Network Security Situation Awareness Framework and Random Forest Assessment Model

Zhen-kun QIAN

doi:10.13718/j.cnki.xsxb.2019.11.018

In view of the fact that traditional network security situational awareness assessment relies too much on expert experience, this paper proposes a multi-layer cyber security situational awareness (CSSA) framework and a network security situation assessment model based on random forest. In this method, the CSSA process has first been aligned with the security data lifecycle, the CSSA requirements analyzed, a CSSA multi-level analysis framework proposed, and then the random forest algorithm used to build the CSSA assessment model. This model is based on multiple classifiers. The idea of composition consists of a decision tree, each tree relies on independent samples, and the random vectors of all trees in the forest distribute the same value. When classifying, every tree voted and returned the class with the most votes, which made the network security situation assessment more objective and accurate. Experiments show that compared with Bayesian networks, this model can assess the current network security situation more quickly and accurately.

HTML

随着互联网技术的迅速发展，网络设备成为社会基础设施，给整个社会带来了方便，但随之增多的是网络攻击和破坏行为^[1-3]，造成了较为恶劣的影响，因此对于网络安全态势感知的研究越来越受到关注^[4-5].

网络安全态势是指受监控网络的全球安全状况，网络攻击在一定时间段内受到的影响，以及对网络安全总体目标的影响^[6-7].一般来说，安全态势信息由时间维度和空间维度2个方面组成.网络给人们的生活带来了方便，同时随着网络攻击和破坏行为增多，已经影响到了个人与社会的正常网络环境.

为了应对大规模网络中增加的信息安全威胁，已经使用了多种安全设备，这些设备会产生很多安全事件，就会造成过多的警告信息，很难准确获得整个网络的安全状态.为了解决这个问题，态势感知的概念被引入网络安全系统^[8]. Singh等^[9]构建了一种动态网络安全态势感知框架，该模型具有适应新实体的可扩展性，能够适应网络中的配置更改，同时处理异构数据以获得网络安全的整体视图. Wu等^[10]中提出了一个复杂网络的网络安全态势感知模型，引入复杂网络理论对SSA数据建模，通过分析网络的性质数据，可以更有效地挖掘当前数据的特征. Li等^[11]根据多方面信息的融合提出了一种改进的安全态势感知模型.

如何掌握整体安全态势，量化当前网络中不安全因素引起的网络损害程度，评估网络安全态势感知的准确成为一个重要方向.张劭帅等^[12]采用集对分析理论对无线传感器网络安全态势进行评估，该方法对中低强度的攻击灵敏度更高. Zhu等^[13]提出一种基于信息融合的网络安全态势感知模型评估方法，网络安全状况是融合脆弱性、威胁性和基本操作性3个方面评估的结果，该评估方法多维、准确、直观地描述了网络系统的整体安全态势感知.李玺等^[14]中提出了基于Markov决策过程和博弈论思想的网络安全态势评估方法，该方法能够准确给出装备保障信息网络的安全态势值.

基于国内外在网络安全态势感知领域的研究成果，本文提出了基于随机森林的多层次网络安全态势感知模型评估方法.与贝叶斯网络、BP神经网络相比，随机森林算法可更准确，更高效地工作.另外，对于不平衡的数据，本文方法可以平衡错误，且不会导致过度拟合.

4. 结论

本文构建了一个多层次网络安全态势感知模型，并提出了基于随机森林的态势感知模型评估方法，能够实现快速准确的态势预测.本文构建的多层次CSSA模型将CSSA过程与安全数据生命周期对齐，在多级分析框架中，数据采集和存储遵循分布式结构，每一种监控网络基础设施获取数据都要进行相应处理.采用随机森林算法对多层次CSSA模型进行评估，将多个分类器组合，并依赖于独立样本，这使得网络安全态势评估更为客观和准确.实验表明，本文模型和评估方法可行，在预测准确性、时间等性能上优于其他现有方法，能够提供选项来评估网络安全.未来研究方向是对本文方法进行优化与改进，以便本文方法能够适合大规模复杂网络的模型评估.

Figure (4) Table (4) Reference (15)

Name
	Name cannot be empty!
E-mail
	Mailbox cannot be empty! Mailbox cannot be empty!
Telephone
	Mobile number cannot be empty! Please enter a valid mobile number!
Title

Content
Verification Code

[1]	HOQUE N, BHUYAN M H, BAISHYA R C, et al.Network Attacks:Taxonomy, Tools and Systems[J].Journal of Network and Computer Applications, 2014, 40:307-324. doi: 10.1016/j.jnca.2013.08.001 CrossRef Google Scholar
[2]	赵新杰, 刘渊, 孙剑, 等.基于迁移学习和D-S理论的网络异常检测[J].计算机应用研究, 2016, 33(4): 1137-1140. doi: 10.3969/j.issn.1001-3695.2016.04.039 CrossRef Google Scholar
[3]	李响.基于经验模态分解的局域网络入侵检测算法[J].西南师范大学学报(自然科学版), 2016, 41(8): 132-137. Google Scholar
[4]	EVESTI A, KANSTRÉN T, FRANTTI T.Cybersecurity Situational Awareness Taxonomy[C]//Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA), 2017 International Conference On.London: IEEE, 2017. Google Scholar
[5]	PARK H K, KIM M S, PARK M, et al.Cyber Situational Awareness Enhancement with Regular Expressions and an Evaluation Methodology[C]//Military Communications Conference (MILCOM), MILCOM 2017-2017 IEEE.Baltimore: IEEE, 2017. Google Scholar
[6]	WEBB J, AHMAD A, MAYNARD S B, et al.A Situation Awareness Model for Information Security Risk Management[J]. Computers & security, 2014, 44:1-15. Google Scholar
[7]	王坤, 邱辉, 杨豪璞.基于攻击模式识别的网络安全态势评估方法[J].计算机应用, 2016, 36(1): 194-198, 226. doi: 10.3969/j.issn.1001-3695.2016.01.045 CrossRef Google Scholar
[8]	KANSTRÉN T, EVESTI A.A Study on the State of Practice in Security Situational Awareness[C]// IEEE International Conference on Software Quality, Reliability and Security Companion.Vienna: IEEE, 2016. Google Scholar
[9]	SINGH M, BHANDARI P.Building a Framework for Network Security Situation Awareness[C]//Computing for Sustainable Global Development (INDIACom), 2016 3rd International Conference on.New Delhi: IEEE, 2016. Google Scholar
[10]	WU Z T, LIU J, XU S Y.A Cyberspace Security Situation Awareness Model Based on Complex Network[C]//Reliability, Maintainability and Safety (ICRMS), 2016 11th International Conference on.Hangzhou: IEEE, 2016. Google Scholar
[11]	LI F W, ZHANG X Y, ZHU J, et al.A improved Network Security Situation Awareness Model[J].EAI Endorsed Transactions on Security and Safety, 2015, 2(5):1-5. Google Scholar
[12]	张劭帅, 袁津生.基于集对分析的WSN安全态势感知模型的研究[J].计算机工程与科学, 2017, 39(3): 505-511. doi: 10.3969/j.issn.1007-130X.2017.03.015 CrossRef Google Scholar
[13]	ZHU L, XIA G, ZHANG Z, et al.Multi-dimensional Network Security Situation Assessment[J].International Journal of Security and Its Applications, 2016, 10(11):153-164. doi: 10.14257/ijsia.2016.10.11.14 CrossRef Google Scholar
[14]	李玺, 卢昱, 刘森, 等.基于Markov game模型的装备保障信息网络安全态势感知方法研究[J].计算机应用研究, 2017, 34(11): 3441-3445. doi: 10.3969/j.issn.1001-3695.2017.11.054 CrossRef Google Scholar
[15]	RASMUSSEN H B, LVTZEN M, JENSEN S. Energy Efficiency at Sea: Knowledge, Communication, and Situational Awareness at Offshore Oil Supply and Wind Turbine Vessels[J]. Energy Research & Social Science, 2018, 44: 50-60. Google Scholar

Message Board

Network Security Situation Awareness Framework and Random Forest Assessment Model

Abstract

References

Access History

通讯作者: 陈斌, bchen63@163.com

Article Metrics

Access History

Other Articles By Authors