Evaluation Method Research Of Network Security Situation Awareness Based On Immune Concentration

In the information era,the information life is deeply rooted in people's minds.Information security issues are emerge in endlessly.It is a frequent and permanent topic to find and solve the problem of information security.Network security situation awareness is one of the methods to find network security problem.And network security situation evaluation as the focus of situational awareness,the variability of network security problem also requires that the evaluation method should keep pace with the times.It can dynamic discovery of network security incidents and evaluate security situation.The biological immune system has the characteristics of self adaptation,self learning habit and real time.Antibodies in living organisms are able to identify and distinguish whether foreign substances are harmful to living organisms.When the harmful antigen was identified,the antibody concentration increased immediately.The level of immune concentration reflects the degree of invasion of the organism,and the antibody can identify the known and unknown viruses in the process of evolving.Therefore,in this paper,the theory of biological immune system is applied in the network security situation evaluation.The network security situation evaluation method based on immune concentration is studied.The immune concentration directly reflects the security situation of the network.The normal network behavior is defined as self and the illegal network behavior is defined as antibody.The evaluation method can evaluate the impact of known and unknown illegal network behavior on the network in real time dynamically by constructing antibody evolution model.The main work of this paper is:First,this paper introduces the application of imunology in the field of computer security and network security situation evaluation at home and abroad.Then current network security situation evaluation is analyzed.And this paper considers that immunology theory is applied to the network security situation evaluation is feasible and can reflect the real-time and network security situation dynamically.Secondly,according to the two-level indicator system of security situation and the theory of biological immunology,this paper puts forward the security situation evaluation model of immune concentration in three layer network.In the model,the quantitative calculation method of network security situation is given.The antibody evolution model and the calculation method of immune concentration are analyzed in detail.The level of immune concentration is given.Finally,according to the network security situation of immune concentration model,the detailed design of evaluation scheme is given.Then the network environment and evaluation system are established.The network testing environment and evaluation system are established,and the process from data acquisition and evaluation calculation to the presentation of situation is implemented.The experimental results show that the network security situation assessment method based on immune concentration can be used to evaluate the known and unknown illegal network behavior in real time dynamically.