一种网络安全态势自适应预测模型

doi:10.19665/j.issn1001-2400.2020.03.003

Abstract

Abstract:

Aiming at the low prediction accuracy of traditional network security situation prediction technology, a network security situation adaptive prediction model (NAP) is proposed. First, it extracts alarm elements and calculate network security situation time sequences based on the entropy correlation method. Then, the sequences are taken as the input of the sliding adaptive cubic exponential smoothing method with initial security situation predicted value sequences generated. Finally, the time-varying weighted Markov chain is used to predict the error value based on the error state and the initial predicted values are modified. Experimental results show that the NAP has a better prediction accuracy than other existing models.

Key words: network security situation, entropy correlation method, predicted value, cubic exponential smoothing method, time-varying weighted Markov chain

CLC Number:

TP309

YANG Hongyu,ZHANG Xugao. Network security situation adaptive prediction model[J].Journal of Xidian University, 2020, 47(3): 14-22.

Figures/Tables 10

指标	低	一般	高
$A F H i$	P₁₁	P₁₂	P₁₃
$A C H i$	P₂₁	P₂₂	P₂₃
$A S H i$	P₃₁	P₃₂	P₃₃

References 17

[1]	LEAU Y B, MANICKAM S. Network Security Situation Prediction: a Review and Discussion[J]. Communications in Computer and Information Science, 2015,516:424-435.
[2]	CIPRIANO C, ZAND A, HOUMANSADR A, et al. Nexat: a History-based Approach to Predict Attacker Actions [C]//Proceedings of the ACM International Conference Proceeding Series. New York: ACM, 2011: 383-392.
[3]	XIAO P, XIAN M, WANG H M. Network Security Situation Prediction Method Based on MEA-BP [C]//Proceedings of the 3rd IEEE International Conference on “Computational Intelligence and Communication Technology”. Piscataway: IEEE, 2017: 7977327.
[4]	SUN S X. The Research of the Network Security Situation Prediction Mechanism Based on the Complex Network [C]//Proceedings of the 2015 International Conference on Computational Intelligence and Communication Networks. Piscataway: IEEE, 2015: 1183-1187.
[5]	LEAU Y B, KHUDHER A A, MANICKAM S, et al. An Adaptive Assessment and Prediction Mechanism in Network Security Situation Awareness[J]. Journal of Computer Science, 2017,13(5):114-129. doi: 10.3844/jcssp.2017.114.129
[6]	SCHATZ D, BASHROUSH R. Security Predictions—a Way to Reduce Uncertainty[J]. Journal of Information Security and Applications, 2019,45:107-116. doi: 10.1016/j.jisa.2019.01.009
[7]	XIAO J, ZHANG B Q, LUO F Z. Distribution Network Security Situation Awareness Method Based on Security Distance[J]. IEEE Access, 2019,7:37855-37864. doi: 10.1109/Access.6287639
[8]	王晋东, 余定坤, 张恒巍, 等. 静态贝叶斯博弈主动防御策略选取方法[J]. 西安电子科技大学学报, 2016,43(1):144-150. doi: 10.3969/j.issn.1001-2400.2016.01.026
	WANG Jindong, YU Dingkun, ZHANG Hengwei, et al. Active Defense Strategy Selection Based on the Static Bayesian Game[J]. Journal of Xidian University, 2016,43(1):144-150. doi: 10.3969/j.issn.1001-2400.2016.01.026
[9]	周新卫, 李小玲. 基于改进 $G-k$ 算法的多节点网络安全态势预测模型 [J]. 科学技术与工程, 2018,18(25):72-77.
	ZHOU Xinwei, LI Xiaoling. Multi Node Network Security Situation Prediction Model Based on Improved $G-k$ Algorithm [J]. Science Technology and Engineering, 2018,18(25):72-77.
[10]	孙卫喜, 孙欢. 网络安全态势预测技术研究[J]. 计算机技术与发展, 2019,29(4):100-104.
	SUN Weixi, SUN Huan. Research on Network Security Situation Prediction Technology[J]. Computer Technology and Development, 2019,29(4):100-104.
[11]	张任川, 张玉臣, 刘璟, 等. 应用改进卷积神经网络的网络安全态势预测方法[J]. 计算机工程与应用, 2019,55(6):86-93.
	ZHANG Renchuan, LIU Yuchen, LIU Jing, et al. Network Security Situation Prediction Method Using Improved Convolution Neural Network[J]. Computer Engineering and Applications, 2019,55(6):86-93.
[12]	WERNER G, OKUTAN A, YANG S, et al. Forecasting Cyberattacks as Time Series with Different Aggregation Granularity [C]//Proceedings of the 2018 IEEE International Symposium on Technologies for Homeland Security. Piscataway: IEEE, 2018: 8574185.
[13]	席荣荣, 云晓春, 张永铮, 等. 一种改进的网络安全态势量化评估方法[J]. 计算机学报, 2015,38(4):749-758.
	XI Rongrong, YUN Xiaochun, ZHANG Yongzheng, et al. An Improved Quantitative Evaluation Method for Network Security[J]. Chinese Journal of Computers, 2015,38(4):749-758.
[14]	DEBAR H, WESPI A. Aggregation and Correlation of Intrusion-Detection Alerts [C]//Lecture Notes in Computer Science: 2212. Heidelberg: Springer Verlag, 2015: 85-103.
[15]	赵冬梅, 张玉清, 马建峰. 熵权系数法应用于网络安全的模糊风险评估[J]. 计算机工程, 2004,30(18):21-23.
	ZHAO Dongmei, ZHANG Yuqing, MA Jianfeng. Fuzzy Risk Assessment of Entropy-weight Coefficient Method Applied in Network Security[J]. Computer Engineering, 2004,30(18):21-23.
[16]	付钰, 吴晓平, 叶清, 等. 基于模糊集与熵权理论的信息系统安全风险评估研究[J]. 电子学报, 2010,38(7):1489-1494.
	FU Yu, WU Xiaoping, YE Qing, et al. An Approach for Information Systems Security Risk Assessment on Fuzzy Set and Entropy-weight[J]. Acta Electronica Sinica, 2010,38(7):1489-1494.
[17]	王笑, 戚湧, 李千目. 基于时变加权马尔科夫链的网络异常检测模型[J]. 计算机科学, 2017,44(9):136-141, 161.
	WANG Xiao, QI Yong, LI Qianmu. Network Anomaly Detection Model Based on Time-varying Weighted Markov Chain[J]. Computer Science, 2017,44(9):136-141, 161.

优先级	低	一般	高
1	0.500	0.333	0.167
2	0.250	0.500	0.250
3	0.167	0.333	0.500

预测精度等级	c	P
1级	<0.35	>0.95
2级	<0.50	>0.80
3级	<0.65	>0.70
4级	≥0.70	≥0.65

预测模型	Markov	ICNN	GVK	文中模型
历史数据维度	29	3	5	3
态势量化序列标准差	206.258	246.335	35.179	254.367

误差检验指标	预测模型	预测序列长度
误差检验指标	预测模型	20	40	60	80
后验差检验c	Markov	1.011	1.010	1.074	1.006
	ICNN	0.932	0.882	0.904	0.857
	GVK	0.948	0.927	0.917	0.923
	文中模型	0.596	0.501	0.468	0.133
小概率检验P	Markov	0.450	0.500	0.450	0.475
	ICNN	0.550	0.525	0.533	0.513
	GVK	0.400	0.375	0.450	0.438
	文中模型	0.850	0.825	0.867	0.900

Network security situation adaptive prediction model

RichHTML

PDF (PC)

Like

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 10

References 17

Related Articles 1

Metrics

Comments

Recommended 10