Graph database-based network security situation awareness data storage method

Xiaoling Tao,Yang Liu,Changsong Yang,Yong Wang,Feng Zhao

doi:10.1186/s13638-018-1309-9

Abstract

With the rapid development of the Internet, network security situation awareness has attracted tremendous attention. In large-scale complex networks, network security situation awareness data presents the characteristics of large-scale, multi-source, and heterogeneous. Recently, much research work have been done on network security situation awareness. However, most of the existing methods store different types of data in different ways, which makes data query and analysis inefficient. To solve this problem, we propose a graph database-based hierarchical multi-domain network security situation awareness data storage method. In our scheme, we build a hierarchical multi-domain network security situation awareness model to divide the network into different domains, which can collect and dispose the awareness data more efficiently. Meanwhile, to unify our storage mode, we also define network security situation awareness data storage rules and methods based on graph database. Finally, extensive experiments on real datasets show that our proposed method is efficient compared to state-of-the-art storage models.

Highlights

With the advancement of network technology and the expansion of network scale, the network security risks are increasingly prevalent, such as network attacks, network vulnerabilities, data and privacy security [1, 2], and so on
network security situation awareness (NSSA) has been extensively studied in the past decades
1.1 Our contributions In this paper, we propose a graph database-based hierarchical multi-domain NSSA data storage method

Summary

Introduction

With the advancement of network technology and the expansion of network scale, the network security risks are increasingly prevalent, such as network attacks, network vulnerabilities, data and privacy security [1, 2], and so on. Masduki et al [7] designed an intrusion detection-based NSSA system, which utilized intrusion detection software Snort and Bro to collect and analyze malicious traffic, and the data should be stored in the PostgreSQL database These awareness schemes used relational database which cannot satisfy the storage requirement for heterogeneously multi-source data. By using Neo4j graph database, our method can truly reflect the network security situation and improve the efficiency of data query and the visualization of query results. Ashwin et al [18] proposed an efficient and secure information retrieval framework for content centric networks Their scheme used the Neo4j graph database to replace the content storage in the current CCNx implementation. They use Neo4j to improve the efficiency of storing and processing large-scale data since Neo4j does not use connection operations

Organization We organize the rest of this paper as follows

Hierarchical multi-domain NSSA data storage method

Query analysis of graph database-based NSSA data

Conclusion