RF-SVM Based Awareness Algorithm in Intelligent Network Security Situation Awareness System
Gang Chen, Yuqian Zhao · 2017
With the increasing outstanding of network security situation, the intelligent network security situation awareness system has been an important weapon in cyberspace battle field, its research and development are also being a matter of great urgency.How to improve accurate rate of situation awareness has been a primary key problem which must be dealt with by intelligent network security situation awareness system.A network security situation awareness algorithm based on regression forecast support vector machine (RF-SVM) was put forward.With adopting regression idea of regression, this algorithm can forecast potential threat in future network data flow referring to historical network attack data thoroughly in process of network awareness.Experiment indicates it can improve accurate rate of situation awareness effectively and reduce forecasting error. IntroductionWith network going deep into social life, malicious activities aiming at network are growing and attacks such as Dos/DDos are becoming a growing threat.The traditional network security management is usually dependent on discrete deploying network security devices involving firewall, anti-virus and intrusion detection.So many problems including single function, larger warning information and too much irrelevant warning information will appear.Network security manager is hard to control being confronted with security situation of total network due to facing too much warning information.It would lead effective responses can't be taken in time.So research and development of intelligent network security situation awareness system are becoming a matter of great urgency.Network security situation awareness has been a hot field developing in recent years and how to improve accurate rate of situation awareness has been a primary solving problem.It can provide the foundation for network security managers with decision by analysing current network security situation and forecasting attack behaviour which will happen in next step.It is of great importance to improving monitoring capability of network, emergency response capability and forecasting development tendency of network security.Recently, many network security situation awareness algorithms have been presented by researchers such as log audit and performance correction algorithm, basing on D-S evidence theory, basing on hybrid system model, basing on artificial neural network, multi-dimension data streams mining algorithm, Markov game model, and so on.These algorithms have been proven in process of network security situation awareness and achieved good result.Meanwhile, many network security situation forecast models have been built such as quantitative hierarchical threat evaluation model, information fusion model, complex network model, and so on.Considering successful application in forecast and comprehensive evaluation, support vector machine was adopted to network security situation awareness.The low accurate rate will be got due to forecast network security situation only by current data.To resolve this problem, regression forecast is introduced to improve accurate rate of network security situation awareness.It can forecast potential threat in future network data flow referring to historical network attack data thoroughly in process of network awareness.Experiment indicates it can improve accurate rate of situation awareness effectively and reduce forecasting error.