Implementation Research On Security Situation Sensor Of Specific Service

Recently, network security situational awareness (NSSA) is becoming an emerging topic in network security domain, which generally reflects the status of network security. The choice of data sources is directly related to the accuracy of network security situation analysis. As an important data source reflecting the network security situation, the service data source affects the implementation of NSSA significantly. According to the needs of network security situational awareness systems, it is necessary to design and implement a kind of security situational sensor, which can monitor and collect the security status datas of services, detect the deviation and failure imformation, and also provide the unified access interfaces to higher layers, the research emphases of this paper is that.Firstly, this paper introduces the related concepts and key technologies of the service sensor. The related concepts introduce the definition of the service sensor, the definition of services and feature analysis. According to the indicators demand of service, the description and classification of service data sources are provided. Finally, the key techniques of the service sensor are introduced.Secondly, it proposed the design scheme of the service sensor. The scheme analyzeds the deloyment location . the system architecture and the sub modules of the sensor in detailed, including functions of each module, and recommends of sub modules.Thirdly, a network security situational evaluation model based on simple additive weight and rough set theory is presented.The architecture of the model is divided into two stages: situation conceptual modeling and situation evaluation modeling, the model associatly analyses the venture and the performance indicators, and established assessment formula which is mostly oriented of the DNS security situation evaluation. Test results show that modeling is feasible.Finally, the implementation method of service sensor system is studied.It includes the detection of a statistical model and the detection of the state transition .It completes the collection process and the analyse process through collecting and analysis the security status data of DNS. An attack test is carried out and the result is analyzed.