一种网络安全态势自适应预测模型

doi:10.19665/j.issn1001-2400.2020.03.003

摘要/Abstract

摘要：

针对传统网络安全态势预测模型预测精度较低的不足,提出一种网络安全态势自适应预测模型。首先,提取警报要素并利用熵关联法计算得到网络安全态势的时间序列;然后,将该序列作为滑动自适应三次指数平滑法的输入,并生成安全态势初始预测值序列;最后,基于误差状态通过时变加权马尔科夫链预测误差,并修正初始预测值。实验结果表明, 自适应预测模型相比其他模型具有较好的预测精度。

关键词: 网络安全态势, 熵关联法, 预测值, 三次指数平滑法, 时变加权马尔科夫链

Abstract:

Aiming at the low prediction accuracy of traditional network security situation prediction technology, a network security situation adaptive prediction model (NAP) is proposed. First, it extracts alarm elements and calculate network security situation time sequences based on the entropy correlation method. Then, the sequences are taken as the input of the sliding adaptive cubic exponential smoothing method with initial security situation predicted value sequences generated. Finally, the time-varying weighted Markov chain is used to predict the error value based on the error state and the initial predicted values are modified. Experimental results show that the NAP has a better prediction accuracy than other existing models.

Key words: network security situation, entropy correlation method, predicted value, cubic exponential smoothing method, time-varying weighted Markov chain

中图分类号:

TP309

杨宏宇,张旭高. 一种网络安全态势自适应预测模型[J]. 西安电子科技大学学报, 2020, 47(3): 14-22.

YANG Hongyu,ZHANG Xugao. Network security situation adaptive prediction model[J]. Journal of Xidian University, 2020, 47(3): 14-22.

图/表 10

图1

表1

评语支持度矩阵示意表"

指标	低	一般	高
$A F H i$	P₁₁	P₁₂	P₁₃
$A C H i$	P₂₁	P₂₂	P₂₃
$A S H i$	P₃₁	P₃₂	P₃₃

表1

表2

表3

图2

表5

图3

表6

图4

表7

参考文献 17

[1]	LEAU Y B, MANICKAM S. Network Security Situation Prediction: a Review and Discussion[J]. Communications in Computer and Information Science, 2015,516:424-435.
[2]	CIPRIANO C, ZAND A, HOUMANSADR A, et al. Nexat: a History-based Approach to Predict Attacker Actions [C]//Proceedings of the ACM International Conference Proceeding Series. New York: ACM, 2011: 383-392.
[3]	XIAO P, XIAN M, WANG H M. Network Security Situation Prediction Method Based on MEA-BP [C]//Proceedings of the 3rd IEEE International Conference on “Computational Intelligence and Communication Technology”. Piscataway: IEEE, 2017: 7977327.
[4]	SUN S X. The Research of the Network Security Situation Prediction Mechanism Based on the Complex Network [C]//Proceedings of the 2015 International Conference on Computational Intelligence and Communication Networks. Piscataway: IEEE, 2015: 1183-1187.
[5]	LEAU Y B, KHUDHER A A, MANICKAM S, et al. An Adaptive Assessment and Prediction Mechanism in Network Security Situation Awareness[J]. Journal of Computer Science, 2017,13(5):114-129. doi: 10.3844/jcssp.2017.114.129
[6]	SCHATZ D, BASHROUSH R. Security Predictions—a Way to Reduce Uncertainty[J]. Journal of Information Security and Applications, 2019,45:107-116. doi: 10.1016/j.jisa.2019.01.009
[7]	XIAO J, ZHANG B Q, LUO F Z. Distribution Network Security Situation Awareness Method Based on Security Distance[J]. IEEE Access, 2019,7:37855-37864. doi: 10.1109/Access.6287639
[8]	王晋东, 余定坤, 张恒巍, 等. 静态贝叶斯博弈主动防御策略选取方法[J]. 西安电子科技大学学报, 2016,43(1):144-150. doi: 10.3969/j.issn.1001-2400.2016.01.026
	WANG Jindong, YU Dingkun, ZHANG Hengwei, et al. Active Defense Strategy Selection Based on the Static Bayesian Game[J]. Journal of Xidian University, 2016,43(1):144-150. doi: 10.3969/j.issn.1001-2400.2016.01.026
[9]	周新卫, 李小玲. 基于改进 $G-k$ 算法的多节点网络安全态势预测模型 [J]. 科学技术与工程, 2018,18(25):72-77.
	ZHOU Xinwei, LI Xiaoling. Multi Node Network Security Situation Prediction Model Based on Improved $G-k$ Algorithm [J]. Science Technology and Engineering, 2018,18(25):72-77.
[10]	孙卫喜, 孙欢. 网络安全态势预测技术研究[J]. 计算机技术与发展, 2019,29(4):100-104.
	SUN Weixi, SUN Huan. Research on Network Security Situation Prediction Technology[J]. Computer Technology and Development, 2019,29(4):100-104.
[11]	张任川, 张玉臣, 刘璟, 等. 应用改进卷积神经网络的网络安全态势预测方法[J]. 计算机工程与应用, 2019,55(6):86-93.
	ZHANG Renchuan, LIU Yuchen, LIU Jing, et al. Network Security Situation Prediction Method Using Improved Convolution Neural Network[J]. Computer Engineering and Applications, 2019,55(6):86-93.
[12]	WERNER G, OKUTAN A, YANG S, et al. Forecasting Cyberattacks as Time Series with Different Aggregation Granularity [C]//Proceedings of the 2018 IEEE International Symposium on Technologies for Homeland Security. Piscataway: IEEE, 2018: 8574185.
[13]	席荣荣, 云晓春, 张永铮, 等. 一种改进的网络安全态势量化评估方法[J]. 计算机学报, 2015,38(4):749-758.
	XI Rongrong, YUN Xiaochun, ZHANG Yongzheng, et al. An Improved Quantitative Evaluation Method for Network Security[J]. Chinese Journal of Computers, 2015,38(4):749-758.
[14]	DEBAR H, WESPI A. Aggregation and Correlation of Intrusion-Detection Alerts [C]//Lecture Notes in Computer Science: 2212. Heidelberg: Springer Verlag, 2015: 85-103.
[15]	赵冬梅, 张玉清, 马建峰. 熵权系数法应用于网络安全的模糊风险评估[J]. 计算机工程, 2004,30(18):21-23.
	ZHAO Dongmei, ZHANG Yuqing, MA Jianfeng. Fuzzy Risk Assessment of Entropy-weight Coefficient Method Applied in Network Security[J]. Computer Engineering, 2004,30(18):21-23.
[16]	付钰, 吴晓平, 叶清, 等. 基于模糊集与熵权理论的信息系统安全风险评估研究[J]. 电子学报, 2010,38(7):1489-1494.
	FU Yu, WU Xiaoping, YE Qing, et al. An Approach for Information Systems Security Risk Assessment on Fuzzy Set and Entropy-weight[J]. Acta Electronica Sinica, 2010,38(7):1489-1494.
[17]	王笑, 戚湧, 李千目. 基于时变加权马尔科夫链的网络异常检测模型[J]. 计算机科学, 2017,44(9):136-141, 161.
	WANG Xiao, QI Yong, LI Qianmu. Network Anomaly Detection Model Based on Time-varying Weighted Markov Chain[J]. Computer Science, 2017,44(9):136-141, 161.

优先级	低	一般	高
1	0.500	0.333	0.167
2	0.250	0.500	0.250
3	0.167	0.333	0.500

预测精度等级	c	P
1级	<0.35	>0.95
2级	<0.50	>0.80
3级	<0.65	>0.70
4级	≥0.70	≥0.65

预测模型	Markov	ICNN	GVK	文中模型
历史数据维度	29	3	5	3
态势量化序列标准差	206.258	246.335	35.179	254.367

误差检验指标	预测模型	预测序列长度
误差检验指标	预测模型	20	40	60	80
后验差检验c	Markov	1.011	1.010	1.074	1.006
	ICNN	0.932	0.882	0.904	0.857
	GVK	0.948	0.927	0.917	0.923
	文中模型	0.596	0.501	0.468	0.133
小概率检验P	Markov	0.450	0.500	0.450	0.475
	ICNN	0.550	0.525	0.533	0.513
	GVK	0.400	0.375	0.450	0.438
	文中模型	0.850	0.825	0.867	0.900