A Network Security Situation Awareness Model Based on Artificial Immunity System and Cloud Model

Abstract

The artificial immune theory and the cloud model theory are applied to the research on situation awareness of network security in this paper. A security situation awareness model is established from three levels, including situation perception, situation comprehension and situation projection. In the model, network attacks can be real-timely monitored by the intrusion detection technology based on the danger theory and the cloud model; network security situation can be evaluated by the calculation of antibody concentration changes which have relationship with the attack power, and can be predicted by a new mechanism of time-series prediction based on cloud models according to the historical and current situations. The theoretical analysis and experimental results show that the model is effective to network security situation awareness with advantages of real-time and high accuracy.