Network security situation assessment method based on fuzzy rough set

Abstract

The invention relates to a network security situation assessment method, and aims to provide a network security situation assessment method based on a fuzzy rough set. The network security situation assessment method based on the fuzzy rough set comprises the following steps: acquiring situation factors and situation levels to construct a decision table of the situation levels relative to the situation factors; and performing attribute reduction on the situation factors of decision rules in the decision table to obtain a reduced decision table, and making a decision on data needing to be judged in a current network through a KNN classifier by using the reduced decision table in order to obtain a situation level. Through adoption of the method, the problem that discretization of a real number continuous attribute is needed in a rough set method is solved. On the other hand, a rule aggregation way is adopted, thereby lowering the calculation complexity of a fuzzy rough set method. Meanwhile, a good decision result can be provided.

Description

technical field [0001] The invention relates to a network security situation assessment method, in particular to a network security situation assessment method based on fuzzy rough sets. Background technique [0002] With the continuous expansion and complexity of the network scale, network security threats are also increasing. Various types of logs and alarm information come in various forms and formats, and they are redundant and have a high rate of false alarms. Traditional processing methods have been difficult to deal with. In this context, in order to deal with large-scale networks and multi-source security information, network security situation awareness (NSSA) is derived from traditional security assessment. Network security situational awareness includes four links: situational understanding, situational assessment, situational prediction and situational visualization. [0003] Situation assessment is the core link of network security situation awareness, and it ...

AI Technical Summary

Problems solved by technology

[0004] For the rough set method in the network situation assessment method, since the rough set method does not require prior knowledge, it is suitable for the attribute reduction of the network situation assessment, but there is a problem of discretization in the processing of real-number attribute values, and the discretization will lose At the same time, different discretization methods or setting different parameters for the same discretization method may lead to different results

In order to solve the problem of discretization of continuous attributes of real numbers, the fuzzy rough set method, as a generalization of the rough set method, is a feasible method, but the computational complexity is too high

Images