

The use of metaphor maps to depict elements of cyberspace and information flow has been the subject of various studies. For instance, Tsou et al. mapped information from cyberspace onto geographic coordinates, thereby creating visual representations that depict not only the relationship between cyberspace and physical geographic space, but also the impact of cyberspace on real-world geography [2,3,4,5]. Wu et al. developed a user-focused cultural cyberspace map using global website traffic data [6]. Lu et al. examined the differences between China’s physical geographic space and virtual space by analyzing connection frequency at the provincial level, connection patterns based on the backbone network, and connection speeds between urban nodes, producing corresponding maps [7]. Ruslan Enikeev’s “Galaxy Map” visualizes the 350,000 most trafficked websites on the internet [8]. Inspired by space exploration, Holmquist created a “Planet” map representing websites as planets, galaxies, solar systems, and asteroid fields [9]. Chen et al. introduced the D-Map visualization method, using metaphor maps to simulate information dissemination processes within social networks [10]. Wise et al. used contour lines as a metaphor to represent news maps, indicating the importance or popularity of news events through variations in line structure [11]. Xin et al. analyzed spatial metaphor expressions of non-spatial data using the Gosper curve and metaphor map principles [12]. Liu et al. proposed methods for constructing metaphorical Gosper maps and cyberspace topographic maps [13]. Qi et al. visualized resource nodes in cyberspace as ontologies, utilizing peaks and contour lines from traditional geographic space as visualization metaphors [14].

The concept of “cyber potential” is derived from “geopolitical potential”, representing a country’s or region’s influence and capabilities in cyber technology, information control, data flow, and cyber security relative to other countries or regions within the global cyberspace. It reflects a nation’s competitiveness, influence, and dominance in international cyber affairs. Currently, the characterizations and depictions of cyber potential are primarily conveyed through indicator models and thematic visualizations. Prominent methods for evaluating national cyberspace strength include the Belfer National Cyber Power Index (NCPI) [15], the Global Cybersecurity Index (GCI) [16], the Cyber Readiness Index 2.0 (CRI 2.0) [17], and the Cyber Power Index (CPI) [18]. By integrating both soft and hard powers associated with cyberspace, national cyberspace strength is thematically expressed through specialized symbols. Hard power refers to the physical power and tangible capabilities of a country in the field of cyberspace, typically assessed through some directly measurable indicators, such as cyber infrastructure, including the number of national Internet Protocol (IP) addresses, Internet access speed, and other metrics. Soft power, on the other hand, refers to the power achieved by a country through attraction and influence in the field of cyberspace [19]. Unlike hard power, which achieves its goals through direct control or threat, soft power influences other countries through culture, values, innovative ideas, and the guidance of global public opinion. For example, the international influence of online platforms is a key manifestation of soft power. This notion includes the widespread use of globally renowned social media platforms (such as Facebook, Twitter, and YouTube) or digital technology platforms (such as Alibaba, Tencent, and Bytedance). These platforms have become carriers of cultural transmission, political expression, economic exchange, and social interaction, influencing the global cyber ecology. In the international competition in cyberspace, hard and soft powers complement each other and together constitute the overall strength of a country in cyberspace. Visualizing a country’s influence within cyberspace facilitates the analysis of control capabilities, expansion trends, cooperative relationships, and their impacts on cybersecurity, stability, and development [20]. For instance, Leetaru et al. performed a visual analysis of Twitter activity using Twitter data and geographic information systems to reveal global usage patterns and activity levels, thereby highlighting the sphere of influence of various regions in cyberspace [21].

In summary, metaphors have emerged as a significant method to realize the modeling and expression of cyberspace environments. As a “basic map”, a cyber potential map can effectively depict and express the basic environment and related thematic information in cyberspace. However, some shortcomings remain in the modeling and expression of cyber potential in previous studies: (1) Traditional indicators and charts are employed to illustrate the extent of power in cyberspace. Although they provide some data support, they struggle to intuitively convey the adjacent relationships between countries in virtual space, and it is unfeasible to precisely depict the interactions and relative positions of countries in cyberspace; (2) The hierarchical relationship method fails to fully reflect the key feature of “connection” in cyberspace and ignores the complex and changeable interaction modes between entities in cyberspace; (3) Assessing power in cyberspace soly based on the quantity and density of network connections overlooks critical elements, such as national hard power infrastructure, economic power, and military power, resulting in an incomplete portrayal of cyberspace power.

To overcome the shortcomings of the existing cyber potential map modeling and expression methods, this paper presents a metaphorical mapping model that bridges cyber potential and administrative division mapping. This model leverages the foundamental theories and methods of metaphor mapping and integrates the basic data such as the GMap algorithm and cyberspace link data. On this basis, the cyber potential metaphor map is generated by graph embedding, graph clustering, spatial layout, and other technologies. This map serves as the “base map” for the superposition display of various thematic elements in cyberspace. Experiments of cyberspace potential analysis and connectivity analysis are carried out to evaluate the proposed method. The contributions of this paper are as follows: (1) By optimizing the metaphor mapping method, the proposed method overcomes the limitation of traditional graphic display, thereby more accurately reflecting the neighboring relations and interactive characteristics of countries in cyberspace; (2) Through the redesign of the cyber logical relationship model, the proposed method fully reflects the core position of “connectivity” in cyberspace and reveals the diversity of inter-state relations; (3) The proposed cyber potential map integrates cyberspace infrastructure, economic, military, and other hard power factors to provide a more comprehensive and profound display of cyberspace power. These innovations not only fill the gaps in existing research but also provide more intuitive and systematic visualization tools for cyberspace analysis and decision-making. The technical route of this paper is shown in Figure 1.

2. Research Approach

A “metaphor” is a concept rooted in linguistics [22], characterized by the unconventional juxtaposition of familiar and unfamiliar elements to deepen the understanding and comprehension of the unfamiliar [23,24]. The relationship between the tenor and the vehicle forms the fundamental structure of a metaphor. The tenor represents the primary subject or original concept of the metaphor, whereas the vehicle is the specific element used to illustrate or describe the tenor. A metaphorical map is a spatial text with a synthetic structure generated by the fabric of map symbols based on perceptual intention and map language, in which the culture, spirit, and concept conveyed by the map are the “noumenon”, and the visual image generated by map symbols is the “metaphor body” [25].

Cyber potential refers to the capability of a country, organization, or individual to manage information and data in cyberspace and exert influence or control or perform cyber operations targeting other entities. It encompasses both defensive and security capabilities, as well as the ability to leverage cyber technology and information resources to influence economic, political, and social domains.

Maps use boundaries, outlines, and territorial areas to delineate the borders, locations, and sizes of countries, providing an intuitive understanding of geographical space. Therefore, this study proposes the use of geographical representations of a country’s area, boundary lines, and location to metaphorically represent the scope of a country’s influence in cyberspace, as illustrated in Figure 2.

The ontology of “cyber potential” entails a foundational understanding of the cyber environment, requiring insights into the influence range of various nations in cyberspace, communication dynamics, and critical nodes. The metaphor of an “administrative division map” primarily symbolizes the territorial scope of a country or region, the structure of administrative divisions, the locations of administrative hubs, and the transportation networks [26]. Although these two concepts reside in different spatial domains, they possess significant similarities that serve as the basis for the metaphorical representation of a cyber potential map. The structure of an administrative division map can be utilized to represent the sphere of influence in cyberspace. Selecting and emphasizing specific characteristics within a metaphor are crucial for the creative interpretation of ontology, which is essential for forming visual metaphors in metaphorical maps. The metaphor of an “administrative division map” encompasses a variety of components, including residential areas, roadways, water systems, and administrative jurisdictions. The area of an administrative region represents the size of the geographic territory it covers, whereas boundaries delineate the geographical extent. Roads symbolize the connectivity networks between regions, illustrating transportation accessibility between cities. Hub cities indicate critical positions within the transportation cyberspace [27].

The “cyber potential map” ontology needs to clearly outline the influence spheres in cyberspace for different countries, the borders of these influence spheres, the connectivity between countries, and the critical nodes in the cyber connection nodes. By highlighting the shared characteristics of these map metaphors, we can accentuate the similarities, which, in turn, enables the visual representation of the metaphorical map through symbolization. The scope of cyberspace influence is depicted with area symbols in a variety of colors, whereas the backbone network is represented using line symbols, akin to road networks. The cyberspace backbone connections, categorized as “Backbone, Regional Connection, Local Connection, and Access Layers”, correspond to varying road classifications.

Specifically, the design can be divided into four distinct road levels. By employing color, line thickness, and other visual cues, the differences between these levels are clearly depicted, creating an intuitive, hierarchical cyberspace topology. (1) Backbone: The backbone layer serves as the core infrastructure of the global cyberspace, responsible for long-distance, high-capacity data transmission across nations and regions. It links the largest and most critical global nodes, including major data centers, international exchange points, and large-scale internet providers, thus forming the backbone of global internet traffic. On the cyberspace map, the backbone layer is represented by thick, bold lines in prominent colors like deep blue or black, signifying its importance and extensive reach. These lines link critical nodes, including data hubs and international undersea cables, and represent the major paths for global data flows. (2) Regional Connection: This layer bridges the backbone to smaller, regional cyberspaces, managing medium-capacity data traffic between nations or cities within specific regions. Much like major highways or inter-city roads, it facilitates cross-border or inter-regional data flow. Typically, the regional connection layer relies on fiber-optic links or satellite communications to efficiently route traffic from the backbone to local areas. On the map, it is depicted with medium-thick lines in lighter colors such as green or yellow, signifying its role as a crucial yet lower-capacity link compared to the backbone for regional connectivity. (3) Local Connection: The local connection layer connects cities, towns, and local infrastructures within a specific country or region, handling smaller, localized data flows. It distributes data to local users, businesses, and devices, resembling city roadways in the physical realm. This layer includes metro networks, city-wide fiber-optic loops, and regional ISPs. On the map, it is represented by slender lines in soft hues like light blue or pale green. This signifies its lower capacity compared to the regional and backbone layers and denotes localized connections like regional data centers or local ISP interlinks. (4) Access Layer: The access layer links individual users and devices (e.g., homes, businesses, public institutions) to the broader cyberspace. It represents the final leg of the data’s journey, routing traffic to personal computers, mobile devices, and public hotspots. On the map, the access layer is depicted with dotted or exceedingly thin lines in light gray or yellow, signifying its low-capacity, highly fragmented connections that have a more constrained scope and influence relative to the upper layers.

As depicted in Figure 3, the methodology for crafting the cyber potential metaphor map entails translating the “intangible, boundless” essence of cyberspace into a “concrete, delineated” representation on the cyber potential map [28]. The key stages are as follows:

(1) Cyberspace node-link data graphing: Foundational cyberspace resource data are leveraged, such as AS, domain-name system (DNS), IP, and vulnerabilities, to construct a “node-link” association graph. This process generates the cyberspace link graph where the AS and DNS servers are nodes and IP addresses are attributes of these nodes. These attributes aid in delineating the relationships between nodes and elucidating the structure of cyberspace.

(2) Mapping the cyberspace link graph to a two-dimensional (2D) plane: Graph embedding algorithms are employed to project the high-dimensional cyberspace “graph” to nodes on a 2D plane, similar to geographic “map projections”.

(3) Clustering cyberspace nodes by country: The k-means and modularity optimization algorithms are used to cluster discrete 2D cyber nodes.

(4) Mapping national cyber influence domains with a force-directed layout: The cyber potential of each nation is assessed using the cyber potential indicator system and the force-directed layout is refined in accordance with the direct connections between countries’ AS.

(5) Utilizing a map coloring algorithm to depict the diverse national sectors in cyberspace, we can ultimately create a metaphorical map of cyber potential.

3. Materials and Methods

The cyber potential metaphor map, with cyberspace power as its central theme, leverages geographic maps as a metaphor, utilizing familiar geographic map elements to depict the complex and abstract nature of cyberspace. In the proposed method, the cyber potential metaphor map is constructed using the GMap algorithm. The GMap algorith, a data visualization technique rooted in map metaphors, facilitates 2D map visualization of cyber connection data through processes such as graph embedding, graph clustering, and boundary generation. The first step of the GMap algorithm involves embedding the graph into a 2D space. Common embedding techniques include principal component analysis (PCA), multidimensional scaling (MDS), force-directed algorithms, and nonlinear dimensionality reduction methods such as locally linear embedding (LLE) and ISOMAP. The second step involves conducting cluster analysis on the graph or the embedded point set. During this step, it is essential to select a clustering algorithm that is compatible with the chosen embedding method. For instance, geometry-based clustering algorithms like k-means are well suited for embeddings derived from MDS as MDS tends to place similar vertices within the same geometric region, thereby ensuring a clear separation between clusters. In contrast, modularity-based clustering algorithms may be more appropriate for embeddings obtained from force-directed algorithms. These algorithms are closely related, and it is expected that vertices within the same cluster will be physically proximate during the embedding process. In the third step, the map is generated by integrating the 2D embedding with the clustering results. Finally, in the last step, the countries are assigned colors using a coloring algorithm designed to maximize the color contrast between neighboring countries [29,30,31,32,33].

3.1. Graph Embedding in Cyberspace Data

Graph embedding algorithms are techniques that map graph data (typically high-dimensional dense matrices) to low-dimensional dense vectors [34]. Cyberspace AS connection data represent high-dimensional graph connection data. The proposed method employs the DeepWalk algorithm to achieve dimensionality reduction, mapping cyber connection graph data to a 2D plane. DeepWalk is a graph structure data mining algorithm that integrate the random walk and Word2vec algorithms [35,36]. The main steps of DeepWalk are illustrated in Figure 4, as follows:

(1) Node sequence sampling via random walk: For each node in the AS-connected cyberspace graph, a random walk is initiated to collect locally associated data. This step involves iteratively selecting the next node based on a predefined strategy from the current node, thereby generating multiple node sequences.

(2) Learning representational vectors with the skip-gram model: The node sequences generated in the previous step serve as training data for the skip-gram model. During training, the skip-gram model aims to learn the contextual relationships between nodes, focusing on nodes that co-occur in random walks, to generate a low-dimensional vector representation for each node.

(3) Training the sampled data: The sampled data are trained using the skip-gram model to obtain vectorized node representations, maximizing node co-occurrence and employing hierarchical softmax for large-scale classification.

(4) Computing the embeddings for each node in the graph.

Algorithm 1 represents the pseudocode for embedding AS connection data into a 2D plane using the DeepWalk algorithm:

Algorithm 1: AS Connection Data Graph Embedding

Input:    AS connection graph G (V, E)

Window size ω

Output dimension d

Number of paths starting from each node γ

Length of each path t

Output: Matrix representing hidden information Φ ∈ R∣V∣ × d

1. Randomly initialize Φ.

2. Construct hierarchical softmax.

3. Perform γ random walks for each node.

4. Shuffle the nodes in the network.

5. Generate random walks of length t starting from each node.

6. Update parameters using the skip-gram model with gradient methods based on the generated random walks.

3.2. Cyberspace Graph Clustering Algorithm

3.2.1. Country AS Clustering Based on k-Means

The k-means algorithm is an iterative clustering analysis algorithm designed to partition n objects in a dataset into k clusters, minimizing the sum of distances from each object to the “the centroid of its assigned cluster” [37]. The distance is typically measured using the Euclidean distance. The specific steps (see Figure 5 and Figure 6) include the following:

(1) Initialize cluster centers using “country names”: Randomly select k data points as the initial cluster centers. Begin by randomly choosing a country name as the first initial cluster center. For each unselected AS number, calculate its minimum distance to the existing cluster centers and select the next cluster center based on the probability distribution of these distances. This approach ensures that k-means maintains a significant distance between initial cluster centers, helping to avoid local optima. This method ensures that the initial cluster centers in k-means are significantly spaced apart, thereby reducing the likelihood of converging to local optima.

(2) Calculate the distance between each node and the cluster centers. For each data point in the dataset, compute its Euclidean distance to each cluster center and assign it to the nearest cluster center. The calculation formula is

$$dist\left(x,c_i\right)=\sqrt{{\sum }_{j=1}^d{(x_j-c_{ij})}^2}$$

(1)

where x denotes the AS point, c_i denotes the i-th cluster center, d denotes the data dimension (typically 2D), and x_j and c_ij denote the values of x and c_i in the j-th dimension, respectively.

(3) Recalculate the cluster center. For each cluster (country), update its cluster center by computing the average of all data points within that cluster. The formula is

$$c_i={\displaystyle \frac{1}{\left|S_i\right|}}{\sum }_{x\in S_i}x$$

(2)

where S_i denotes the set of data points for the i-th cluster (country), and |S_i| denotes the number of data points in the set (the number of AS numbers).

(4) Perform clustering iteration: The allocation and update steps are iteratively executed until all AS numbers of a country are grouped within the same cluster (country), and the AS numbers of different countries are distinctly separated across clusters. At this point, the clustering process terminates.

3.2.2. National Node Modularity Optimization Algorithm

After applying the k-means algorithm for clustering analysis, the partition quality is often less than optimal. Despite a visual impression of connectivity within the subgraphs, the underlying node connections tend to be tenuous. Furthermore, the clustering process may result in overlaps between clusters of different countries. Inconsistent outcomes can arise from different initializations, highlighting the algorithm’s instability. The modularity of the clustering results is relatively low, exhibiting weak internal connections within clusters and stronger connections between different countries. Hence, it is essential to optimize the modularity of the clustering results. Modularity optimization generally leads to higher-quality community partitions, characterized by stronger internal connections and sparser connections between different countries. It also minimizes overlap between clusters, thereby clarifying the overall distribution structure. Additionally, modularity optimization can substantially enhance the modularity of clustering results, producing consistent and high-modularity country partitions even under different initialization conditions. This bolsters stability and mitigates sensitivity to initialization, thereby yielding comparable clustering outcomes across various initializations.

Modularity serves as a metric to assess and evaluate the quality of the algorithm’s network structure partitioning [38]. Consequently, the modularity of the initial clustering results can be calculated. The optimizing modularity enhances the internal cohesion within clusters and boosts clustering stability. The calculation formula for modularity is [39] as follows:

$$Q={\displaystyle \frac{1}{2m}}{\sum }_{ij}[A_{ij}-{\displaystyle \frac{k_i{k}_j}{2\omega }}]\delta (c_i,c_j)$$

(3)

A higher Q value indicates superior clustering quality. The range of Q is [−0.5, 1], A Q value nearer to 1 signifies superior clustering quality, implying that connections within AS connection domains are more robust, whereas those between AS connection domains are comparatively. Conversely, a Q value closer to −0.5 reflects inferior clustering quality, which may stem from overlapping connection domains or feeble internal connections. Since the computation of modularity takes into account the discrepancy between actual edge weights and random expected edge weights, in addition to connections both within and outside the community, this discrepancy cannot attain absolute symmetry. For example, a greater number of connections between nodes indicates stronger cohesion and a higher modularity value, approaching 1. However, if all the nodes are interconnected, forming a single large community, or if the communities are excessively close to one another, the modularity may decline. However, its minimum value will not reach −1, because the modularity sets a reasonable minimum value by comparing it to a stochastic model, thereby preventing the occurrence of extreme low values. In practical applications, a Q value ranging from 0.3 and 0.7 is typically considered indicative of good clustering performance. Within this range, connections within connection domains are stronger than those between domains. Meanwhile, it avoids issues of excessively dispersed connection domains that may arise with a high Q as well as the problem of overlapping domains that can occur with a low Q value [39]. Thus, a Q value between 0.3 and 0.7 represents a balance. It indicates that the clustering results possess adequate structure, avoiding both excessive aggregation and dispersion. This makes the partitioning of connection domains more practical and well suited for real-world applications. Let m represent the number of edges in the graph. A_ij denotes the elements of the adjacency matrix A. ω_ij represents the edge weight between nodes i and j. k_i and k_j indicate the numbers of neighboring nodes for nodes i and j, respectively. When i and j belong to the same country, δ(c_i, c_j) = 1; conversely, when they are in different communities, δ(c_i, c_j) = 0.

First, a bipartite graph is constructed based on the connections after clustering, where each node corresponds to two vertices which represent whether the node is present in the current cluster or not. Next, for each node i, the variable C_i stores its cluster number. Subsequently, every other node j is traversed to calculate both the edge weight between i and j and their respective cluster numbers C_i and C_j. If C_i = C_j, then the edge weight ω_ij is added to the modularity calculation; otherwise, no modifications are made. Finally, the total modularity is calculated using the formula (3). The pair of nodes that yields the highest modularity gain from all possible node pairs is selected and merged into the same cluster. Subsequently, the bipartite graph and modularity are updated to achieve the optimal final clustering result.

3.3. Spatial Layout Algorithm of Comprehensive Cyber Potential Indicators

3.3.1. Construction of the Cyber Potential Indicator System

The number of cyberspace AS, links, IP addresses, and vulnerabilities can partially reflect the robustness of cyberspace infrastructure and the communication capabilities of cyberspace links. However, these metrics alone do not provide a comprehensive assessment of cyber potential. To gain a more complete understanding of a nation’s or organization’s cyber potential, it is essential to consider a broader range of factors that encompass the following.

(1) Cyberspace technical strength: This factor encompasses the construction of cyberspace infrastructure, the level of research and development in cyberspacetechnology, and the development level of the information technology industry, which can be indicated by the number of national IPs and ASNs.

(2) Cyberspace security capability: This factor pertains to a country’s ability to secure its cyberspace, defend against cyberattacks, and manage cyber security incidents. It is reflected by the number of vulnerabilities present in the national cyberspace.

(3) Information control and dissemination capability: This factor involves a country’s capacity to regulate online information, guide public opinion, and disseminate culture and values on online platforms. It is represented by the number of secure Internet servers.

(4) International cooperation and diplomacy: This factor includes participation in global Internet governance and the level of cooperation with other countries in cyberspace technology and cybersecurity. It is indicated by the number of AS connections between countries.

(5) Legal regulations and policy environment in cyberspace: This factor includes the completeness of legal regulations in cyberspace and the extent to which policies support the cyberspace economy and innovation. It can be reflected by the Internet penetration rate.

Data on the number of vulnerabilities in national cyberspace is obtained through the “DaydayMap” platform [40]. The “DaydayMap” platform is a tool focused on cybersecurity situational awareness, particularly in detecting, evaluating, and managing potential vulnerabilities in cyberspace. By monitoring global and country-specific cyberspace, DaydayMap provides visibility into cyberspace security, helps users identify potential vulnerabilities, and provides data support for security. One of the main features of the platform is the use of cyberspace detection and vulnerability scanning technology to provide detailed information about known vulnerabilities while also providing a more accurate count of national vulnerabilities.

The Belfer National Cyber Power Index (NCPI) evaluates the cyber capabilities of 30 countries with a particular focus on assessing the objectives of seven nations [15]. This index incorporates 32 intention indicators and 29 capability indicators using data sourced from public information. However, the NCPI primarily considers subjective factors related to a country’s influence, governance, and legal frameworks in cyberspace. For a comprehensive assessment of a country’s cyber strength, objective capabilities, such as the number of AS domains and DNS servers, should be emphasized. Therefore, the proposed method constructs a model for the cyber potential indicator system based on the NCPI, involving the following steps:

(1) Design the influencing factors of cyber potential, including cyberspace technical strength, cyberspace security capability, international cooperation and diplomacy, economic strength, military strength, population size, and technological level.

(2) Develop design indicators: For each key factor, corresponding indicators are developed to quantify its influence. For instance, economic strength can be measured by indicators such as gross domestic product (GDP), trade volume, and foreign exchange reserves. Military strength can be assessed by the number of armed forces personnel and the ratio of military expenditure to GDP. The technological level can be evaluated by metrics such as the number of scientific journal articles, patent applications, education penetration rates, and high-tech industry export values. Specific measurement elements are summarized in

Table 1. Key factors and quantitative indicators.

Key Factor	Indicators
Cyberspace technical strength	Number of national IPs and ASN quantities.
Cyberspace security capability	Number of vulnerabilities in the national cyberspace.
International cooperation and diplomacy	Number of AS connections in the country.
Economic strength	Gross domestic product (GDP), trade volume, and foreign exchange reserves.
Military strength	Number of armed forces personnel and military expenditure as a percentage of GDP.
Population size	Population size.
Technological level	Number of scientific journal articles, patent applications, education penetration rate, and high-tech industry export value.

.

Drawing on the geopolitical potential model [41], a country’s cyberspace strength can be categorized into cyberspace influence (soft power) and overall national influence (hard power). According to the degree of influence of various indicators, the coefficient of variation weighting method is used to assign weights [42,43]. The coefficient of variation weighting method is an objective approach that directly derives weights from the original indicator data through statistical processing. It is characterized by its minimal susceptibility to subjective factors, rendering it highly suitable for projects with strongly independent evaluation indicators. The specific steps are as follows:

(a) Construct the original indicator data matrix: Given m indicators and n countries exist, let X represent the original data matrix, where x_ij denotes the value of the jth indicator for the ith country.

$$X=\left[\begin{array}{cccc}{x}_{11}& x_{12}& \dots & x_{1m}\\ x_{21}& x_{22}& \dots & x_{2m}\\ \dots & \dots & \dots & \dots \\ x_{n1}& x_{n2}& \dots & x_{nm}\end{array}\right]$$

(4)

(b) Data normalization processing:

$$\mathrm{Positive} \mathrm{indicator}: y_{ij}=x_{ij}-min(x_{1j},\dots ,x_{nj})/max(x_{1j},\dots ,x_{nj})-min(x_{1j},\dots ,x_{nj})$$

$$\mathrm{Negative} \mathrm{indicator}: y_{ij}=max(x_{1j},\dots ,x_{nj})-x_{ij}/max(x_{1j},\dots ,x_{nj})-min(x_{1j},\dots ,x_{nj})$$

(c) Calculate the standard deviation of the j-th indicator, which reflrcts the absolute variation degree of each indicator S_j. Let S_j represents the standard deviation of the j-th indicator:

$$S_j=\sqrt{{\displaystyle \frac{{\sum }_{i=1}^n{(y_{ij}-\overline{x_j})}^2}{n}}}$$

(5)

(d) Calculate the coefficient of variation for the j-th indicator, which reflects the relative variation degree of each indicator:

$$v_j={\displaystyle \frac{S_j}{y_j}}$$

(6)

(e) Calculate the weight w_j for the j-th indicator:

$$w_j={\displaystyle \frac{v_j}{{\sum }_{j=1}^m{v}_j}}$$

(7)

Given that current assessments of cyberspace strength prioritize cyberspace power and recognize the substantial impact of cyberspace infrastructure on a country’s overall cyberspace strength, the proposed method assigns a weight of 0.7 to the cyberspace influence component (soft power) and 0.3 to the overall national influence component (hard power). The weights assigned to the comprehensive cyberspace strength index are listed in

Table 2. Comparison and analysis of cyberspace map representation methods.

Primary Index	Weight	Secondary Index	Weight
Cyberspace Strength	0.7	IP number	0.55
		AS (indicates the number of autonomous domains)	0.06
		Number of DNS servers	0.04
		Number of domain names	0.15
		Internet penetration	0.11
		Number of secure Internet servers	0.05
		Number of vulnerabilities	0.04
Overall Strength	0.3	GDP	0.73
		Land area	0.27

.

(3) After assigning weights to the data, the Z-score standardization method is used to normalize the data to the range [0, 1] [44]. The specific steps are as follows:

Transform the sequence x₁, x₂,…, n:

$$y_i={\displaystyle \frac{x_i-\overline{x}}{s}}, \mathrm{where} \overline{x}={\displaystyle \frac{1}{n}}{\sum }_{i=1}^n{x}_i, s=\sqrt{{\displaystyle \frac{1}{n-1}}{\sum }_{i=1}^n{(x_i-\overline{x})}^2}$$

(8)

The new sequence y₁, y₂,… y_n has a mean of 0 and a variance of 1. Finally, the comprehensive strength of each country is calculated by

$$P={\sum }_{j=1}^n{a}_j{M}_j$$

(9)

where a_j represents the weights assigned to various indicators, and M_j indicates the metrics formed by cyberspace strength and overall strength.

(4) By referencing the geopolitical potential model [43], construct the cyberspace potential model:

$$W_{i}A={\displaystyle \frac{k_{iA}{\left(\partial P_i\right)}^c}{d_{iA}}}$$

(10)

where W_iA represents the cyberspace potential of country i in country A. k_iA represents the cyberspace dependency coefficient of country A on country i, determined by the ratio of A’s cyberspace facility import and export trade with i to A’s total cyberspace facility trade with the world. A larger k_iA indicates a higher cyberspace dependency of country A on country i, thereby increasing i’s cyberspace influence over A. ∂P_i represents the actual power of country i in country A, comprising both country i’s cyberspace comprehensive strength P_i and country A’s strategic investment willingness in i’s cyberspace ∂. ∂ is categorized into four levels: fundamental interests, important interests, ordinary interests, and no interests, corresponding to the values of ∂ as 1, (0.5, 1), (0, 0.5], and 0, respectively. c represents the national comprehensive strength of country i, and d_iA represents the cyberspace distance between the two countries, which is the cyberspace latency.

3.3.2. Force-Directed National Cyber Potential Map Layout

Based on the cyber connection clustering of national entities, the number of AS connections between countries and their direct associations are fully considered. However, accurately describing “adjacency” in cyberspace remains challenging. For instance, a greater number of cyber connections between countries implies a higher degree of dependency on their cyber communications, which could be characterized as an “adjacent relationship”. Therefore, the proposed method utilizes a force-directed layout algorithm to optimize the layout of “sections” in the cyberspace between countries. This algorithm is grounded in physics principles, simulating repulsive and attractive forces between nodes to attain optimal node placement [45]. The basic process is as follows:

First, countries within the same cluster are placed in the same area according to clustering results, with each node’s position initialized randomly.

Next, the repulsive, attractive, and connection forces between nodes are calculated. Repulsive forces serve to maintain a certain distance between countries within the same cluster, thereby avoiding overlap. Attractive forces pull countries within the same cluster closer together, bolstering the cluster’s cohesion. Connection forces create connecting lines between countries in different clusters and exert a specific attraction along these lines to ensure the connections between countries are not excessively weak. The positions of each node (country) are updated on the basis of the calculated forces. This process of force computation and position updating is iterated until convergence conditions are met.

Finally, connections are visualized by rendering lines or curves between countries to depict their interconnections. Each country is allocated a proportional area based on its calculated cyberspace strength index, and the map is reconstructed in accordance with the updated coordinates. To ensure consistent area representation despite alterations in the graphical layout, the size of each country is determined by its cyberspace strength index, which entails the following steps:

(1) Define the objective function: Define an objective function to quantify both polygon aggregation and the size of vacant land, where vacant land refers to unoccupied areas on the map that are not adjacent to any countries, as illustrated in Figure 7.

Consider using the Euclidean distance between polygon centroids to measure aggregation and the area of vacant land to measure size. Define the objective functions f₁ for aggregation and f₂ for vacant land size. The overall objective function is F = ω₁f₁ + ω₂f₂, where ω₁ and ω₂ denote weight coefficients used to balance the importance of the two objective functions. Assuming the coordinates of the centroid of the i-th polygon are (x_i,y_i), the distance between polygons can be expressed as the following:

$$d_{ij}=\sqrt{{(x_i-x_j)}^2+{(y_i-y_j)}^2}$$

(11)

Assume a polygon possesses n vertices with coordinates (x₁,y₁), (x₂,y₂)… (x_n,y_n). The coordinates of the centroid of the polygon are given by (x,y): $x={\displaystyle \frac{{\sum }_{i=1}^n{x}_i}{n}},y={\displaystyle \frac{{\sum }_{i=1}^n{y}_i}{n}}$. The objective function for polygon aggregation can be defined as the weighted sum of distances between polygons, $f_1={\sum }_{i=1}^{N-1}{\sum }_{j=i+1}^N{\omega }_{ij}{d}_{ij}$, where N denotes the number of polygons and ω_ij denotes the weight coefficient between polygons i and j. The objective function for vacant land size can be defined as the sum of the areas of the bounding rectangles of the polygons minus the sum of the areas of all polygons.

$$f_2={\sum }_{i=1}^{N-1}{\sum }_{j=i+1}^N(S_{ij}-A_i-A_j)$$

(12)

where S_ij denotes the area between the bounding rectangles of polygons i and j, and A_i and A_j denote the areas of polygons i and j, respectively. The area of a polygon is given by

$$A={\displaystyle \frac{1}{2}}\left|{\sum }_{i=1}^n(x_i{y}_{i+1}-x_{i+1}{y}_i)\right|$$

(13)

where n denotes the number of vertices of the polygon, (x_i,y_i) is the coordinate of the i-th vertex, and (x_i+1,y_i+1) is the coordinate of the next vertex. The area between the bounding rectangles is

$$S_{ij}=|x_i-x_j||y_i-y_j|$$

(14)

where (x_i,y_i) and (x_j,y_j) are the centroid coordinates of polygons i and j.

(2) Define the constraints: To ensure that the polygons are aggregated together without any vacant land, the following constraints are added:

(a) The minimum distance between any two polygons is no less than a preset value d_min.

(b) The maximum area of vacant land should not exceed a preset value S_max.

(c) The area of each polygon must remain unchanged after updating the coordinates, equating to its original area.

(3) Solve the optimization problem: Combine the objective function and constraints to form a standard optimization problem, expressed as follows:

$$\begin{array}{l}\mathrm{minimize}\mathrm{F}\left(\mathrm{x}\right)\\ \mathrm{subject} \mathrm{togi}\left(\mathrm{x}\right)\le 0, \mathrm{i}=1,\dots ,\mathrm{m}\\ \mathrm{hj}\left(\mathrm{x}\right)=0, \mathrm{j}=1,\dots ,\mathrm{p}\end{array}$$

where x denotes the coordinate vector of the polygons, gi(x) and hj(x) denote the inequality and equality constraint functions, respectively. Here, m and p denote the numbers of inequality and equality constraints, respectively. This problem is solved using nonlinear programming to obtain the optimal solution. Finally, the coordinates of relevant points and lines are updated using the calculated optimal solution, as illustrated in Figure 8.

4. Experiment and Discussion

4.1. Experiment Data

As shown in

Table 3. Cyberspace comprehensive strength index.

Index	Unit	Time
IP	Pcs	2023
AS	Pcs	2023
DNS Servers	Pcs	2023
Domain Names	Pcs	2023
Internet Penetration	Percentage	2021
Secure Internet Servers	Per million people	2020
CVE Vulnerabilities	Pcs	2023
GDP	Millions of dollars	2022
Land Area	Square kilometer	2023

, the experimental data are divided into two main parts: (1) Cyberspace connection data, which includes the number of IPs, AS counts, DNS server counts, and domain counts; (2) Data on national cyber power, which affects cyber spheres of influence. Key factors in this category include Internet penetration rates, secure Internet servers counts, vulnerability counts, GDP, and land area. All data are sourced from publicly available datasets on Index Mundi, Chacuo websites, the “DaydayMap” platform, and the International Bank for Reconstruction and Development [40,46,47,48].

(1)

Cyberspace connection data

➢

IP. The IP version used in this study was IPv6. The study focused on the actual usage and connectivity of these addresses rather than their mere allocation. Changes in the number of IP addresses indicate the development status of cyberspace and the region’s competitiveness in the global digital landscape [49].

➢

AS. It is a collection of one or more networks that are centrally managed and controlled by a single governing entity. Each AS usually has an independent routing policy and can autonomously decide how to exchange data with other ASs. An AS communicates and routes with other AS systems through the Border Gateway Protocol (BGP) [50]. The experiment utilized AS connectivity data, which consists of 6842 entries representing the AS connectivity across various countries.

➢

DNS. It is responsible for converting domain names into corresponding IP addresses. A higher number of DNS servers means that a country or organization can build a more robust and efficient domain name resolution infrastructure [51].

➢

Domain Names. It is a human-readable address used to identify resources on the internet. It serves as a convenient substitute for IP addresses, allowing users to access websites and online services more easily. The registration and management of domain names are governed by various domain registries, and the availability of domain names reflects the level of digital infrastructure and online presence in a region. A larger number of registered domain names indicates a more active and established presence in the global digital economy

(2)

Data on national cyber power

➢

Internet Penetration. The expansion of internet penetration directly influences a country’s prominence in global cyberspace. Greater internet access enables a larger portion of the population to connect to information networks, thereby facilitating the flow of information and social interaction. This, in turn, bolsters the nation’s digital economy and cultural dissemination. As internet penetration increases, so does the country’s influence and voice within the global cyberspace system.

➢

Secure Internet Servers. A robust presence of secure internet servers strengthens a country’s cybersecurity defenses, minimizing the risk of data breaches and cyberattacks. Countries with advanced cybersecurity technologies and effective defense measures can enhance their standing in global cyber governance. Secure servers not only safeguard national data but also foster trust in the country’s cyber capabilities, thereby promoting international cooperation.

➢

CVE Vulnerabilities. Cyber vulnerabilities pose significant risks to a country’s cyber power. When national information systems are riddled with vulnerabilities, they become potential targets for hackers, leading to data breaches and system disruptions. An increased number of vulnerabilities weakens a country’s cyber defenses, undermining its international reputation and trust in cybersecurity. This, in turn, can diminish its influence in global cyber affairs. The experiment utilized CVE vulnerability data, including 302 vulnerabilities that reflect the security flaws identified in each country. CVE refers to security vulnerabilities identified and managed by the globally standardized CVE numbering system, with each vulnerability assigned a unique number [52].

➢

GDP. Countries with higher GDP typically have greater resources to allocate toward information technology and cyberspace infrastructure. Such nations can invest more in strengthening cybersecurity, improving infrastructure, and driving digital transformation, thereby enhancing their position in the global digital economy. The stronger a country’s economic power, the greater its influence in global cyber governance and digital competition.

Land Area. Extensive land areas can present significant challenges in the development of information infrastructure, particularly in terms of cyber coverage and security in remote regions. While large countries may allocate more resources to enhancing their cyber infrastructure, their vast geographical size can create imbalances in cybersecurity management, impacting overall cyber power. The expansive land area also increases the complexity of cyberspace governance and security maintenance.

The cyberspace strength index of each country can be obtained using Equation (9). The top ten countries in terms of cyberspace strength are listed in

Table 4. Top ten countries in terms of overall cyberspace strength.

Country	Abbreviation	National Power Index
United States	US	0.84
China	CN	0.47
Russia	RU	0.24
Germany	DE	0.23
United Kingdom	GB	0.21
Brazil	BR	0.18
Canada	CA	0.18
Japan	JP	0.17
Australia	AU	0.16
France	FR	0.14

.

4.2. Visualizations of Cybers Potential Metaphor Map

The proposed method employs GMap to visualize AS connectivity data, with the results presented in Figure 9. Subsequently, the clustering criterion was changed to “country names”, and a force-directed layout algorithm was utilized to generate the cyber potential metaphor map, as illustrated in Figure 10, where each country name represents an AS domain of that country.

4.3. Experimental Analysis

4.3.1. Analysis of Cyberspace Sphere of Influence and Links

According to the analysis of the cyberspace potential metaphor map, the top ten countries ranked by cyberspace strength are the United States, China, Russia, Germany, United Kingdom, Brazil, Canada, Japan, Australia, and France, as shown in Figure 11. This ranking closely aligns with the top ten cyber powers identified in the NCPI which are summarized in

Table 5. Comparison with NCPI cyberspace power ranking.

Ranking	Cyberspace Comprehensive Strength	NCPI Ranking
1	United States	United States
2	China	China
3	Russia	Russia
4	Germany	United Kingdom
5	United Kingdom	Australia
6	Brazil	Netherlands
7	Canada	Korea
8	Japan	Vietnam
9	Australia	France
10	France	Iran

.

The discrepancy emerged due to the distinct methodologies employed in assessing cyberspace strength. In this study, the comprehensive strength of cyberspace is determined through objective data indicators, such as the number of national IPs, ASNs, and vulnerabilities. On the other hand, the NCPI places greater emphasis on subjective data for its analysis, incorporating metrics like cybersecurity awareness, risk literacy, successful Google content removal requests, and the scale of national standards organizations. The NCPI views cyberspace capability as the objectives a country aims to accomplish in or via cyberspace. In contrast, the national cyberspace’s comprehensive strength in this study is grounded in each country’s cyberspace mapping resources, thereby offering a more objective depiction of national cyberspace strength.

4.3.2. Thematic Information Expression Based on the Cyber Potential Map

Thematic information was incorporated into Figure 10 to create the “Global cyberspace power distribution and backbone level thematic map”, as shown in Figure 12. This thematic map was designed to visually convey the global distribution of cyber power through an intuitive manner. The cyberspace map was used as the base map, with the relative size of country areas illustrating the disparities in cyberspace strength among nations, thereby offering a lucid visualization of the global cyberspace strength distribution. The number of ASs was symbolically represented using hexagons as the outer frame of the symbols, symbolizing stability and structure to reflect the autonomous nature of cyberspace regions.

At the center of the graphic, an icon resembling a signal tower was used to indicate efficient and convenient cyber signal transmission. A gradient color scheme, ranging from light blue to dark blue, was employed to signify an increase in quantity, conveying information through variations in color intensity. Lines of different thicknesses represent the hierarchical structure of the three AS-backbone network levels, classified as Tier 1, Tier 2, and Tier 3. Tier 1 represents the global Internet backbone, characterized by networks that are directly interconnected and do not rely on external networks for IP packet routing. Tier 2 (secondary backbone) networks are typically regional or national providers connected to both Tier 1 and other Tier 2 networks via Internet exchange points or private peering agreements. Tier 3 (tertiary backbone) networks are local or regional providers that offer Internet access to end users and connect to higher-tier networks through rented or purchased bandwidth. The Tier 1 backbone network was represented by thicker lines, symbolizing its pivotal role as the core of the global network infrastructure. The Tier 2 backbone network was depicted with medium-thickness lines, reflecting its robust strength and broad distribution. Given the extensive number of Tier 3 networks, it is clear they were not fully displayed. Instead, only a specific region in XX Province, XX, was highlighted to exhibit local network details. Additionally, red, dark green, and blue were, respectively, used to indicate the number of IP addresses per country, number of DNS servers, and relative number of domain names compared to other countries. The aim of the overall design was to deliver a comprehensive analysis of global cyberspace resources and their structural hierarchy through a layered data presentation and engaging visual graphical display.

5. Conclusions and Prospects

5.1. Conclusions

In this study, AS connectivity data from various countries were employed as a base map to calculate and represent the comprehensive cyberspace strength of each country. This strength is metaphorically depicted as a geographical map, showcasing their relative positions and influence within cyberspace. Through comprehensive calculations and spatial metaphor representation, this research offers a novel perspective for analyzing and understanding national cyberspace development. By analyzing the AS connectivity data of each country, assessments of their comprehensive cyberspace strength were derived and represented by area size. The findings reveal that countries with stronger cyberspace strength occupy larger areas on the cyberspace map, whereas those with weaker strength appear in smaller areas. This visualization method effectively illustrates the relative positions and strength disparities among countries in cyberspace. The main contributions and innovations of this study are as follows:

(1) This paper proposes the “ cyber potential” model based on the geo-potential model. The model is used to measure the influence of different countries in cyberspace and is capable of reflecting the relative standing and cyber strength of countries in the global cyber landscape. By quantifying the cyberspace influence factors of countries on a specific region, the model reveals the interaction and interdependence of countries in cyberspace, providing a new perspective for understanding the global cyber order.

(2) The proposed method uses an improved GMap algorithm, which significantly improves the accuracy and effectiveness of cyberspace structure visualization. This improved algorithm not only more accurately portrays the cyberspace influence of various countries but also addresses the issue of regional dispersion of the same country on the map. By consolidating the regions of the same country, the display results better align with geographical space characteristics, thereby enhancing the map’s readability and intuitiveness

(3) Through the use of metaphor, the intricate cyberspace is transformed into an easily comprehensible regional distribution map, and a virtual sphere of influence map based on cyberspace power is constructed. In this map, larger countries signify strong cyber strength, while countries that are closer together indicate robust cyber cooperation between them. This approach not only simplifies the cyberspace analysis process but also aids users in more readily understanding the global cyberspace layout and the interactions among nations.

5.2. Prospects

Although this study made significant progress in investigating cyberspace maps, several areas warrant further exploration and improvement. First, the evaluation index system for comprehensive cyberspace strength could be further refined. Currently, national cyberspace strength is primarily assessed using factors such as IP counts, ASN counts, and vulnerabilities. However, as technology continues to advance, a range of additional crucial indicators are likely to gain relevance. These encompass cyber infrastructure, security capabilities, innovation in cyber applications, governance, and sustainability. It is imperative that future research endeavors place greater emphasis on integrating more comprehensive and precise evaluation metrics. Furthermore, the geographical metaphor employed to represent cyber strength could be broadened to encompass a wider array of dimensions. The proposed method simplifies cyber strength to area size on a geographical map, which provides an intuitive representation. However, given that cyber strength may encompass dimensions such as influence range and resilience, it follows that exploring various metaphorical representations could offer a more nuanced reflection of the position and strength of each country in cyberspace. Finally, a deeper investigation into the influencing factors and policy implications of national cyber strength is necessary. Although this study provides a preliminary analysis of the components of cyber strength, further examination of the relationships between these factors and their mechanisms of influence is needed. Integrating these insights with the current needs and status of different countries could yield targeted policy recommendations to guide their cyberspace development strategies.

In summary, the findings of this study present new perspectives and methods for understanding and analyzing national cyberspace development. Future research should aim to further investigate evaluation metrics, metaphorical geographical representations, and influencing factors and policy recommendations. This will propel the advancement of cyberspace map research and foster innovation in the field. The findings and methods presented herein lay the foundation for conducting more detailed analyses and innovative approaches cyberspace research, thereby contributing to our understanding of cyberspace and formulations of more effective strategies for national cyber development.