Network Security Situation Evaluation Model Based On Ensemble Learning

Internet has become an important infrastructure to support the society, and the network security situation (NSS) is more serious. Current network security devices, whether functionally or technically are difficult to meet the securiy needs. We need a new technology to comprehensive analysis and display network security.NSS has been used to describe the different runtime security status. In this paper, network security situation evaluation (NSSE) has been in-depth study. On one hand, NSSE includes real-time target network’s security situation analysis, which is network security situational awareness (NSSA); on another hand, includes the future security situation analysis of the target network, which is called network security situation forecast (NSSF), however the two parts of researchs are still in the independent stage, with no deep understanding of its mathematical mechanism.The integrated network security situation evaluation model (NSSE model), which is based on ensemble learning boosting algorithm, achieves a full evaluation for current and future NSS, after we begins with in-depth analysis of the nature of the similarities and differences between NSSA and NSSF. The main contents are as follow:1. Abstract both NSSA and NSSF mathematics essence by analysising the physical process of them. NSSA and NSSF have been unified solution as function fitting.2. Use analytic hierarchy process (AHP) to build NSSE index system. The NSSA results are as the index system input, the network security situation values (NSSV) are as the output, which are as NSSF input, in order to unify the physical workflow between NSSA and NSSF.3. Boosting algorithm has been designed NSSE model for function fitting, and achieved the integration of the NSSA and NSSF.4. KDD Cup99and Honey Net have been to verify the effectiveness of NSSE model, focused on assessing the false negative rate and false alarm rate, and get better experimental results.