| In recent years,the Internet and big data technologies have complemented each other,and the number of users and the amount of data contained in them have grown rapidly,greatly enriching human life.Together with the progress of techniques,network security incidents causing significant losses often occur,and modern network attacks are more diversified and more covert,people enjoy the Internet and big data to bring convenience at the same time,dealing with network security risks has become a major problem.Network security situation awareness can analyze various elements that interference with network security,comprehensively assessment the current network situation,and then predict the trend of network situation changes in the subsequent period based on the current and previous situations,which is important for the future protection of cyberspace security.The core of the research in this thesis focuses on the implementation of two components of network security situation assessment and prediction,and major study works are as follows.(1)Proposed network security situation assessment method based on serial parallel CBAMCNN-LSTM(Convolutional Block Attention Module Convolutional Neural Network-Long Short Term Memory)fusion model.This part is divided into two aspects.On the one hand,the construction of reasonable situation index system supporting the implementation of network security situation assessment,and this thesis constructs a situation indicator system based on the impact of attacks,the indicator system contains the meaning of situation factors and the calculation of the situation value,and divides the situation level according to the rules in the thesis to provide support for relevant network managers to intuitively understand the current situation and make security decisions.On the other hand,to build serial parallel CBAMCNN-LSTM fusion model.In the use of fusion models,often only one of serial and parallel fusion is introduced,this thesis introduces the implementation of both model serial parallel two fusion methods,the fusion of the models selected CBAMCNN and LSTM,the convolution operation of CNN enables it to extract local features,CBAM enables CNN to focus on important features in terms of channels and space,and the gating mechanism of LSTM has a great advantage in extracting time series features.The fusion of CBAMCNN and LSTM can better utilize the respective advantages of the two models,and the training process uses an adaptive learning rate approach to enhance the learning ability of the model.In this thesis,we construct both Serial CBAMCNN-LSTM(CBAMCNN-LSTM-S)and Parallel CBAMCNN-LSTM(CBAMCNN-LSTM-P)two fusion model based network security situation assessment methods,and introduce in detail the implementation of the serial parallel fusion model and its advantages over previous methods.(2)Proposed a network security situation prediction method based on IPSO-ABiLSTM(Improved Particle Swarm Optimizing Attention Bidirectional Long Short-Term Memory)fusion model.The first work is to introduce the sliding time window approach to reconstruct the situation data to obtain the situation prediction dataset.The second work is to construct the model,the correlation of network security situation data before and after the existence of BiLSTM,the advantage of BiLSTM is just able to two-way mining the relationship between the front and back of the time-series data,Attention mechanism can also enhance the degree of attention to important features,so this thesis will BiLSTM fusion Attention mechanism,the fusion of ABiLSTM model can play the advantages of the two models to reduce the error value of the situation prediction data.The third work is the optimization of ABiLSTM hyperparameters,for the problem that the hyperparameter selection has a large impact on the model performance,choose PSO algorithm for searching optimal parameters,firstly,the PSO algorithm is improved to balance the merit-seeking ability,and then the IPSO algorithm is used to find the optimal ABiLSTM hyperparameters to get the final IPSO-ABiLSTM fusion model.In addition,the parameters involved in the optimization process of IPSO algorithm and the advantages of IPSO-ABiLSTM fusion model over previous prediction methods are introduced in detail.(3)The experiments in this thesis were conducted on the UNSW-NB15 dataset.Situation assessment: We first conducted comparison experiments with different CBAM positions to determine the CBAM positions,and then the binary classification experiments and tenth class experiments are conducted,and the time overhead of this thesis model is also analyzed,and the experiments proved that the performance of the serial parallel CBAMCNN-LSTM model was improved compared with other single models,and the model classification results were quantified according to the network security situation index system to obtain the situation values and determine the situation level,and the comprehensive analysis of which concluded that the accuracy of the model assessment could reach 85.19%and 92.59%.Situation prediction: Firstly,the effect of IPSO algorithm and PSO algorithm is compared,and it is proved that IPSO algorithm in this thesis is more effective.Then,the prediction comparison experiments are conducted in different sizes of sliding windows,and the results show that IPSO-ABiLSTM fusion model is better than several other models,which is the best prediction effect at the window size of 2,and the highest fitting degree can reach0.9922.Combining with the experimental results,it can be proved that the fusion model has great advantages in the situation assessment and prediction. |
