Research On Network Security Situation Assessment Technology Based On Time Dimension Hierarchy

Network security situation assessment technology is very critical to improve the network monitoring,scheduling,and the guiding significance to predict the tendency of the network,it requires multifaceted information from a macro level to determine the security status of the network system,monitoring of potential or existing anomalies in large-scale networks to get the situation description that is in line with the actual situation.The core technology of network situation assessment is to integrate multi-source heterogeneous data generated by network system by data mining or machine learning algorithm,and quantify it into a security situation,responding to the risk of the network system in time so as to reduce unnecessary losses.However,the existing network security situation assessment technology has certain difference with the actual situation,and usually only gives the overall situation,it is a relatively short time representation and general method,unfavorable to network management in time to troubleshoot network anomalies and strategy scheduling.Aiming at these problems,on the basis of related research relative papers,this paper put forward a network security situation assessment model based on time dimension hierarchical,the research results of key module has the following several aspects:(1)According to the non-equilibrium of network abnormal data and the characteristics of new abnormal types,this paper puts forward an unbalance abnormal data classification algorithm of active learning as an anomaly detection module.The algorithm has two aspects: sampling method and strategy of algorithm was improved,active learning of the sampling method to improve the recognition rate of the new style of samples,reduce the sample distribution imbalance caused by the impact of the classification error of the minority class.(2)In order to quantify the network security situation more accurately,a hierarchical network situation assessment method based on improved TBM model is proposed.First of all,the network index is divided into three levels as input;then,the trained PSO-neural network is used to deal with the input data and output the situation value,and the TBM model is used to fuse the situation value of the output;finally,through simulation experiments verify the effectiveness and reliability of the algorithm.(3)This paper uses the particle size on the time dimension with the internal and external threat organically integrated,evaluation index based on the dynamic and static factors are divided into separate short-long cycle.The short period focuses on the real-time dynamic change;the long period evaluation is based on the short period evaluation,which indicates the trend in the long period,and the integrity of the evaluation is increased.The rationality and validity of the method are verified by simulation experiment.