Network Security Situational Awareness Visualization

In the sphere of network security, the new theory, named as Network Situation Awareness (NSA), is introduced to the administrator. Due to the focus of it is the whole status of the large-scale network, rather than the details of the technical issues, NSA is regarded as an effective tool, which is adept at freeing the administrator from the burdensome work on the information-collectting. With the support of NSA, it becomes realizable for the administrator to spend more time on the analysis and research of the whole network, and to make a proper decision as soon as possible.After the introduction of information visualization, the awareness on the network situation is become more effective and exacter. In this thesis, the wights of indexes and the result of network situation are analyzed through another way, the visualization technology. The algorithms of awareness and prediction are assessed, in order to ensure the veracity of the result, and the related parameters will be adjusted if necessary. After that, Geographic Information System (GIS) is introduced for the layout of the electronic map, with the information of index and situation.The main issues included in this thesis are listed as following:(1) The related work of NSA and Visualization technology is surveyed; the current methods of the visualization are analyzed.(2) 4 index systems are introduced, which interact on each other and relate to the whole network; the relationship among all of the indexes and the value of the network security situation is researched, during the process of founding the index system. Therefore, based on the circle coordinates, the weights of the indexes and the performance of the situation awareness are optimized.(3) The result of the situation prediction is researched based on cluster analysis. With the assistance of awareness result and expertise, the prediction result is validated and optimized accordingly.(4) A visualization system on network situation awareness is designed and implemented, which optimize the algorithm of awareness and prediction, with the advantage of the scatter diagram, and express the result visually, by the styles of electronic map, histogram, broken line graph and so on.