Research Progress and Future Trend Analysis of Network Security Situational Awareness

Abstract

With the continuous expansion of the network scale in recent years, network security problems have become increasingly prominent, and network security incidents have emerged one after another. Network security situation awareness is an essential part of network security defense that allows cybersecurity operators to cope with the complexity of today’s networks and threat landscape. In this paper, we thoroughly review and systematize the origin and the models of network security situational awareness and the evolution of its definition, and then we give its definition. Additionally, we introduced the key technologies in this field from the three functional modules of network security situation extraction, network security situation assessment, and network security situation prediction, and analyzed their advantages and disadvantages. Last but not least, we explicitly propose four possible research directions that the researchers in network security can work on in the future.