Network Security Situation Awareness Research Articles

Research on a Critical Link Discovery Method for Network Security Situational Awareness.

Network security situational awareness (NSSA) aims to capture, understand, and display security elements in large-scale network environments in order to predict security trends in the relevant network environment. With the internet's increasingly large scale, increasingly complex structure, and gradual diversification of components, the traditional single-layer network topology model can no longer meet the needs of network security analysis. Therefore, we conduct research based on a multi-layer network model for network security situational awareness, which is characterized by the three-layer network structure of a physical device network, a business application network, and a user role network. Its network characteristics require new assessment methods, so we propose a multi-layer network link importance assessment metric: the multi-layer-dependent link entropy (MDLE). On the one hand, the MDLE comprehensively evaluates the connectivity importance of links by fitting the link-local betweenness centrality and mapping entropy. On the other hand, it relies on the link-dependent mechanism to better aggregate the link importance contributions in each network layer. The experimental results show that the MDLE has better ordering monotonicity during critical link discovery and a higher destruction efficacy in destruction simulations compared to classical link importance metrics, thus better adapting to the critical link discovery requirements of a multi-layer network topology.

Detection of Geographic Information System Security Hazards in the IoT Based on Network Security Situation Awareness

Abstract The geographic information system (GIS) is the important system these days for navigation and directing the routes. In order to detect the security risks of the GIS efficiently and accurately and to protect the security of the GIS, a GIS security risk detection method in the Internet of Things based on network security situational awareness has been proposed. The data preprocessing method based on the operation data of the GIS is adopted. The normalized and standardized processing of the operation data of the GIS is devised to reduce the dimensional difference between the data and the geographical areas. This will facilitate the subsequent applications of the GIS to make better decisions by preserving the security. The redundant data in the GIS operation data are removed by using feature reduction algorithms through the acquisition method. The security elements based on enhanced probabilistic neural network are inferred, and the useful data samples are obtained as the security elements detection set. A rough set theory is also used to realize geographic security hidden danger identification. The experimental results show that the proposed method is efficient to maintain security and to detect the geographic security risk detection within a short span of time. The detection result accuracy is high, which meets the GIS application requirements.

Network awareness of security situation information security measurement method based on data mining

Awareness of Network Security Situation (abbreviated as NSS for short) technology is in a period of vigorous development recently. NSS technology means network security situational awareness technology. It refers to the technology of collecting, processing, and analyzing various real-time information in the network to understand and evaluate the current network security status. It can not only find network security threats, but also reflect the NSS in the system security metrics, and provide users with targeted security protection measures. Based on data mining methods, this paper analyzed and models perceived threats and security events with data mining algorithms, and improved information security measurement methods based on association analysis. This paper proposed network security information analysis and NSS based on data mining, and analyzed the experimental results of network awareness of NSS information security measurement. The experimental results showed that when the Timer was 8, the accuracy of the awareness of NSS information security measurement method based on data mining can reach 92.89%. The data mining model had the highest accuracy of 93.14% in situation understanding and evaluation of KDDCup-99 dataset. The results showed that the model can accurately predict the NSS. When Timer was 6, the highest accuracy of the model was 92.71%. In general, the NSS prediction mining model based on KDDCup-99 can better understand, evaluate and predict the situation.

Estimating computer network security scenarios with association rules

Traditional NSSA (network security situational awareness) systems are problems familiarize to enormous for complicated network circumstances due to instrument limitations, inadequate and data fusion capabilities. This paper proposes the investigation of Association Rules (AR) based NSS (network security situation) prediction technology. Mining for regulations for associations to remedy this issue re- confidence support framework is enhanced by incorporating an interest. The assessment standard is revised, and the worth of AR is reassessed established on a discussion of associated standard ideas and algorithms AR mining. This research proposes an MFP-interest algorithm that combines an alert AR pattern with a degree of interest. The MFP-interest algorithm was evaluated. The researcher found that the MFP-interest algorithm is capable of accurately predicting NSS. The majority of time points have relative error ranges of less than 0.035.

Research on Substation Network Security Situational Awareness Strategy and Equipment Remote Operation and Maintenance

Abstract Substation network security is the key to maintaining the stable operation of power systems. In the face of growing threats of network attacks, traditional security protection measures have been brutal to meet the needs of modern power systems. Research on substation network security, situational awareness strategies, and remote operation and maintenance of equipment is essential to improve network defense capability and ensure the continuity and reliability of power supply. This study explores effective security situational awareness methods and remote operation and maintenance techniques to provide new solutions for substation network security. This paper builds an efficient network attack detection model by introducing linear discriminant analysis (LDA) and radial basis function (RBF) neural networks. The experiment uses the KDD Cup99 dataset, which is preprocessed to provide the model training and testing data. The LDA-RBF model in this paper outperforms the traditional RNF neural and BP neural networks regarding recognition rate. Specifically, the recognition rate reaches 90.2% for the Smurf attack and 100% for the Ipsweep attack. The proposed model of the study also performs well in terms of leakage and false alarm rates, with an overall recognition rate of 97.00%. This study proposes a network security situational awareness strategy and equipment remote operation and maintenance method that can effectively enhance substation networks’ security and operation and maintenance efficiency.

Application of machine learning algorithm and data evaluation in computer network security situation awareness technology

With the rapid development of information technology and the rapid popularization of the Internet, while people enjoy the convenience and efficiency brought about by new technologies, they are also suffering from the harm caused by cyber attacks. In addition to efficiently thwarting network assaults, a high volume of complicated security event data might unintentionally increase the strain of policy makers. At present, NS threats mainly include network viruses, trojans, DOS (Denial-Of-Service), etc. For the increasingly complex Network Security (NS) problems, the traditional rule-based network monitoring technology is difficult to predict the unknown attack behavior. Environment-based, dynamic and integrated data fusion can integrate data from a macro perspective. In recent years, Machine Learning (ML) technology has developed rapidly, which could easily train, test and predict existing third-party models. It uses ML algorithms to find out the association between data rather than manually sets rules. Support vector machine is a common ML method, which can predict the security of the network well after training and testing. In order to monitor the overall security status of the entire network, NS situation awareness refers to the real-time and accurate reproduction of network attacks using the reconstruction approach. Situation awareness technology is a powerful network monitoring and security technology, but there are many problems in the existing NS technology. For example, the state of the network cannot be accurately detected, and its change rule cannot be understood. In order to effectively predict network attacks, this paper adopted a technology based on ML and data analysis, and constructed a NS situational awareness model. The results showed that the detection efficiency of the model based on ML and data analysis was 7.18% higher than that of the traditional NS state awareness model.

A Priori Algorithm Based Network Security Situational Awareness Multi-Source Data Correlation Analysis Method

In the context of the information age, the Internet has developed rapidly, but the accompanying network security threats have also become an issue that cannot be ignored. In order to effectively respond to these threats and improve the data processing capabilities of network security situational awareness, the study focuses on the challenges of multi-source data processing and proposes a multi-source data association analysis method based on the A priori algorithm. This method aims to deeply explore the implicit relationships between data and provide stronger support for network attack detection. In addition, the study also designed a multi-level evaluation method based on coefficient of variation indicators, aiming to provide a more objective and comprehensive evaluation of the detection results. After a series of experimental verification, the proposed correlation analysis method has achieved significant results in detecting phishing attacks and DOS attacks, with detection rates of 90.3% and 93.8%, respectively. At the same time, the multi-level evaluation method has also been experimentally proven to provide more reasonable and accurate results for data evaluation. The methods and technologies proposed in the study can not only improve the multi-source data processing ability of network security situational awareness, but also provide valuable references for future network security research and practice.

Network virus propagation and security situation awareness based on Hidden Markov Model

The security situation of the network is determined by the observation state and hidden state of a complex virus system. To analyze the relationship between the two states and evaluate the trends in the security situation of the system, we construct a new model for security situation awareness based on Hidden Markov Model (HMM). Firstly, the paper examines the impact of virus propagation on network security and proposes a new SIR (Susceptible–Infected–Recovered) virus propagation model on scale-free networks. Secondly, we construct a Hidden Markov Model for network security, and this model designs and utilizes the Forward Algorithm and Viterbi Algorithm to assess the security status of epidemic networks. Finally, we ascertain the effectiveness of the model and algorithms through model examples and simulation experiments. The results show that the proposed algorithm is highly efficient in analyzing the security of virus systems and has great application value in predicting the security trends of networks.

Retracted: Research on Network Security Situational Awareness Based on Crawler Algorithm

Retracted: Research on Network Security Situational Awareness Based on Crawler Algorithm

ALSNAP: Attention-based long and short-period network security situation prediction

The Internet of Things (IoT) and other emerging communication and network technologies enable improved efficiency, convenience, and connectivity in various domains. However, these advancements also pose significant security risks due to the increasing complexity of attacks and the lack of effective security strategies. Traditional security schemes, such as signature-based intrusion detection systems, have limited predictive power and require a considerable number of cybersecurity staff. Therefore, proactive defense techniques based on network security situation prediction are essential. Network security situation prediction aims to forecast the future state of network security based on historical data and current observations. However, current prediction methods can only capture either long-term or short-term data features, leading to unsatisfactory results. In contrast, this paper proposes a novel attention-based long and short-period network security situation prediction (ALSNAP) scheme that combines improved bidirectional long short-term memory, vector autoregression, and multi-scale convolution with branching attention. It applies an attention mechanism to optimize the prediction model and enhance its accuracy. We evaluated ALSNAP on four public network datasets, including three typical IoT datasets, and compared it with other state-of-the-art methods. Our results demonstrate that ALSNAP achieves higher prediction accuracy than other methods. We also analyzed the potential applications of our scheme to real networks and its integration into intelligent network security situation awareness systems to deliver timely and effective countermeasures.

Research on hierarchical network security situation awareness data fusion method in big data environment

ABSTRACT With the increase in the number of network users, data information has become more abundant, and query speed and coverage have greatly improved. In this era, the problem of information leakage is relatively serious, and some malicious software has invaded the network system of user devices, increasing the threat to network security. In order to improve the analysis ability of network security situation awareness, this study designs a hierarchical network security situation awareness data fusion method under the big data environment. On the basis of data fusion technology and network security situation awareness technology, the hierarchical network security situation information is collected. Then, its features are extracted, and the network security situation awareness process is constructed based on RBF neural. By using this process, hierarchical network security situation awareness data can be obtained. The data is first sorted out and analyzed, and then the data is filtered. Finally, the matrix three decomposition data fusion algorithm is selected as the blueprint of the data fusion method. It can complete the hierarchical network security situation awareness data fusion. Experimental results show that the proposed method has high matching accuracy, little influence on the data fusion time due to the increase of data volume and low energy consumption in the fusion process.

A Hidden Markov Model-Based Network Security Posture Prediction Model

Abstract As a key technology of network security situational awareness, this paper focuses on network security situational prediction technology and proposes a new network security situational prediction model based on Hidden Markov Model. The paper proposes a network security posture prediction method based on the improved Hidden Markov Model for the problem that the Baum-Welch parameter training method of the traditional Hidden Markov Model for posture prediction is sensitive to initial values and easily falls into local optimum. The method obtains the initial parameters by introducing the simulated annealing algorithm and using its excellent probabilistic burst-jump property to find the optimal in the global range. The Baum-Welch algorithm is used to optimize the initial parameters further to obtain the optimal model parameters, and then a more accurate posture prediction model is established. The probability of occurrence of the alarm information sequence corresponding to the network security posture value of 3 at t= 4 is obtained by simulating the network environment for testing, which is 0.000268, 0.000152, 0.000147, 0.000284, and 0.000187. Comparing the generated network security posture values with the real situation, it is found that the predicted results in this paper are highly similar to the real values. It is verified that the improved Hidden Markov method can effectively improve the accuracy of the network security posture prediction model and reflect the network security situation more objectively and realistically.

Machine Learning-Based Research on Network Security\'s Primary Technologies

Abstract: A large number of network devices, applications, and the explosive growth of network data have made the network environment extremely complex with significant potential hazards to network security. This is due to the ongoing development of information technology. Cyber attackers are now attacking network settings with connected histories rather than just common users; examples of these environments include businesses, governments, and nations. Massive amounts of Internet data have been produced by the diversification of network services, and traditional network security systems have had trouble keeping up with the demands of network security in terms of performance and self-adaptability. The growth of concepts in the field of network security has been greatly aided by research on machine learning-based network security that has produced numerous findings, demonstrating strong skills in processing large data, automatic learning, detection, and identification. In this paper, we integrate machine learning-related technologies to enhance the performance of intrusion detection and alarm correlation automation, and we investigate key technologies such as machine learning-based network security situational awareness methods and dynamic data stream classification methods based on judgment feedback, to enhance the detection performance, adaptive and generalization capabilities of machine learning-based network security

The Current Research Status of AI-Based Network Security Situational Awareness

Network security situational awareness is based on the extraction and analysis of big data, and by understanding these data to evaluate the current network security status and predict future development trends, provide feedback to decision-makers to make corresponding countermeasures, and achieve security protection for the network environment. This article focuses on artificial intelligence, summarizes the related definitions and classic models of network security situational awareness, and provides an overview of artificial intelligence. Starting from the method of machine learning, it specifically introduces the research status of neural-network-based network security situational awareness and summarizes the research work in recent years. Finally, the future development trends of network security situational awareness are summarized, and its prospects.

Distribution Network Security Situation Awareness Method Based on the Distribution Network Topology Layered Model

Distribution network security situation awareness refers to the process of perception, understanding, and state projection of systems, elements, and environmental factors within a certain space-time volume. Security situation awareness is an important part of the security assessment of the distribution network. In response to the rapid and accurate distribution network security situation awareness requirements, this paper proposes a distribution network security situation awareness method based the distribution network topology layered model. First, a hierarchical model of the distribution network topology under the premise of optimizing the location of the synchronous phasor measuring device is constructed. This model can quickly capture the system security situation elements. Then, a support vector data description algorithm fused with information entropy is used to realize the identification and understanding of abnormal information in the security situation elements of the distribution network. The long- and short-term memory network is then used to predict the operation trend of the distribution network under normal operation and fault disturbance. Finally, a simulation is established, and the IEEE-33 distribution network model is used to verify the effectiveness of the method proposed in this paper. The results show that the method of this paper improves the speed and accuracy of obtaining the security situation elements of the distribution network, shortens the identification time of the security situation elements, and realizes the security situation awareness of the nodes of the distribution network.

Establishment of nonlinear network security situational awareness model based on random forest under the background of big data

Abstract In order to explore the establishment of a nonlinear network security situational awareness model based on random forest in the context of big data, a multi-level network security knowledge system evaluation model based on random forest is proposed. This article proposes a multi-level CSSA analysis system and then uses random memory algorithm to create a CSSA evaluation model. Also, it proposes a CSSA multi-level analysis framework and then uses random forest algorithm to build a CSSA evaluation model. A random vector distribution of the same values is used for all forest trees. In this article, the interval [0,1] is used to quantitatively describe the weight of the security level. The training sample ratio of test samples is 110:40, in order to predict the security of the network, the prediction of knowledge is closer to the true value, and the complexity of multi-level security is predicted. Use unusual forests. The tree returns the most recommended part, which is a more realistic assessment of network security. The experimental results show that considering the network security situation, the prediction performance of this method is closer to the actual value, and the performance is better than the other two methods. Therefore, perception of multi-level security situations can be effectively predicted using random access memory. It is proved that random forest is faster and more efficient in network security.

Exploration of a network security situational awareness model based on multisource data fusion

Exploration of a network security situational awareness model based on multisource data fusion

Research on Network Security Situation Awareness and Dynamic Game Based on Deep Q Learning Network

<p>In today’s increasingly complex network environment, increasingly severe network attacks, and real-time dynamic changes in offensive and defensive scenarios, network security technology has also evolved from passive security to active security technology, and expanded from analyzing unilateral security elements to comprehensively analyzing overall network security. Aiming at the problem of inaccurate assessment results due to the lack of comprehensive analysis of threat information, protection information and environmental information in existing assessment methods, this paper proposes a defensive random game model. This model analyzes threat propagation and establishes a threat propagation access relationship network, and then establishes a random game model for the game process of threat action and protection strategy implementation to solve the mixed strategy Nash equilibrium. The model comprehensively analyzes the dynamic changes of the security situation elements, ignoring the short-term situation elements that will not change, such as topology structure, service information, etc., and mainly analyzes the dynamic changes of attack information, vulnerability information, and defense measures, and predicts from the host and network levels. The experimental verification shows that the prediction method in this paper can improve the prediction accuracy and is more in line with the offensive and defensive scenarios.</p> <p> </p>

Survey of Technology in Network Security Situation Awareness

Network security situation awareness (NSSA) is an integral part of cybersecurity defense, and it is essential for cybersecurity managers to respond to increasingly sophisticated cyber threats. Different from traditional security measures, NSSA can identify the behavior of various activities in the network and conduct intent understanding and impact assessment from a macro perspective so as to provide reasonable decision support, predicting the development trend of network security. It is a means to analyze the network security quantitatively. Although NSSA has received extensive attention and exploration, there is a lack of comprehensive reviews of the related technologies. This paper presents a state-of-the-art study on NSSA that can help bridge the current research status and future large-scale application. First, the paper provides a concise introduction to NSSA, highlighting its development process. Then, the paper focuses on the research progress of key technologies in recent years. We further discuss the classic use cases of NSSA. Finally, the survey details various challenges and potential research directions related to NSSA.

Hierarchical network security situation awareness data fusion method in cloud computing environment

In order to improve the accuracy of hierarchical network security situational awareness data fusion and shorten the fusion time, this paper proposes a hierarchical network security situational awareness data fusion method in cloud computing environment. The hierarchical model is established to obtain the hierarchical structure of data fusion. Hierarchical network security situational awareness data are collected and processed in parallel by cloud computing technology. According to the data collection results, the similarity between security events is calculated by using the clustering idea, and the similar security events are merged to achieve the purpose of removing redundant events. The hierarchical network security situational awareness data is fused by grey relational analysis. Finally, the simulation results show that the accuracy of data fusion of this method is high, up to 98%, and the fusion time is short, the longest is 13 s. Compared with the comparison method, this method has a better performance, indicating that this method is suitable for data fusion of hierarchical network security situation awareness.