Research On Factors Extraction,Evaluation And Prediction In Network Security Situational Awareness

Network security situational awareness system (NSSAS) is a new technology to monitor network security, and it is one of the hot research domains in information security. A new perspective to observe the network security status is demanded in NSSA, it emphasizes timely detection of potential or arisen anomalies in network system, and also can forecast network security status in some time later. The main idea of NSSA is to make full use of one or several kinds of mathematical methods to fuse the multi-source heterogeneous data in the network system, and then easily understandable network security situation will be generated from a cognitive perspective.Firstly, NSSA in network security are researched comprehensively in this thesis, including the concept description, research state, and developing direction of NSSA, and then the model of NSSA is formed primarily. The model includes three models: data fusion model, realization model of network security situation, predict model.Secondly, the thesis presents a distributed data fusion model, it uses three classifiers to label network data, and fuses the results to get the network security situational factors depending on the rate of every classifiers differentiation. and experiment is done to check the validity of the method.Thirdly, layered realization model of network security situation is constructed, this model makes use of statistical method for the quantitative calculation of security situation index of service level, host level and network level in networked system. Then we can get the different level security situation.Finally, the thesis presents a method based on GA-BPNN (Genetic Algorithm-Back Propagation Neural Network) to predict the network security situation. The model makes use of GA to modify the power value of network to construct anagenesis model, then we can use the model to predict the network security situation. Experiment results show that this method can achieve perfect prediction, helping administrator to understand the current situation.