Heterogeneous Multi-Sensor Data Fusion with Multi-Class Support Vector Machines: Creating Network Security Situation Awareness

Abstract

Multi-sensor data fusion and network situation awareness are emerging technique in the field of network security and they help administrators to be aware of the actual security situation of their networks. This paper mainly focuses on heterogeneous multi-sensor data fusion and situation awareness. We adopted Snort and NetFlow collector as two sensors to gather real network traffic and fused them use multi-class support vector machines that could solve a multi class problem. In order to avoid dimension disaster, we employed an effective feature reduction approach to decrease the dimension of input vector and the computation time of support vector machines that improved fusion performance and real time characteristic. Our framework is proved to be feasible and effective and has better performance than neural network through a series of experiments that using real network traffic.