Network security situation awareness method based on fuzzy rough set

Abstract

The invention provides a network security situation awareness method based on a fuzzy rough set, and relates to the technical field of network security, and the method comprises the steps: carrying out the preprocessing of situation awareness data; establishing a decision table by taking the situation awareness data and the historical situation data as training samples, and aggregating decision rules with the same discrete value attribute; performing fuzzy rough set reduction on the preprocessed situation awareness data by adopting a positive domain method to obtain a reduced data set; training the reduced data set to obtain a security threat intelligent detection model; and constructing a security situation awareness platform, and carrying out intelligent detection on the network security situation. According to the method, feature reduction and normalized representation can be carried out on security situation data, threat detection is carried out on a feature set through a machine learning algorithm, a prototype system is constructed for an attack scene and a threat detection scene, and feature reduction, intelligent detection and prototype system construction and display of a cyberspace security situation are realized.

Description

Technical Field

[0001] The invention relates to the technical field of network security, and in particular provides a network security situation awareness method based on fuzzy rough sets. Background Art

[0002] With the development of electronic information technology and the improvement of informatization, the complexity of information systems continues to increase. Network confrontation presents the characteristics of complex status, dynamic changes, and organizational coordination. Information systems face security threats such as wireless communication link interference, pseudo-target attacks, identity masquerading attacks, denial of service attacks, and communication content tampering. If the current means and methods are used for protection, that is, using the network monitoring data in a short period of time to compare with the expert database accumulated over a long period of time, and then formulating network prevention and decision-making measures, there will be problems such as misjudgment and omission of network security incidents, resulting in the inability to conduct a comprehensive and comprehensive analysis and evaluation of the monitoring data and provide decision support, which will be more difficult and thorny when implementing specific network security defense technical measures.

[0003] In response to the above problems, in the late 1990s, the situation awareness theory in the air command system was applied to network security, and network security situation awareness technology came into being. Network security situation awareness technology monitors all security factors of the complete network, comprehensively perceives the network security threat situation, and has insights into subtle changes in security factors, thereby predicting the trend of network security and helping security personnel take targeted security protection measures. Both domestic and foreign countries have conducted relevant research on situation awareness methods. However, existing network security situation awareness methods have problems such as redundant situation features, low detection efficiency and accuracy, and single output results. Summary of the invention

[0004] The purpose of this application is to provide a network security situation awareness method based on fuzzy rough sets, which simplifies security situation features through fuzzy rough sets, uses machine learning algorithms to detect the simplified situation features, builds a situation awareness prototype system for attack scenarios and threat detection scenarios, and realizes feature simplification, intelligent detection and prototype system display of cyberspace security situation.

[0005] In order to achieve the above object, the present invention adopts the following technical solution: a network security situation awareness method based on fuzzy rough sets, the method comprising:

[0006] Preprocessing of situational awareness data;

[0007] The situation awareness data and historical situation data are used as training samples to establish a decision table, and the decision rules with the same discrete value attributes are aggregated;

[0008] The preprocessed situation awareness data is subjected to fuzzy rough set reduction using the positive domain method to obtain a reduced data set.

[0009] The simplified data set is trained using a machine learning method selected from the naive Bayes algorithm, the random forest algorithm, the decision tree learning algorithm and the support vector machine method to obtain a security threat intelligent detection model;

[0010] A security situation awareness platform is built based on attack scenarios and threat detection scenarios, and the security threat intelligent detection model is used based on the security situation awareness platform to perform intelligent detection of network security situation.

[0011] The network security situation awareness method based on fuzzy rough sets provided by the present invention also has the following technical features: the preprocessing of situation awareness data includes:

[0012] Find the information format of the situation awareness data set, obtain the data information of the branch, map the feature string to the index value, and realize the feature extraction and digital representation of the situation awareness data.

[0013] The network security situation awareness method based on fuzzy rough sets provided by the present invention also has the following technical features: the pre-processed situation awareness data is subjected to fuzzy rough set simplification using a positive domain method, and the simplified data set obtained includes:

[0014] The similarity between the two security situation factors in the decision table is calculated, and the similarity between any two objects in the decision table is calculated. A fuzzy equivalence matrix is ​​established, and the elements in the matrix represent the similarity values ​​between the two objects in the decision table.

[0015] Define dependent functions and initialize them;

[0016] Select one attribute from all the attributes of each situation awareness data feature, adopt a greedy strategy, calculate the dependency value after adding the attribute, and add the attribute that increases the dependency value to the reduced set;

[0017] Add attributes one by one until the dependent value is equal to the dependent values ​​of all conditional attributes to obtain a reduced data set.

[0018] The network security situation awareness method based on fuzzy rough sets provided by the present invention also has the following technical features: the similarity calculation is performed between the security situation factors of the decision table, the similarity between any two objects in the decision table is calculated, and a fuzzy equivalence matrix is ​​established. The elements in the matrix represent the similarity values ​​between the objects in the decision table, including:

[0019] The decision information system is represented by a four-tuple DT=<U,C∪D,V,f> , where U is a non-empty finite set, C is a non-empty conditional finite set, D is a decision attribute set, V is the value range of the attribute, and f(a,x) is the value of element x on attribute a;

[0020] The similarity calculation formula is expressed as similarity = 1 / 1 + d, where d represents the distance between two objects;

[0021] When the object attribute is a Boolean value, the distance between attributes a(x) and a(y) is calculated as

[0022] When the object attribute is categorical, the distance calculation formula between attributes a(x) and a(y) is

[0023] When the object attribute type is a real value, it becomes an interval value after aggregation. The probability calculation formula for the interval value A[a1,a2] being greater than or equal to the interval value B[b1,b2] is: The distance between interval value A[a1,a2] and interval value B[b1,b2] is calculated as d(A,B)=1-P (A≥B) -P (B≥A) ;

[0024] A fuzzy equivalence matrix is ​​established, and the elements in the matrix represent the similarity values ​​between the decision table objects.

[0025] The network security situation awareness method based on fuzzy rough sets provided by the present invention also has the following technical features: defining the dependency function and initializing the dependency function include:

[0026] The conditional attribute set is represented by C, the decision attribute set is represented by D, and the positive domain is represented by The reduced set is denoted as R;

[0027] Defining dependent functions

[0028] Initialize the dependency function and reduction set R←{},γ←0,γ C (D).

[0029] The network security situation awareness method based on fuzzy rough sets provided by the present invention also has the following technical features: selecting an attribute from all the attributes of each situation awareness data feature, using a greedy strategy, adding the attribute, and calculating the dependency value, and adding the attribute that increases the dependency value to the reduced set includes:

[0030] Select an attribute from the remaining attributes, adopt a greedy strategy, and calculate the dependency value after each attribute is added;

[0031] If the dependency value after adding this attribute is greater than the original dependency value, that is, γ R∪{x} (D)>γ T (D), then add the attribute to the reduced set;

[0032] The reduction set is updated to R = R ∪ {x}, and the dependency value is updated to γ←γ C (D).

[0033] The network security situation awareness method based on fuzzy rough sets provided by the present invention also has such a technical feature that the simplified data set is trained using a naive Bayes algorithm, a random forest algorithm, a decision tree learning algorithm and a support vector machine method to obtain a security threat intelligent detection model including:

[0034] The preprocessed and reduced data are randomly divided into training data set and test data set;

[0035] The training data set is trained using one of the four machine learning algorithms, decision tree, random forest, naive Bayes and support vector machine, to build an intelligent detection model;

[0036] Input the features of the test data set into the intelligent detection model, and compare the classifier output with the test set label to obtain the accuracy of the intelligent detection model;

[0037] If the accuracy rate is higher than 95%, the intelligent detection model is a security threat intelligent detection model; if the accuracy rate is not higher than 95%, the machine learning algorithm is reselected to build the model.

[0038] The network security situation awareness method based on fuzzy rough sets provided by the present invention also has the following technical features: the security situation awareness platform includes: an attack host for executing various types of attack behaviors, a target machine system for serving as a DVWA mirror, and a situation awareness system host for analyzing and detecting collected target machine logs.

[0039] Beneficial Effects

[0040] The network security situation awareness method based on fuzzy rough sets provided by the present invention can simplify and normalize the features of security situation data, perform threat detection on feature sets through machine learning algorithms, build prototype systems for attack scenarios and threat detection scenarios, and realize feature simplification, intelligent detection, prototype system construction and display of cyberspace security situation.

[0041] The network security situation awareness method based on fuzzy rough sets provided by the present invention eliminates redundant security situation features. Aiming at the problem that the characteristic attributes of situation awareness data are not equally important and some are even redundant, the fuzzy rough set method is used to simplify the situation awareness data, and under the condition of keeping the classification ability of the knowledge base unchanged, the irrelevant or unimportant attributes are deleted, thereby eliminating the redundant features of the situation awareness data and improving the efficiency of subsequent security threat detection.

[0042] The network security situation awareness method based on fuzzy rough sets provided by the present invention improves the accuracy and efficiency of threat detection. Aiming at the problems of rigidity and low detection rate of traditional security detection methods, a machine learning algorithm is used to train a security threat intelligent detection model to perform intelligent detection and identification of threat features, thereby improving the accuracy of threat detection.

[0043] The network security situation awareness method based on fuzzy rough sets provided by the present invention improves the visualization of situation awareness results. Aiming at the problem that the situation output results are single and non-intuitive, a security situation awareness prototype system is built based on attack scenarios and threat detection scenarios to display situation data such as security alerts, security situation, assets, and assessment results, which helps to improve the efficiency of security response. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 A flowchart of the method provided by the present invention;

[0046] Figure 2 is a flow chart of situation awareness data preprocessing in an embodiment of the present invention;

[0047] Figure 3 The figure is a flow chart of simplifying the characteristics of situation awareness data in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The present application is further described in detail below in conjunction with the accompanying drawings and examples, but it should be noted that these implementation methods are not limitations of the present application, and equivalent changes or substitutions in functions, methods, or structures made by ordinary technicians in the field based on these implementation methods are all within the scope of protection of the present application.

[0049] In the description of the embodiments of the present application, it should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the creation of the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the creation of the present application.

[0050] In addition, the terms "first", "second", "third", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", etc. may explicitly or implicitly include one or more of the features. In the description of the invention of this application, unless otherwise specified, the meaning of "plurality" is two or more.

[0051] The terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the invention of this application can be understood by specific circumstances.

[0052] like Figure 1-3 As shown, the embodiment of the present application provides a network security situation awareness method based on fuzzy rough sets. First, the situation awareness data is preprocessed, the features are digitized, the situation awareness data and the experience data of domain experts are used as training samples to establish a decision table, and the decision rules with the same discrete value attributes are aggregated; secondly, the features of the situation awareness data after preprocessing are simplified, and the attribute set is simplified using the positive domain method to obtain a simplified data set; then, the simplified security situation data is trained using machine learning methods such as the naive Bayes algorithm, random forest algorithm, decision tree learning algorithm, and support vector machine to obtain a security threat intelligent detection model for intelligent detection and identification of threat features; then, a security situation awareness platform is constructed based on attack scenarios and threat detection scenarios, including elements such as attack hosts, target machines, and situation awareness hosts, and situation data such as security alarms, security situations, detection results, and asset information are visualized. The specific steps are as follows:

[0053] 1) Preprocessing of situation awareness data;

[0054] 2) Using situation awareness data and historical situation data as training samples, generating security situation factors and security situation levels, using security situation factors and security situation levels to establish a decision table, and performing aggregation operations on decision rules with the same discrete attributes in the above decision table, thereby reducing the computational complexity of the fuzzy rough set model;

[0055] 3) The preprocessed situation awareness data is subjected to fuzzy rough set simplification using the positive domain method to obtain a simplified data set;

[0056] 4) training the reduced data set using a machine learning method selected from the naive Bayes algorithm, the random forest algorithm, the decision tree learning algorithm, and the support vector machine method to obtain a security threat intelligent detection model;

[0057] 5) Build a security situation awareness platform based on attack scenarios and threat detection scenarios, and use the security threat intelligent detection model based on the security situation awareness platform to perform intelligent detection of network security situation.

[0058] In some embodiments, the preprocessing of the situation awareness data includes:

[0059] Find the information format of the situation awareness data set, obtain the data information of the branch, map the feature string to the index value, and realize the feature extraction and digital representation of the situation awareness data.

[0060] In some embodiments, the pre-processed situation awareness data is subjected to fuzzy rough set simplification using a positive domain method to obtain a simplified data set including:

[0061] The similarity between the two security situation factors in the decision table is calculated, and the similarity between any two objects in the decision table is calculated. A fuzzy equivalence matrix is ​​established, and the elements in the matrix represent the similarity values ​​between the two objects in the decision table.

[0062] Define dependent functions and initialize them;

[0063] Select one attribute from all the attributes of each situation awareness data feature, adopt a greedy strategy, calculate the dependency value after adding the attribute, and add the attribute that increases the dependency value to the reduced set;

[0064] Add attributes one by one until the dependent value is equal to the dependent values ​​of all conditional attributes to obtain a reduced data set.

[0065] In some embodiments, the similarity calculation is performed on the security situation factors of the decision table, and the similarity between any two objects in the decision table is calculated to establish a fuzzy equivalence matrix. The elements in the matrix represent the similarity values ​​between the objects in the decision table, including:

[0066] The decision information system is represented by a four-tuple DT=<U,C∪D,V,f> , where U is a non-empty finite set, C is a non-empty conditional finite set, D is a decision attribute set, V is the value range of the attribute, and f(a,x) is the value of element x on attribute a;

[0067] The similarity calculation formula is expressed as similarity = 1 / 1 + d, where d represents the distance between two objects;

[0068] When the object attribute is a Boolean value, the distance between attributes a(x) and a(y) is calculated as

[0069] When the object attribute is categorical, the distance calculation formula between attributes a(x) and a(y) is

[0070] When the object attribute type is a real value, it becomes an interval value after aggregation. The probability calculation formula for the interval value A[a1,a2] being greater than or equal to the interval value B[b1,b2] is: The distance between interval value A[a1,a2] and interval value B[b1,b2] is calculated as d(A,B)=1-P (A≥B) -P (B≥A) ;

[0071] A fuzzy equivalence matrix is ​​established, and the elements in the matrix represent the similarity values ​​between the decision table objects.

[0072] In some embodiments, the defining of the dependent function and initializing the dependent function includes:

[0073] The conditional attribute set is represented by C, the decision attribute set is represented by D, and the positive domain is represented by The reduced set is denoted as R;

[0074] Defining dependent functions

[0075] Initialize the dependency function and reduction set R←{},γ←0,γ C (D).

[0076] In some embodiments, selecting an attribute from all attributes of each situation awareness data feature, using a greedy strategy, calculating the dependency value after adding the attribute, and adding the attribute that increases the dependency value to the reduced set includes:

[0077] Select an attribute from the remaining attributes, adopt a greedy strategy, and calculate the dependency value after each attribute is added;

[0078] If the dependency value after adding this attribute is greater than the original dependency value, that is, γ R∪{x} (D)>γ T (D), then add the attribute to the reduced set;

[0079] The reduction set is updated to R = R ∪ {x}, and the dependency value is updated to γ←γ C (D).

[0080] In some embodiments, the simplified data set is trained using a naive Bayes algorithm, a random forest algorithm, a decision tree learning algorithm, and a support vector machine method to obtain a security threat intelligent detection model, including:

[0081] The preprocessed and reduced data are randomly divided into training data set and test data set;

[0082] The training data set is trained using one of the four machine learning algorithms, decision tree, random forest, naive Bayes and support vector machine, to build an intelligent detection model;

[0083] Input the features of the test data set into the intelligent detection model, and compare the classifier output with the test set label to obtain the accuracy of the intelligent detection model;

[0084] If the accuracy rate is higher than 95%, the intelligent detection model is a security threat intelligent detection model; if the accuracy rate is not higher than 95%, the machine learning algorithm is reselected to build the model.

[0085] In some embodiments, the security situation awareness platform includes: an attack host for executing various types of attack behaviors, a target machine system for serving as a DVWA image, and a situation awareness system host for analyzing and detecting collected target machine logs.

[0086] The above is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application shall be included in the protection scope of the present application. The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and variations can be made without departing from the technical principles of the present application, and these improvements and variations should also be regarded as the protection scope of the present application.

Claims

1. A network security situation awareness method based on fuzzy rough sets, characterized in that: The method comprises: Preprocessing of situational awareness data; The situation awareness data and historical situation data are used as training samples to establish a decision table, and the decision rules with the same discrete value attributes are aggregated; The preprocessed situation awareness data is subjected to fuzzy rough set reduction using the positive domain method to obtain a reduced data set. The simplified data set is trained using a machine learning method selected from the naive Bayes algorithm, the random forest algorithm, the decision tree learning algorithm and the support vector machine method to obtain a security threat intelligent detection model; A security situation awareness platform is built based on attack scenarios and threat detection scenarios, and the security threat intelligent detection model is used based on the security situation awareness platform to perform intelligent detection of network security situation.

2. The network security situation awareness method based on fuzzy rough sets according to claim 1 is characterized in that: The preprocessing of the situation awareness data includes: Find the information format of the situation awareness data set, obtain the data information of the branch, map the feature string to the index value, and realize the feature extraction and digital representation of the situation awareness data.

3. The network security situation awareness method based on fuzzy rough sets according to claim 1 is characterized in that: The pre-processed situation awareness data is subjected to fuzzy rough set simplification using the positive domain method, and the simplified data set obtained includes: The similarity between the two security situation factors in the decision table is calculated, and the similarity between any two objects in the decision table is calculated. A fuzzy equivalence matrix is ​​established, and the elements in the matrix represent the similarity values ​​between the two objects in the decision table. Define dependent functions and initialize them; Select one attribute from all the attributes of each situation awareness data feature, adopt a greedy strategy, calculate the dependency value after adding the attribute, and add the attribute that increases the dependency value to the reduced set; Add attributes one by one until the dependent value is equal to the dependent values ​​of all conditional attributes to obtain a reduced data set.

4. The network security situation awareness method based on fuzzy rough sets according to claim 3 is characterized in that: The similarity calculation is performed on the security situation factors of the decision table, and the similarity between any two objects in the decision table is calculated to establish a fuzzy equivalence matrix. The elements in the matrix represent the similarity values ​​between the objects in the decision table, including: The decision information system is represented by a four-tuple DT=<U,C∪D,V,f> , where U is a non-empty finite set, C is a non-empty conditional finite set, D is a decision attribute set, V is the value range of the attribute, and f(a,x) is the value of element x on attribute a; The similarity calculation formula is expressed as similarity = 1 / 1 + d, where d represents the distance between two objects; When the object attribute is a Boolean value, the distance between attributes a(x) and a(y) is calculated as When the object attribute is categorical, the distance calculation formula between attributes a(x) and a(y) is When the object attribute type is a real value, it becomes an interval value after aggregation. The probability calculation formula for the interval value A[a1,a2] being greater than or equal to the interval value B[b1,b2] is: The distance between interval value A[a1,a2] and interval value B[b1,b2] is calculated as d(A,B)=1-P (A≥B) -P (B≥A) ; A fuzzy equivalence matrix is ​​established, and the elements in the matrix represent the similarity values ​​between the decision table objects.

5. The network security situation awareness method based on fuzzy rough sets according to claim 3 is characterized in that: Defining the dependent function and initializing the dependent function includes: The conditional attribute set is represented by C, the decision attribute set is represented by D, and the positive domain is represented by The reduced set is denoted as R; Defining dependent functions Initialize the dependency function and reduction set R←{},γ←0,γ C (D).

6. The network security situation awareness method based on fuzzy rough sets according to claim 3 is characterized in that: The method of selecting an attribute from all the attributes of each situation awareness data feature, using a greedy strategy, adding the attribute and calculating the dependency value, and adding the attribute that increases the dependency value to the reduced set includes: Select an attribute from the remaining attributes, adopt a greedy strategy, and calculate the dependency value after each attribute is added; If the dependency value after adding this attribute is greater than the original dependency value, that is, γ R∪{x} (D)>γ T (D), then add the attribute to the reduced set; The reduction set is updated to R = R ∪ {x}, and the dependency value is updated to γ←γ C (D).

7. The network security situation awareness method based on fuzzy rough sets according to claim 1 is characterized in that: The simplified data set is trained using the naive Bayes algorithm, random forest algorithm, decision tree learning algorithm and support vector machine method to obtain a security threat intelligent detection model including: The preprocessed and reduced data are randomly divided into training data set and test data set; The training data set is trained using one of the four machine learning algorithms, decision tree, random forest, naive Bayes and support vector machine, to build an intelligent detection model; Input the features of the test data set into the intelligent detection model, and compare the classifier output with the test set label to obtain the accuracy of the intelligent detection model; If the accuracy rate is higher than 95%, the intelligent detection model is a security threat intelligent detection model; if the accuracy rate is not higher than 95%, the machine learning algorithm is reselected to build the model.

8. The network security situation awareness method based on fuzzy rough sets according to claim 1 is characterized in that: The security situation awareness platform includes: an attack host for executing various types of attack behaviors, a target machine system for serving as a DVWA mirror, and a situation awareness system host for analyzing and detecting collected target machine logs.

Images