Research On Key Technologies Of Network Situation Assessment Feature Selection And Situation Prediction Hyperparameter Optimization

Network security situational awareness is an ability to dynamically observe network security risks.It gathers the advantages of various network security technologies,comprehensively integrates the situation elements in cyberspace,analyzes and evaluates the health of network operation from a macro perspective,and makes regression prediction on the situation value of security problems in the future before the attack,so as to help network managers carry out emergency maintenance of security events.Aiming at the problem of redundancy and imbalance of network situation feature data,this thesis adopts feature selection to reduce data dimensions,and then uses classification method to establish situation assessment model.Aiming at the difficulty of super parameter combination optimization of situation prediction model,this thesis uses adaptive particle swarm optimization algorithm to optimize LSTM prediction model.The specific research contents are as follows:In the aspect of situation assessment,in order to accurately measure which features contribute the most to the assessment and classification,we first use the K-means clustering algorithm to balance the data set,and then use the recursive elimination cross validation method combined with the logistic regression basis model to select the feature subset with the best number of features.The recursive feature elimination cross validation method selects 27 best features,and then inputs the generated feature subset into the CART model for two classification and multi classification evaluation.Compared with LR,SVM and RF models,CART has achieved an advantage of at least 1 percentage point in terms of recall rate and false positive rate.In multi classification evaluation,aiming at the problem that CART is easy to over fit,the suitable depth of tree is determined by comparing the inflection point changes of accuracy scores of training set and test set.In the evaluation of 10 types of attacks,compared with previous work,the recall index of 7types of attacks has gained advantage.In the aspect of situation prediction,firstly,the Stacked Sparse Auto Encoder is used to reduce the data dimension improved after single hot coding.By setting the sparse coefficient,a certain proportion of neurons are randomly selected to participate in training to improve the generalization ability of the model,and then the output data generation time series is used for LSTM network prediction.In view of the difficulty of optimizing the combination of super parameters of LSTM,an adaptive particle swarm optimization(APSO)algorithm is introduced to optimize the seven super parameters of LSTM.Firstly,two cec2017 benchmark functions are used to test the optimization of APSO algorithm to verify its convergence effect,and then it is used for LSTM hyperparametric optimization.Finally,the super parameter optimization results show that compared with the single LSTM model,both can better show the trend of situation change,but APSO-LSTM has taken the lead in three evaluation indexes.From the situation trend prediction chart,APSO-LSTM model has better fitting effect at the inflection point,lower overall error and higher accuracy.