Security Situation Assessment Model Research Articles

A network security situation assessment method based on fusion model

This research introduces an innovative network security situation assessment (NSSA) model, designed to overcome the shortcomings in feature extraction quality and efficiency observed in existing methods. At the core of this model is a fusion model (FM), which uniquely combines an attention mechanism with a bi-directional gated recurrent unit (BiGRU). This FM framework is adept at extracting pivotal information pertinent to various cyber threats. It employs the attention mechanism to assign appropriate weights to these crucial features, thereby elevating the model’s precision. The BiGRU, in synergy with newly proposed quantitative indicators, is responsible for generating the final evaluation results, offering a more refined measure of the cybersecurity stance. Comparative threat detection experiments reveal that the FM model exhibits superior performance across multiple evaluation metrics, marking a significant advancement in the field of network security assessment.

Research on Network Security Situation Assessment Model in Decentralized Computing Environment

Abstract In this paper, decentralized computing is used as an entry point to review the latest research results on network security issues through two methods, namely task assignment and hierarchical analysis, and construct a network security posture assessment model based on decentralized computing. A control framework is constructed by utilizing the functional complementarity of continuous authentication and security threat assessment in order to facilitate real-time observation of the security situation of the network and timely elimination of malicious nodes. A quantitative network security threat posture assessment model is constructed through hierarchical analysis to observe the extent of the breach of confidentiality and integrity of network information based on the security threat posture index. The effectiveness of the network security posture assessment model and method proposed in this paper was verified by empirical analysis in a simulated environment. The results show that after the simulated attack lasts for 12 minutes, the network security risk index measured by the assessment model in the test cascade case becomes larger with the intensification of the network attack, and the risk index value is up to 5.5. In summary, the network security posture assessment model based on decentralized computing designed in this paper can quickly reflect the changes in the security status of the underlying network and provide administrators with the current security status of the network in a macroscopic way.

A novel network security situation assessment model based on multiple strategies whale optimization algorithm and bidirectional GRU.

The rapid development of the internet has brought about a comprehensive transformation in human life. However, the challenges of cybersecurity are becoming increasingly severe, necessitating the implementation of effective security mechanisms. Cybersecurity situational awareness can effectively assess the network status, facilitating the formulation of better cybersecurity defense strategies. However, due to the low accuracy of existing situational assessment methods, situational assessment remains a challenge. In this study, a new situational assessment method, MSWOA-BiGRU, combining optimization algorithms and temporal neural networks, was proposed. Firstly, a scientific indicator system proposed in this research is used to calculate the values of each indicator. Then, the Analytic Hierarchy Process is used to derive the actual situation values, which serve as labels. Taking into account the temporal nature of network traffic, the BiGRU model is utilized for cybersecurity situational assessment. After integrating time-related features and network traffic characteristics, the situational assessment value is obtained. During the evaluation process, a whale optimization algorithm (MSWOA) improved with a mix of strategies proposed in this study was employed to optimize the model. The performance of the proposed MSWOA-BiGRU model was evaluated on publicly available real network security datasets. Experimental results indicate that compared to traditional optimization algorithms, the optimization performance of MSWOA has seen significant enhancement. Furthermore, MSWOA-BiGRU demonstrates superior performance in cybersecurity situational assessment compared to existing evaluation methods.

Enhanced Internet of Things Security Situation Assessment Model with Feature Optimization and Improved SSA-LightGBM

In this paper, an improved Internet of Things (IoT) network security situation assessment model is designed to solve the problems arising from the existing IoT network security situation assessment approach regarding feature extraction, validity, and accuracy. Firstly, raw data are dimensionally reduced using independent component analysis (ICA), and the weights of all features are calculated and fused using the maximum relevance minimum redundancy (mRMR) algorithm, Spearman’s rank correlation coefficient, and extreme gradient boosting (XGBoost) feature importance method to filter out the optimal subset of features. Piecewise chaotic mapping and firefly perturbation strategies are then used to optimize the sparrow search algorithm (SSA) to achieve fast convergence and prevent getting trapped in local optima, and then the optimized algorithm is used to improve the light gradient boosting machine (LightGBM) algorithm. Finally, the improved LightGBM method is used for training to calculate situation values based on a threat impact to assess the IoT network security situation. The research findings reveal that the model attained an evaluation accuracy of 99.34%, sustained a mean square error at the 0.00001 level, and reached its optimum convergence value by the 45th iteration with the fastest convergence speed. This enables the model to more effectively evaluate the IoT network security status.

Network Situation Assessment Method Based on Improved BP Neural Network

Although a software defined network (SDN) realizes the flexible configuration and centralized control of network resources, there are potential security risks and challenges. Network security situation awareness (NSSA) technology associates and integrates multi-source heterogeneous information to analyze the impact of the information on the whole network, and network security situation assessment can grasp the network security situation information in real time. However, the existing situation assessment methods have low assessment accuracy, and most of the studies focus on traditional networks, while there are few situation assessment studies in the SDN environment. In this paper, by summarizing the important index parameters of SDN, a network security situation assessment model based on the improved back propagation (BP) neural network (based on the cuckoo search algorithm) is proposed, and the step factor of the cuckoo search algorithm (CS) was improved to improve the search accuracy. The model maps the situation elements to the layers of the neural network, and optimizes the weights and thresholds of the BP neural network through the cuckoo search algorithm to obtain the global optimal solution; it finally realizes the purpose of situation assessment and the comprehensive rating of the SDN environment. In this paper, the evaluation model was verified on the network set up in Mininet. The experimental results show that the situation assessment curve of this model is closer to the real situation value, and the accuracy rate is 97.61%, with good situation assessment results.

A New Model for Network Security Situation Assessment of the Industrial Internet

To address the problem of network security situation assessment in the Industrial Internet, this paper adopts the evidential reasoning (ER)algorithm and belief rule base (BRB) method to establish an assessment model. First, this paper analyzes the influencing factors of the Industrial Internet and selects evaluation indicators that contain not only quantitative data but also qualitative knowledge. Second, the evaluation indicators are fused with expert knowledge and the ER algorithm. According to the fusion results, a network security situation assessment model of the Industrial Internet based on the ER and BRB method is established, and the projection covariance matrix adaptive evolution strategy (P-CMA-ES) is used to optimize the model parameters. This method can not only utilize semiquantitative information effectively but also use more uncertain information and prevent the problem of combinatorial explosion. Moreover, it solves the problem of the uncertainty of expert knowledge and overcomes the problem of low modeling accuracy caused by insufficient data. Finally, a network security situation assessment case of the Industrial Internet is analyzed to verify the effectiveness and superiority of the method. The research results show that this method has strong applicability to the network security situation assessment of complex Industrial Internet systems. It can accurately reflect the actual network security situation of Industrial Internet systems and provide safe and reliable suggestions for network administrators to take timely countermeasures, thereby improving the risk monitoring and emergency response capabilities of the Industrial Internet.

A network security situation assessment model based on BP neural network optimized by D-S evidence theory

Abstract Traditional networks rely heavily on the distribution of expert experience when assessing complex network security situations, resulting in low assessment accuracy, which has been unable to adapt to the current network security needs of the big data era, and has unavoidable problems such as low efficiency and poor flexibility. In response to these problems, this paper proposes a network security situation assessment method based on D-S evidence theory to optimize neural networks. First establish the CS-BP neural network model, enhance the local search ability of the cuckoo algorithm through conjugate gradient calculation, and then introduce it into the BP neural network to improve the training convergence speed and overcome the local minimum problem; finally, in order to reduce the basic probability distribution (BPA) subjective impact, using DS evidence theory to optimize the CS-BP neural network, determine the degree of impact of each attack, and evaluate the value of the network security situation. The experimental results show that the network situation assessment model of CS-BP neural network optimized based on D-S evidence theory can effectively assess the network security situation in the environment of trusted equipment.

Effectiveness of Security Incident Event Management (SIEM) System for Cyber Security Situation Awareness

Cyber-attacks have always targeted information communication technology systems of various organizations.Intruders and hackers have within their reach, very powerful tools through which they capable to bypassthe existing network security so as to deliver a payload that might have a severe impact on the wholeorganization. Therefore, it has become essential for organizations to develop mechanisms through whichthey can detect a possible cyber threat and then respond accordingly. By establishing cybersecurity situationawareness, organizations will understand what is happening and then respond effectively. The presentstudy evaluated the effectiveness of the Security Incident Event Management (SIEM) system for CyberSecurity Situation Awareness. A Hierarchical Network Security Situation Assessment Model (referred toHNSSAM) which joins Security Incident Event Management (SIEM) system evidence theory fusion ruleswith classified quantitative risk assessment method was applied. Data processing was initially designed soas to collect security data from various sensors. Mechanisms for data verification were then adopted so as toestablish whether SIEM was effective in successfully detecting any form of cyber-attack. Results show thatSIEM tools may be applied by security analysts to gain visibility into the security threats attacking the ITsystems of an organization and then respond appropriately.

A Security Situation Assessment Model of Information System for Smart Mobile Devices

The accuracy of the existing security situation assessment model of information system for smart mobile devices is affected by expert evaluation preferences. This paper proposes an information system security situation assessment model for smart mobile devices, which is based on the modified interval matrix-entropy weight-based cloud (MIMEC). According to the security situation assessment index system, the interval judgment matrix reflecting the relative importance of different indexes is modified to improve the objectivity of the index layer weight vector. Then, the entropy weight-based cloud is used to quantify the criterion layer and the target layer security situation index, and the security level of the system is graded. The evaluation experiment on the departure control system for smart mobile devices not only verify the validity of this model but also demonstrate that this model has higher stability and reliability than other models.

Network Security Situation Assessment Model Based on Extended Hidden Markov

A network security situation assessment system based on the extended hidden Markov model is designed in this paper. Firstly, the standard hidden Markov model is expanded from five-tuple to seven-tuple, and two parameters of network defense efficiency and risk loss vector are added so that the model can describe network security situation more completely. Then, an initial algorithm of state transition matrix was defined, observation vectors were extracted from the fusion of various system security detection data, the network state transition matrix was created and modified by the observation vectors, and a solution procedure of the hidden state probability distribution sequence based on extended hidden Markov model was derived. Finally, a method of calculating risk loss vector according to the international definition was designed and the current network risk value was calculated by the hidden state probability distribution; then the global security situation was assessed. The experiment showed that the model satisfied practical applications and the assessment result is accurate and effective.

Network Security Situation Assessment Model based on Information Quality Control

Network Security Situation Assessment Model based on Information Quality Control

Cognitive machine learning model for network information safety

The problem of network information security has resulted in a significant increase in economic losses, resulting in an increase in the energy loss of learning resource scheduling in situational cognitive learning networks. In order to improve the scheduling ability of learning resources in networks, a situational cognitive learning model based on network information security is proposed. Considering the limitation of data packet delay in attenuation channel, the link equilibrium configuration condition of learning resource scheduling output is obtained. Based on this, a situational cognitive learning network security situation assessment model is constructed to reflect the security situation in learning scheduling system and the degree of harm to the system. Based on the inertia weight of learning resources output, the data flow model of learning resources in situational cognitive learning network is constructed, and the sharing security settings of situational cognitive learning network resources are realized by combining the network security situation assessment model. Optimize the cognitive learning mode network, select the candidate nodes that meet the conditions as Sink nodes, and take the initial energy of the nodes as the constraint index, carry out the learning path planning of Situational Cognition under network information security, realize the optimization of learning resource scheduling, and complete the construction of situational cognitive learning mode. The simulation results show that this method is applied to secure scheduling of learning resources in situational cognitive learning network, can reduce the energy consumption of network nodes, improve the survival probability of situational cognitive learning nodes, maximize the benefits of balanced control of learning resources, reduce economic losses and optimize the situational cognitive learning model.

Security situation assessment for massive MIMO systems for 5G communications

Abstract MIMO technology is a key technology of 5G, which is widely used in next-generation scenarios such as heterogeneous networks, millimeter-wave networks, and automotive networks. How to build a large-scale MIMO system security situation assessment model for 5G has become the main topic of current concern. This paper analyzes the situational awareness theory of 5g-oriented MIMO system security. Firstly, based on the theory of MIMO system, the influence of MIMO system on 5G network security and the theory of situation awareness technology, the security situation awareness system model of 5g-oriented large-scale MIMO system is constructed. In the security situation assessment section of the MIMO system, according to the rules of evidence reasoning, of different active attack and passive eavesdropping two kinds of empowerment behavior under different attribute data, and then put the empowerment process of average power and large scale attenuation coefficient, interrupt probability, series, and maintain confidentiality gain data as model inputs, such as implementing MIMO system level of situation assessment. In the security situation prediction part of MIMO system, based on the actual situation level of the system as the criterion, 30 sets of experimental simulation data are used to predict the next moment situation level of the MIMO system. In order to verify the stability and validity of the model, MATLAB is used to simulate the experiment. The results show that the mean square error RMSE of different iterations is kept below 0.02, and the TSQ values of both sides are kept below 0.16. The overall prediction effect of the model was good, indicating that the system could provide effective decision support for 5G MIMO security situation prediction

Network Security Situation Assessment Model Based on GSA-SVM

In order to solve the problem of insufficient accuracy caused by the selection of support vector machine (SVM) parameters in situation assessment, a network security situation assessment model (GSA-SVM) based on GSA optimization of SVM parameters is proposed, which combines the characteristics of less parameters needed to be set by gravity search algorithm (GSA) and strong global optimization capability. Firstly, the model receives the situation assessment data evaluated by the expert system, and then searches for the optimal parameters in SVM through GSA, minimize the error between the generated data and the actual network security situation assessment data. The effect of the model is verified by using Eggcrate function and actual situation assessment data. The results show that this method has good learning ability and is better than Particle Swarm Optimization (PSO) in SVM optimization.

Research on Network Security Situation Assessment and Quantification Method Based on Analytic Hierarchy Process

In hierarchical network security situation assessment model, there are many problems, such as subjective index weight factor, large evaluation index system, large amount of calculation and low efficiency. A network security situation assessment model and quantification method based on AHP is proposed to solve this problem. The AHP analytic hierarchy process (AHP) is combined with the hierarchical model of situation assessment to simplify the situation assessment problem. The D–S evidence theory is used to fuse the fuzzy results of multi-source equipment to solve the problem of single information source and large deviation of accuracy. Through the construction of three evaluation indexes of risk situation, basic operation situation and damage situation, the problem of large evaluation index system and low evaluation efficiency is solved. AHP analytic hierarchy process is used to determine the weights of different index items, so as to avoid the subjectivity and randomness of weighting factors. The simulation results show that the model can reflect the security status of the network as a whole, and the situation assessment is accurate and can better serve the high-level decision-making.

A Quantitative Risk Assessment Model Involving Frequency and Threat Degree under Line-of-Business Services for Infrastructure of Emerging Sensor Networks.

The prospect of Line-of-Business Services (LoBSs) for infrastructure of Emerging Sensor Networks (ESNs) is exciting. Access control remains a top challenge in this scenario as the service provider’s server contains a lot of valuable resources. LoBSs’ users are very diverse as they may come from a wide range of locations with vastly different characteristics. Cost of joining could be low and in many cases, intruders are eligible users conducting malicious actions. As a result, user access should be adjusted dynamically. Assessing LoBSs’ risk dynamically based on both frequency and threat degree of malicious operations is therefore necessary. In this paper, we proposed a Quantitative Risk Assessment Model (QRAM) involving frequency and threat degree based on value at risk. To quantify the threat degree as an elementary intrusion effort, we amend the influence coefficient of risk indexes in the network security situation assessment model. To quantify threat frequency as intrusion trace effort, we make use of multiple behavior information fusion. Under the influence of intrusion trace, we adapt the historical simulation method of value at risk to dynamically access LoBSs’ risk. Simulation based on existing data is used to select appropriate parameters for QRAM. Our simulation results show that the duration influence on elementary intrusion effort is reasonable when the normalized parameter is 1000. Likewise, the time window of intrusion trace and the weight between objective risk and subjective risk can be set to 10 s and 0.5, respectively. While our focus is to develop QRAM for assessing the risk of LoBSs for infrastructure of ESNs dynamically involving frequency and threat degree, we believe it is also appropriate for other scenarios in cloud computing.

A Cost-Sensitive Entropy-Based Network Security Situation Assessment Model

Network intrusion attempts have been on the rise recently. Researchers have shown an increased interest in assessing the security situation for entire network instead of single asset. A considerable amount of assessment models have been designed. However, there is a lack of solid and standard guidelines to define the importance of network asset. In addition, based on our knowledge, no research has been found that adequately covered the cost factor in the assessment model. Thus, the purpose of this paper is to propose a cost-sensitive entropy-based network security situation assessment model. With the aid of Analytic Hierarchy Process (AHP), the model can quantitatively determine the importance of assets in the network by considering the tangible and intangible criteria. To verify the performance of proposed model, a simulation of National Advanced IPv6 Centre (NAv6)’s network environment has been setup. The simulation results regarding security situation in particular time-interval are promising. Hence, the proposed model is able to provide network administrator a more reliable reference before any further decision making for the organization’s network.

A Study on Network Security Situation Evaluation Model

With the rapid development of computer technology and communication technology, user demand more and more and with the application of computer network becoming more and more widely, its scale is becoming increasingly big. But on the other hand, there are so many network security events and the traditional single defense equipment or testing equipment has been unable to meet the demand of security; computer network is faced with severe situation of the information security. Network security situation assessment technology can reflect on the whole dynamic network security situation, and give early warning to its development trend by comprehensively considering various security factors. Therefore, the network security situation assessment model and key technology has become the hot topic of research in the field of network security.

Network security situation awareness model based on autonomic computing

Concerning the complexity of network security management and the absence of self-adaptation on situation awareness process,a Network Security Situation Awareness Model(NSSAM) based on autonomic computing was proposed.The situation extraction was analyzed in real-time by an autonomic feedback law.From the perspectives of attack and defense,a multi-level and multi-angle network security situation assessment model employing Analytic Hierarchy Process(AHP) was established according to the extracted situation information.The model of future network security situation prediction adopting improved genetic neural network was built on the basis of the past and current network security situation.Test results show that NSSAM with autonomic feedback mechanism can effectively enhance self-adaptation of the system.

Multi-sensor Data Fusion for Cyber Security Situation Awareness

Abstract To analyze the influence of security incidents on a networked system and accurately evaluate system security, this paper proposes a novel cyber security situation assessment model, based on multi-heterogeneous sensors. By using D-S evidence theory, we fuse security data submitted from multi-sensors, according to the network topology and the importance of services and hosts. Moreover, we adopt the evaluation policy that from bottom to top and from local to global in this model. The evaluation of a simulated network indicates that the proposed approach is suitable for network environment, and the evaluation results are precise and efficient.