Research On Network Security Situational Awareness Based On Multi-source Heterogeneous Data

With the increasing complexity of the network environment,the increasing scale of the Internet,and the emergence of various network attack incidents one after another,the traditional security system cannot meet people’s security requirements,and the construction of new network security platforms also urgently needs the support of new technologies.The research on the theory of network security situation awareness subverts the traditional network security view,broadens the vision of human beings in a timely manner,guides people to consider the problem of network security from the perspective of the whole network structure,and can make targeted solutions for upcoming network security attacks.The traditional hierarchical network security situation is divided into three parts:situation awareness,situation estimation,and situation prediction,and situation awareness plays an important role as one of them.The basis of situation awareness is data fusion,that is,fusing data from different network security platforms to perceive the current operation status of the network.From the perspective of data fusion,this paper designs a network security situation awareness model based on multi-source data,which is divided into four levels,namely data acquisition layer,data preprocessing layer,feature extraction layer,classification decision-making layer,and introduces the technologies used in each layer in detail,and fuses and processes multi-source data information layer by layer to obtain network security situation awareness information.In order to solve the problem of the existence of massive log data,a log filtering system facing multi-source heterogeneous data is added to the data collection layer,and the system can unify the log data structure after log collection,form data with the same structure,and then filter events.At the same time,by judging the similarity of the message types of the log data,the exception collection and similar set are identified,the two log data are saved,and other data is deleted to reduce the impact of redundant data on the results.Aiming at the problem that the classification accuracy rate in the model is not high,two improvements are made to the data fusion classification decision algorithm at the classification decision level: one is to solve the problems of gradient explosion and gradient disappearance by changing the activation function of the deep neural network for the deep neural network algorithm.Second,in order to overcome the limitations of single deep neural network classification,the sparrow search algorithm is integrated into the deep neural network,so that the algorithm can automatically seek optimization and avoid falling into local optimization and other problems.Through simulation results,the proposed model can effectively remove redundant interference data in the data collection layer when facing multi-source heterogeneous data.Compared with other traditional classification algorithms,the SSA-DNN classification algorithm proposed at the classification decision-making level has improved its accuracy,which verifies the superiority of the classification algorithm in this paper.