Research On Network Security Situation Awareness Based On Machine Learning

The more important parts of network security situational awareness are situational assessment and situational prediction,where situational assessment is the core of situational awareness and situational prediction is the goal of situational awareness,both of which are indispensable for network security situational awareness.For the current shortcomings of strong subjectivity and large prediction error of the situational assessment value,the gradient boosting-based network security situational assessment model and the recurrent neural network-based network security situational prediction model are proposed respectively.In the part of situation evaluation,firstly,the three algorithms of deep neural network algorithm(DNN),support vector machine algorithm(SVM)and extreme gradient boosting algorithm(XGBoost)were compared for their ability to evaluate the situation on the same dataset,and from the analysis of the evaluation results,it was concluded that XGBoost was the best for situation evaluation,so XGBoost was chosen to be improved and optimised.The parameters in XGBoost were optimised using the Differential Evolutionary Algorithm(DE)to achieve global optimality.The mean square error MSE of the DE-optimised XGBoost situational assessment model decreased from 0.004 to 0.002,the coefficient of determination R2 increased from 0.899 to 0.923,and the accuracy rate increased from 0.94 The experiments demonstrate that the DE-XGBoost network security situational assessment model has higher accuracy and lower error.In the situation prediction section,the evaluated situation value data is processed into a new data set by a sliding window approach,divided into a training set and a test set for the prediction model.Build a three-layer Gated Recurrent Unit Neural Network(GRU)network structure,and add a Dropout layer between each two layers to avoid overfitting caused by too many neurons in the model.Adaptive moment estimation(Adam)optimizer is selected to perform the optimization of the neural network and particle swarm algorithm(PSO)is used to select the best Dropout’s loss rate and Adam optimizer’s learning rate.The root mean square error RMSE was chosen as the model’s loss function to judge the model,and finally the RMSE of the predictions was experimentally demonstrated to have decreased from 0.09 to 0.07,and the accuracy of the prediction of the posture level rose from 0.915 to 0.935,an improvement of 2%.Therefore,the PSO-GRU-based network security posture prediction model proposed in this topic outperforms other prediction models.