Research On Network Security Situation Assessment And Prediction

While the Internet provides convenience for people, it also brings a lot of potential security risks. It's difficult to guarantee the security of information property effectively with single defensive measures. The increasingly diverse means of network attacks promote the continuous innovation of network security technology. In such a severe environment, Situational Awareness(SA), as a kind of technology project with a complete security system, has been widely used in the field of network security. From the viewpoint of network security situational awareness(NSSA), this thesis aims at the large-scale complex network. The process of situation assessment and situation prediction is explored item response theory(IRT) and the niche technology of fuzzy elimination mechanism. The thesis mainly contains the following contents:1. As the networks become larger and larger, it's difficult to get the real security status of network in time. Hence, one novel situation assessment method for network security based on IRT is proposed in this thesis. Firstly, it's calculated the threat of attack and the probability of success attack by the Logistic model of IRT and Common vulnerability scoring system. Secondly, then use the three-scale analytic hierarchy process method to calculate the influence weights of network service's metrics factors. Finally, we get the analysis diagram of service, hosts and network among them with the improved method. The simulation results show that: This method can be more persuasive considering factors that affect network security in some extent and get a more realistic network threat situation diagram in real-time.2. In order to further improve the prediction accuracy of network security awareness, aiming at the suddenness and uncertainty in network security incidents, a prediction model based on the wavelet neural network(WNN) and improved niche genetic algorithm(INGA) is proposed in this thesis. The model is established by WNN with strong nonlinear ability and fault tolerance performance. It also adopts the adaptive genetic algorithm to optimize the parameters of WNN. Considering the slow convergence speed adaptive genetic algorithm into the premature problem, a novel niche technology of dynamic fuzzy clustering and elimination mechanism is introduced. It is improved on the overall performance. The experimental results demonstrate the reliability and effectiveness of the proposed model. In addition, INGA-WNN prediction model is better than GA-WNN, GA-BPNN(Back Propagation Neural Network) and WNN in convergence speed and prediction accuracy.