Research And Implementation Of Network Security Situation Awareness System Based On GA-RBF Neural Network

With the rapid development of computer technology and communication technology,the network attack and defense technology has been constantly updated,and the network threat has been aggravated,and the security of information system has been seriously challenged.Under the new normal Internet environment,there is a serious imbalance between the means of network defense and the means of attack,and the research of intelligent security defense system has become a hot topic.The development of data fusion technology makes the network security evaluation to the comprehensive development,but the technology is limited to reflect the past and current network status,now it is difficult to adapt to the complex network environment,the development tendency of network security from passive defense to active defense,the characteristics of intelligence,visualization,global network security is especially,the research and application of machine learning,data mining method and technology has accelerated the development of network defense technology,especially the development of front-end visualization technology provides good technical support for the dynamic display of network security situation awareness system.In this paper,through the research of information system security incidents in the regional network,combined with the log information acquisition hardware in the network analysis method,the use of intelligent situation makes the network management through the visual display to judge the current situation of network security,perceived future network security situation and make timely adjustments to protect network assets,improve the ability to prevent information network attack system.The research and implementation of network security situation awareness system based on GA-RBF neural network:1.Network security situation assessment methods and key technologies.The evaluation method to analyze and compare the different situation,with reference to the existing network security situation index processing results,including a variety of network security factors in regional network(hardware assets,equipment status,security alerts,event logs,etc.)for cleaning,collection and dimensions,using fuzzy AHP method to divide the current range of network security situation value,so as to establish a comprehensive system of network security situation index.The risk analysis of information system in regional network topological structure and organization structure and reference of domestic and foreign scholars have been the evaluation results,using the technology of constructing evaluation index system should follow from the point to the surface and inside of the evaluation data fusion strategy.Through the analysis of situation understanding technology,firewall,server hardware facilities such as logging and scanning results after processing and consistency of test weight information for association analysis,the establishment of threat propagation network data set.2.The construction of prediction model based on GA-RBF neural network.This paper compares several prediction methods of common situation,determine the prediction method of RBF neural network based on the situation,combined with the experimental environment and data already constructed for network security situation of regional network information system security model.The model using genetic algorithm to find the combination of control factors and parameters set set suitable from the process simulation of racial evolution in the collection of natural selection,crossover and mutation,can well overcome the problem of slow feedback through the definition of the relation,nonlinear time and data sets to construct the prediction model is applied to the system.3.Design and implementation of security situation awareness system.According to the model and prediction model of network security situation assessment has been combined,starting from the traditional system design,requirement analysis and function of network security situation awareness system,build the overall framework of the network security situation of regional network information system security awareness system based on.Based on the overall design of the sensing system,determine the trend of acquisition layer,analysis layer,situation understanding situation prediction layer,situation awareness layer,situation display function and interactive process layer subsystems,the characteristics of each subsystem is analyzed based on the realization method of the supporting platform and architecture design,through the analysis of the data flow between the various modules.For each subsystem and proposes solutions to the specific implementation.