Network security situation awareness model and method based on time sequence

Abstract

The invention discloses a network security situation awareness model and method based on a time sequence. The model comprises a data preprocessing module, a situation analysis module and a situation prediction module. The method comprises the following steps: firstly, data sets of different sources are collected; principal component information is extracted in the data; fusion analysis is carriedout on the principal component data by utilizing a D-S evidence theory; secondly, asset importance is added on the basis of vulnerability threats, a security situation value of the network is obtained, finally, a perception algorithm based on Fourier curve fitting is selected to predict the situation value in the future time period according to different situations, and a network security situation prediction curve is drawn; or a perception algorithm based on curve contour similarity is selected to predict the situation value of the future time period. According to the invention, the prediction of the network security situation is more accurate, convenient, effective and reasonable, and the network security situation in a future period of time can be reflected more clearly and visually through the network security situation prediction map.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a network security situation awareness model and method based on time series. Background technique [0002] With the rapid development of computer networks, network attack incidents are increasing year by year, and network security issues have become the focus of people's current attention. Usually, the network security situation is predicted, and the security status of the network can be grasped before the network attack incident occurs, so as to take corresponding measures. Protective measures to avoid unnecessary attacks and losses. [0003] However, the research on the network security situation started relatively late in China, and most of them are researches on the network threat quantification process and intrusion detection process, which can only analyze the past or current network security situation, and cannot predict the network security situation, and there a...

AI Technical Summary

Problems solved by technology

[0003] However, the research on the network security situation started relatively late in China, and most of them are researches on the network threat quantification process and intrusion detection process, which can only analyze the past or current network security situation, and cannot predict the network security situation, and there are a few The prediction model can only be applied to specific standard systems and application scenarios, especially for the vulnerability warning information published by some security vulnerability database websites, due to its high randomness and discreteness, and conforming to the characteristics of time series, resulting in ordinary The current situation analysis model can only obtain the distribution of certain attributes according to statistical methods, and analyze the current network security status, but it cannot make effective and reasonable situation prediction.

Images