Situation Estimation Algorithm And Application Based On Biological Immunity And Graph Model

A series of advances have been made in the related research on situational assessment of environmental threat situation.Situation estimation belongs to a high-level data fusion technology,which uses many sensor data to reason and fuse to obtain an estimate of the current environmental threat status.Based on this estimate,the decision maker can make a corresponding solution.This paper mainly applies the situation estimation algorithm to the cyberspace security situation estimation,and explores its feasibility and effectiveness for data fusion processing.In this paper,the situation estimation framework based on biological immunity and graph model adopts the idea of bottom-up and layer-by-layer fusion reasoning.The work of this paper mainly includes three aspects:1)This paper proposes a general framework for the estimation of the underlying situation.The framework uses the combination of biological immune algorithm and Gradient Boosting Decision Tree algorithm(GBDT).The biological immune algorithm constructs the antibody and antigen gene pool.The GBDT algorithm encodes each gene in the gene pool.The similarity between unknown network behavior and gene bank is detected in real time,and the similarity is taken as the result of situation assessment.Compared with the traditional situation estimation algorithm,the framework has three main advantages.First,the causal relationship is interpretable.GBDT uses leaf node position coding to have better interpretability than binary coding.Second,mining the implicit relationship between features.The coding method based on GBDT learns the classification judgment rules between features according to the best split point of data.Compared with Bayesian network,it can mine the implicit relationship between features without expert knowledge.Third,the framework has the advantages of high flexibility and low time complexity.The similarity detection of biological immune algorithm,similar to the template matching form,can artificially add genes(normal or abnormal behavior),without the complicated re-training of Bayesian network and deep learning,and can improve the prediction speed by parallel computing..2)For the high-level situation estimation,the traditional method is mainly based on the weighted summation method.This way does not pay attention to the correlation between individuals in space and the influence and communication of security situation in space.This paper introduces the relevant theory of graph model,and unifies the individual of space,and uses the knowledge uncertainty inference of D_S evidence theory to obtain the correlation of spatial individuals and highlight the key influences brought by key nodes.The experimental comparison shows that the method is as objective and effective as the AHP algorithm,but the algorithm of this paper is free from the limitation of expert knowledge and can solve the large-scale situation estimation problem.3)Current research on situational estimation ignores the impact of correlations between data features.Redundant information exists in high correlation features,resulting in a decrease in accuracy and generalization capabilities.Aiming at this practical application problem,this paper proposes a flow feature selection method based on bagging learning.The dimension reduction of high-dimensional features improves the accuracy of prediction and enhances the generalization ability of the framework.The experimental results show that the feature selection method of this paper is better than other methods.In summary,this paper proposes a framework based on biological immunity and graph model for some practical problems in situation estimation,including a feature selection method,a gene library coding method,and a high-level situation fusion method.The main purpose is to reduce the dimension of high-dimensional features,mine implicit relationships between features,and objectively express high-level situational threat values.