Network security situation awareness model based on heterogeneous multi-sensor data fusion
Xiaowu Liu, Huiqiang Wang, Jibao Lai, Ying Liang · 2007
Network security situation awareness (NSSA) is an emerging technique in the Held of network security and it helps security analysts to be aware of the actual security situation of their networks. In this paper we presented a novel NSSA model based on multi-sensor data fusion and multi-class support vector machines. In our model, we adopted Snort and NetFlow as two sensors to gather data from network traffic. We employed multi-class support vector machines as fusion engine of our model in combination with an efficient feature reduction approach to fuse the gathered data from heterogeneous sensors. Furthermore, we discussed the alert aggregation algorithm and the security situation awareness generation techniques detailedly. Our model is proved to be feasible and effective through a series of experiments.