Abstract:

In response to the increasing number and forms of network attacks, different types and names of network security situational awareness models have received widespread attention and research from the academic community. In the context of the rapid popularization of information technology, hardware system, software vulnerabilities, and security vulnerabilities in daily application operations have led to an increasing number of ways and means of network attacks. However, a single type of network security monitoring and analysis tool is no longer suitable for the current development of network technology. By reviewing the research history and current status of network security situational awareness technology, this article summarizes and analyzes the theoretical development and engineering applications of situational awareness models, and discusses the shortcomings and deficiencies in relevant technical solutions. It also looks forward to the future research directions of network security situational awareness models.

Key words: network security, information security, situation awareness, malicious software, firewall, intrusion detection, flow analysis, log audit