Security Situation Awareness System Research Articles

Security Situation Awareness System Based on Artificial Intelligence

There is rapid growth of the security threats faced by enterprises and the security attacks technology is also established at a higher level. Enterprises are facing an escalating threat landscape marked by sophisticated security attacks. To address the structural and technical challenges of information security situational awareness, a method for designing an artificial intelligence-driven system is proposed. In order to solve the system structure and key technical problems of information security situational awareness technology of artificial intelligence, a method of designing information security situational awareness system is proposed, and experiments are carried out through the method. By analyzing the data sources that the system needs to collect, including network traffic mirror data, log data, security intelligence and support data, this paper verifies the feasibility of the system method of information security situational awareness technology of artificial intelligence technology. The proposed core competence platform has the characteristics of low delay and robust real-time capabilities. By presetting the event processing topology, we can quickly build the event processing process, and build the corresponding event processing topology model according to different processing requirements to meet the business requirements. The AI-powered information security situational awareness system substantially enhances security awareness and prediction accuracy.

Construction and Analysis of Network Cloud Security Situation Awareness System Based on DBN-DE Algorithm

With the wide application of cloud computing, network security has become the primary issue in cloud environment. This study focuses on constructing a system focusing on network cloud security situation awareness, and combines deep belief network with differential evolution algorithm to improve the perception and analysis capability of network cloud security. Differential evolution algorithm is used to optimize DBN weights and parameters to improve system performance and generalization ability. In the aspect of system performance evaluation, the effectiveness of the system is verified by a series of experiments. The experimental results show that the system based on DBN-DE has excellent performance in network attack detection and can quickly identify various potential threats. The system also has a low false alarm rate, which can reduce the frequency of administrator intervention, and improve the efficiency and reliability of network cloud security.

Research on Network Security Situation Awareness Technology Based on Security Intelligent Monitoring Technology

This paper uses data mining technology to dynamically monitor tobacco Industrial Enterprise' information systems. This paper builds an Internet security situation awareness system under a big data environment. The weight clustering method is used to classify users' network behavior. The spacing of weights is optimized to ensure the maximum difference in classification. Then, NAWL-ILSTM technology establishes a security situational awareness model for the Internet environment. In this project, the extended and short-memory Nadam optimal algorithm (NAWL) is used to realize data deep learning. Finally, the tobacco industry network security situation assessment method is designed to complete the dynamic monitoring of tobacco industry network security based on data mining. Simulation results show that the proposed method can effectively improve the safety evaluation performance of the system and reduce evaluation errors.

Power monitoring network security situation awareness system based on Knowledge Map

When selecting network security indicators, the conventional security situational awareness system ignores the impact of operation and maintenance index and assets on network security, resulting in a small number of attack events perceived by the system when network nodes are attacked. In order to solve this problem, this research designs a power monitoring network security situational awareness system based on knowledge map. In terms of system hardware, the overall system architecture is composed of data layer, function layer and interface layer, and the data collector is used to collect network security risk data; In terms of system software, the knowledge map graph is used to describe the network security risk data. After calculating the network security vulnerability index, assets, security event compensation and operation and maintenance index, the calculation results are used as the network security index to obtain the network security situation value. The test results show that the system can reflect the attack events in all attack stages, and the number of perceived attack events is significantly more than that of the conventional system, indicating that the system can effectively perceive the security situation of the power monitoring network.

Application of network security situational awareness in power information system security

The increasingly complex network environment leads to more and more intense network attacks. Traditional firewall and intrusion detection technology cannot guarantee the network security of power information system, so network space situation awareness becomes the most important in the field of network security. Big data technology can be used to better understand the operation of the network, and different types of data for rapid analysis. Build a security situation awareness system framework that integrates data collection, data processing, data storage, data analysis and data presentation to filter out harmful data and ensure network security. In this paper, the basic concept and system framework of network security situational awareness are briefly introduced. Firstly, Flume and Kafka are used to obtain log or network attack information, and MapReduce and Storm technologies are used for batch or real-time analysis to achieve the perception of network security. Then, the analytic hierarchy process (AHP) is used to determine the index weight, extract the characteristics of the network situation, and complete the evaluation of the network security situation by analyzing and constructing the decision matrix. The system has the characteristics of high availability, scalability and easy deployment, which can better support the perception and prediction of various network security threats.

Hierarchical Network Security Measurement and Optimal Proactive Defense in Cloud Computing Environments

This paper presents an in-depth study and analysis of hierarchical network security measurement and optimal active defense in the cloud computing environment. All the cloud platform security-related data collected through cloud platform monitoring is collected, and then the relevant security data is summarized and analyzed, so that the specific security posture index of the cloud platform can be derived, thus providing a reference for cloud platform managers to judge the security risks of the cloud platform. It provides a reference for cloud platform managers to judge the security risks of cloud platforms. Through the cloud platform security situation awareness system, we mainly study the construction of cloud platform, the construction of security situation awareness system, and the calculation of security situation value and use, thus greatly improving the stability, security, and reliability of the cloud platform. The application of the method avoids the drawbacks of traditional network security management, which relies entirely on past data and cannot sense changes in the security state of the system in real time. At the same time, the predicted results are added to the input of the fuzzy decision-making system, improving the accuracy of the assessment. The method improves the real-time and effectiveness of network security posture prediction, increases the convergence speed and prediction accuracy of the algorithm, and avoids the occurrence of overfitting. Simulation experiments based on the internet network security posture dataset show that this research method has less prediction error than the traditional machine learning methods and other deep learning methods, has higher learning efficiency, and is more rapid, accurate, and effective in predicting the trend of network security posture in the big data environment in the future period.

Internet of vehicles security situation awareness based on intrusion detection protection systems

With the rise of technologies such as mobile Internet, 5G networks and artificial intelligence, the development of Internet of Vehicle Information Security (ICVS) has become the mainstream and direction for the future development of the automotive industry. ICVS, people, roads, clouds, and APP constitute a complex network of vehicles. As part of the Internet, vehicle networking will inevitably face various complex information security threats and risks. This paper aims to design a kind of security situation awareness of Internet of vehicles based on intrusion detection protection systems (IDPS). By collecting the security data of car, app and private cloud for big data analysis, the whole smart car security situation awareness system is constructed. The system can be used to analyze potential threats, send out warnings, and carry out emergency responses.

A Prediction Method of Network Security Situation based on QPSO-SVM

In network security situation awareness system, situation prediction is the key point. The traditional intrusion detection method lacks scalability in the face of the changing network structure and lacks adaptability in the face of unknown attack types. In order to ensure and improve the accuracy of situation prediction, a QPSO-SVM prediction model is proposed by combining the optimization performance of quantum particle swarm optimization and the prediction accuracy of support vector machines. By adding the original sequence to the original sequence, this model weakens the irregular disturbance in the original sequence and enhances the regularity of the sequence. Compared with the traditional SVM and PSOSVM, the superiority of the prediction precision is better, the prediction accuracy can be ensured, and the validity of the model is tested by the simulation experiment.

Multimodal content protection information security situation awareness system based on PCCA

Nowadays, many of these societies’ data or texts (e.g., emails, messages posted in social media, healthcare outcomes, etc.) has become unstructured and semantic nature. This constitutes a challenge for automatic data protection methods. Hence, in this paper multimodal content protection information security situation awareness system based on PCCA is developed. In this position confidentiality conserving algorithm for content protection (PCCA) is used. The proposed algorithm applies computational intelligence for content protection by means of rule-based approach from computational intelligence and user’s current position information. Hence, PCCA can efficiently conserve roaming user’s position confidentiality while accomplishing better performance, guaranteed position confidentiality, and better quality of service.

Security situation assessment for massive MIMO systems for 5G communications

Abstract MIMO technology is a key technology of 5G, which is widely used in next-generation scenarios such as heterogeneous networks, millimeter-wave networks, and automotive networks. How to build a large-scale MIMO system security situation assessment model for 5G has become the main topic of current concern. This paper analyzes the situational awareness theory of 5g-oriented MIMO system security. Firstly, based on the theory of MIMO system, the influence of MIMO system on 5G network security and the theory of situation awareness technology, the security situation awareness system model of 5g-oriented large-scale MIMO system is constructed. In the security situation assessment section of the MIMO system, according to the rules of evidence reasoning, of different active attack and passive eavesdropping two kinds of empowerment behavior under different attribute data, and then put the empowerment process of average power and large scale attenuation coefficient, interrupt probability, series, and maintain confidentiality gain data as model inputs, such as implementing MIMO system level of situation assessment. In the security situation prediction part of MIMO system, based on the actual situation level of the system as the criterion, 30 sets of experimental simulation data are used to predict the next moment situation level of the MIMO system. In order to verify the stability and validity of the model, MATLAB is used to simulate the experiment. The results show that the mean square error RMSE of different iterations is kept below 0.02, and the TSQ values of both sides are kept below 0.16. The overall prediction effect of the model was good, indicating that the system could provide effective decision support for 5G MIMO security situation prediction

IDC安全态势感知系统研究与应用

IDC安全态势感知系统研究与应用

Study on network security situation awareness based on particle swarm optimization algorithm

Abstract The research of network security situation assessment has made great progress, but with the advent of the era of big data, the results of these studies show its limitations and shortcomings, it is difficult to meet the network security under the big data environment needs. Aiming at the network security situation awareness in large data environment, the network security situation awareness index system is firstly established, and the index factors are selected and quantified, and then the situation value is calculated to construct the network security situation awareness system. For the selection and quantification of index factors, we select multi-source data in large data environment, and propose a parallel reduction algorithm based on attribute importance matrix to reduce data source data attributes. For the calculation of the situation, the traditional wavelet neural network learning method is easy to fall into the local minimum, the wavelet neural network parameters are optimized by particle swarm algorithm, and then the wavelet neural network based on particle swarm optimization is applied to calculate the situation value. The simulation results show that the algorithm has fast convergence speed and good fitting effect.

A hierarchical P2P model and a data fusion method for network security situation awareness system

A hierarchical peer-to-peer (P2P) model and a data fusion method for network security situation awareness system are proposed to improve the efficiency of distributed security behavior monitoring network. The single point failure of data analysis nodes is avoided by this P2P model, in which a greedy data forwarding method based on node priority and link delay is devised to promote the efficiency of data analysis nodes. And the data fusion method based on repulsive theory-Dumpster/Shafer (PSORT-DS) is used to deal with the challenge of multi-source alarm information. This data fusion method debases the false alarm rate. Compared with improved Dumpster/Shafer (DS) theoretical method based on particle swarm optimization (PSO) and classical DS evidence theoretical method, the proposed model reduces false alarm rate by 3% and 7%, respectively, whereas their detection rate increases by 4% and 16%, respectively.

Research of Immune Network Defense System Based on Black Hole Theory

Active defense technology may predict future attack situation and detect unknown attacks, but it has many questions to will be researched: vulnerability, lower mal-ware detection rate, security situation awareness technology has faced problem of inter-organization cooperation, real-time response, correlation analysis, high-load low fault tolerance. Artificial immune technology combines with active defense technology to solve integrated artificial immune security situation awareness system with artificial immune technology and active defense technology by Black Hole theory and for diversification ad development characteristics of the artificial immune and active defense, gives a method about simulating Black Hole accretion theory to achieve absorption and utilization a variety of security and virus technology; a no escaped mechanism simulate the Black Hole; a method about access control method based on Hawking radiation theory. Based on the above work, applies virtual and sandbox technology to achieve network system itself virus immunity, and then that we implement re-engineering and reverse engineering for virus technology in order to study virus and dig more holes, create unified integrated defense tactics, so this defense system will improve ability of situation comprehension, situation prediction and intelligence decision.