| With the continuous development of information technology,the Internet not only brings convenience to people’s life,but also goes deep into all aspects of people’s life.The scale of the network is increasingly large,the topology is increasingly complex,and the dimension is constantly expanding.In the trend of large-scale network,network security is also facing greater challenges.Network security situation awareness is a rapidly developing network security technology in recent years.Different from traditional technology,network security situation awareness technology is based on the whole network.Therefore,network security situation awareness technology can be used as an important means to deal with large-scale network security governance,evaluate network security situation,predict future attack trend and formulate feasible strategies.At present,most researches on network security situation awareness take the overall network as the research object.However,the vulnerabilities and security features of different domains are different.If research is conducted from the perspective of the overall network,massive information will cover up differences in domain security features,making it difficult to observe the state.Therefore,this thesis divides the whole large-scale network into several dimensions according to the same business domain and similar security features,forms an observation surface of different dimensions,and then establishes the awareness of network security status in the observation surface.Through the analysis of different observation surface perspectives,the multi-dimensional large-scale network security situation awareness can be realized.The important basis of traditional network security situation awareness is network traffic.However,the massive traffic information not only easily causes the security features to be submerged in the observation surface,but also poses a huge challenge to the information analysis and processing of security nodes.As the main cause of attacks,vulnerability information has a sharply reduced data volume compared with traffic data,and it also has the feasibility of network situational awareness.Therefore,this thesis chooses vulnerability information as the data source for research.In view of the above problems,this thesis studies large-scale network situation awareness from the following three points:(1)In order to realize multi-dimensional large-scale network security situation awareness,this thesis divides the whole network into dimensions according to the same business domain and similar security features to form observation surfaces of different dimensions.This thesis takes the network security situation awareness in a single observation surface as an example to extract the security features of the observation surface and realize the dynamic update of the features.The single observation surface security feature is constructed by random forest algorithm based on vulnerability information as data source under the guidance of security report.Observation surface features are dynamically updated according to threat intelligence and security warning information.(2)In order to reasonably quantify the impact of threats on the observation surface network and evaluate the security situation of the observation surface network,this thesis uses vulnerability severity level and CVSS vulnerability scoring system to conduct quantitative analysis of security threats on the observation surface according to the security features of the observation surface,and comprehensively evaluates the current network security situation of the observation surface by combining the severity and impact of vulnerability features.Realize network security situation awareness on a specific observation surface.(3)In order to predict the probability of various attack behaviors on the observation surface,this thesis predicts the probability of various attack behaviors on the observation surface network through game theory,replaces the income function of game theory with benefit function,and adds the cost calculation of attack and defense to find the optimal strategy of attack and defense and calculate the probability of attack occurrence.In order to further improve the accuracy of overall situation prediction,this thesis constructs new parameters through XGboost model and completes the future network security situation prediction by combining the improved LSTM model through the result verification and correction process. |
