Research On Situation Visualization Technology For Network Security Awareness

As computer networks and communication technologies continue to improve and innovate,network security is also facing more and more opportunities and challenges.In the face of a new generation of network security situation,the traditional security system can no longer meet the needs of security protection.As an emerging technology,network security situation awareness is expected to break through the situation of traditional network security protection and situation of passive defense in the past,making the whole system more active in the acquisition of situational factors,assessment of situation and forecasting.Traditional cybersecurity situation awareness has many shortcomings,such as a single expression of perceived results and insufficient awareness level.In order to better facilitate users to explore the development trend of network security,the combination of network security situation awareness and visualization technology,that is,network situation visualization technology has become an urgent problem to be solved.Based on this,in addition to vividly presenting the results of situation awareness,it can also exert the powerful processing capabilities of human beings in graphics and images,and more easily locate and grasp the problems of network security,and ultimately effectively improve the processing power of the system and enhance the system and management ability.However,today's network situation visualization technology is not yet mature,still in a developing state and cannot avoid the defects of less display dimensions and weaker interaction.In the end,it cannot fully understand the potential risks and threats of network security.Starting from the above practical problems,this thesis studies the data organization method,situational awareness method and visualization technology for network security awareness,and the research results of this thesis are applied to the air traffic control network.Finally,a situational visualization system oriented to network security awareness is designed and constructed.The main works of this thesis is as follows:(1)Network security data organization method based on knowledge graph is studied.By analyzing different security situation-aware data organization schemes and referring to the mainstream network security situation data processing methods,an effective data preprocessing and handling scheme is given for the collected network security raw data,taking full account of its massive,multi-source and heterogeneous characteristics.In addition,this thesis proposes a network security data organization method based on knowledge graph,which aims to realize the efficient and intelligent organization of network security data through knowledge graph,and promote the transformation of data advantage into decision-making and action advantages through knowledge advantage.(2)The network security situation analysis and visualization methods are studied.Based on the principle of extraction of conventional network security situation elements,this thesis further explores the relationship among data.Aiming at the increasingly complex network structure,this thesis analyzes the factors affecting situation awareness and proposes a network security situation awareness evaluation model based on Bayesian attack graph technology.On this basis,the situational scores are evaluated,then as well as situation.The visualization technology is used to display the results of situation awareness from point to face,from shallow to deep,and combined with the needs of user interaction from multi-angle,multi-dimensional and multi-scale.(3)Design and implement a situation visualization system for network security awareness.Based on the above research results,according to the data characteristics and scene requirements of the air traffic control system,the data organization method and visualization technology for network security awareness are combined with the air traffic control system to carry out the application of the landing application and the reverse verification scheme,so that the complex network security situations in the air traffic control system can be presented in a more compact,more concise and clearer way.