Quantitative method for network security situation based on attack prediction

To predict the attack behaviors accurately and comprehensively as well as to quantify the threat of attack,a quantitative method for network security situation based on attack prediction was proposed.By fusing the situation factors of attacker,defender and network environment,the capability of attacker and the exploitability rate of vulnerability were evaluated utilizing the real-time detected attack events,and the expected time-cost for attack-defense were further calculated.Then an attack prediction algorithm based on the dynamic Bayesian attack graph was designed to infer the follow-up attack actions.At last,the attack threat was quantified as the security risk situation from two levels of the hosts and the overall network.Experimental analysis indicates that the proposed method is suitable for the real adversarial network environment,and is able to predict the occurrence time of attack accurately and quantify the attack threat reasonably.     

Network security situation evaluation method for multi-step attack

Aiming at analyzing the influence of multi-step attack,as well as reflecting the system’s security situation accurately and comprehensively,a network security situation evaluation method for multi-step attack was proposed.This method firstly clustered security events into several attack scenes,which was used to identify the attacker.Then the attack path and the attack phase were identified by causal correlation of every scene.Finally,combined with the attack phase as well as the threat index,the quantitative standard was established to evaluate the network security situation.The proposed method is assessed by two network attack-defense experiments,and the results illustrate accuracy and effectiveness of the method.     

Cloud resource prediction model based on triple exponential smoothing method and temporal convolutional network

The container cloud represented by Docker and Kubernetes has the advantages of less additional resource overhead and shorter start-up and destruction time.However there are still resource management issues such as over-supply and under-supply.In order to allow the Kubernetes cluster to respond “in advance” to the resource usage of the applications deployed on it,and then to schedule and allocate resources in a timely,accurate and dynamic manner based on the predicted value,a cloud resource prediction model based on triple exponential smoothing method and temporal convolutional network was proposed,based on historical data to predict future demand for resources.To find the optimal combination of parameters,the parameters were optimized using TPOT thought.Experiments on the CPU and memory of the Google dataset show that the model has better prediction performance than other models.     

基于改进贝叶斯正则化BP神经网络模型的网络安全态势预测方法研究

随着互联网的迅速发展,网络安全问题越来越严重,分析及预测网络安网络安全态势,对于网络安全具有重要意义。本文在网络安全态势量化的的基础上,改进贝叶斯算法,提出一种改进型贝叶斯正则化BP神经网络模型的网络安全态势预测方法,通过模拟网络环境进行数据分析,验证了该预测方法可以减小了训练误差和预测误差,提高了对网络安全态势预测精度,证明了该方法的可行性。     

基于改进CRITIC的灰色关联网络安全态势评估方法

针对灰色关联分析算法无法定量评估样本、没有充分考虑到待评估指标间的关联性和决策者的期望问题,提出了一种基于改进的CRITIC(Criteria Importance Through Intercriteria Correlation)的灰色关联网络安全态势评估算法,借助于改进CRITIC的主客观赋权与TOPSIS(Te...     

Network security situation automatic prediction model based on accumulative CMA-ES optimization

To improve the accuracy of the network security situation, a security situation automatic prediction model based on accumulative data preprocess and support vector machine (SVM) optimized by covariance matrix adaptive evolutionary strategy (CMA-ES) is proposed. The proposed model adopts SVM which has strong nonlinear ability. Also, the hyper parameters for SVM are optimized through the CMA-ES which owns good performance in finding optimization automatically. Considering the irregularity of network security situation values, we accumulate the original sequence, so that the internal rules of discrete data can be revealed and it is easy to model. Simulation experiments show that the proposed model has faster convergence-speed and higher prediction accuracy than other extant prediction models.     

A network security situation prediction model based on wavelet neural network with optimized parameters

The security incidents ion networks are sudden and uncertain, it is very hard to precisely predict the network security situation by traditional methods. In order to improve the prediction accuracy of the network security situation, we build a network security situation prediction model based on Wavelet Neural Network (WNN) with optimized parameters by the Improved Niche Genetic Algorithm (INGA). The proposed model adopts WNN which has strong nonlinear ability and fault-tolerance performance. Also, the parameters for WNN are optimized through the adaptive genetic algorithm (GA) so that WNN searches more effectively. Considering the problem that the adaptive GA converges slowly and easily turns to the premature problem, we introduce a novel niche technology with a dynamic fuzzy clustering and elimination mechanism to solve the premature convergence of the GA. Our final simulation results show that the proposed INGA-WNN prediction model is more reliable and effective, and it achieves faster convergence-speed and higher prediction accuracy than the Genetic Algorithm-Wavelet Neural Network (GA-WNN), Genetic Algorithm-Back Propagation Neural Network (GA-BPNN) and WNN.     

基于卡尔曼算法的网络安全态势预测方法分析

近几年,网络信息技术发展迅速,并逐渐进入社会各行各业的发展中,不仅改变着人们的生产方式,同时也改变了人们的生活方式,给人们衣食住行带来了很大的方便。但是应该看到网络在给人们带来极大便利的同时也存在较大的安全隐患,威胁人们的隐私和网络安全。所以必须要对网络安全态势进行分析和预测,找到一种合理的算法进行态势分析,建立科学的网络安全态势模型,为网络管理者做出安全防护的决策提供有效信息,提高网络安全度。这里主要利用卡尔曼算法进行网络安全态势预测方法的分析,并分析该算法的优越性。     

泛在无线网络中的分布式安全态势感知技术

首先,主要针对泛在无线网络的复杂性和异构性等特点,介绍分布式态势感知这一新颖的态势感知理论;然后,通过分析分布式态势感知与集中式态势感知的区别,指出分布式态势感知的6大特点;再次,详细分析分布式态势感知理论的3个主要部分:获取各个部分的认知信息,提取认知对象,表述认知对象与它们活动之间的关系。最后,指出当前分布式安全态势感知技术研究中需要注意的问题。     

Cloud security situation prediction method based on grey wolfoptimization and BP neural network

Aiming at the accuracy and error correction of cloud security situation prediction, a cloud security situation prediction method based on grey wolf optimization (GWO) and back propagation (BP) neural network is proposed.Firstly, the adaptive disturbance convergence factor is used to improve the GWO algorithm, so as to improve theconvergence speed and accuracy of the algorithm. The Chebyshev chaotic mapping is introduced into the positionupdate formula of GWO algorithm, which is used to select the features of the cloud security situation prediction dataand optimize the parameters of the BP neural network prediction model to minimize the prediction output error.Then, the initial weights and thresholds of BP neural network are modified by the improved GWO algorithm toincrease the learning efficiency and accuracy of BP neural network. Finally, the real data sets of Tencent cloudplatform are predicted. The simulation results show that the proposed method has lower mean square error (MSE)and mean absolute error (MAE) compared with BP neural network, BP neural network based on genetic algorithm(GA-BP), BP neural network based on particle swarm optimization (PSO-BP) and BP neural network based onGWO algorithm (GWO-BP). The proposed method has better stability, robustness and prediction accuracy.     

灰色关联分析与支持向量机相融合的网络安全态势评价

为了提高网络安全态势的评价准确性,提出一种灰色关联分析与支持向量机相融合的网络安全态势评价模型.首先采用灰色关联分析对网络安全态势评价指标进行筛选,并根据对评价结果贡献赋予评价指标权值,然后将重要的评价指标作为支持向量机的输入向量,并采用社会力模型算法选择模型的参数,最后采用仿真实例分析了模型的评价性能.实验结果表明,本文模型通过灰色关联分析选择支持向量机的输入向量和社会力模型算法选择了最合理的型参数,可以准确描述网络安全态势与评价指标之间的变化关系,不仅提高了网络安全态势评价的正确率,加快了建模速度,而且获得比经典模更优的评价结果.     

基于指数平滑的动态规划检测前跟踪算法

针对传统动态规划检测前跟踪(Dynamic Programming Track-Before-Detect, DP-TBD)算法在低信噪比(Signal to Noise Ratio, SNR)环境下跟踪性能较差以及容易出现团聚效应的问题, 提出一种基于指数平滑法的DP-TBD算法.该算法的创新之处在于:利用指数平滑法预测当前帧的目标状态, 当对当前帧代价函数进行优化时利用预测的目标状态对前一帧搜索窗内的代价函数进行加权.仿真结果表明, 文中所提算法能够有效抑制团聚效应, 且算法的检测性能和跟踪性能都比传统算法有所提高, 并且信噪比越低, 性能提高越明显.因此文中算法相对于传统算法来说更适用于低信噪比环境.     

基于软件定义网络的安全态势感知方式分析

本文首先分别详细地阐述了软件定义网络和态势感知的概念,随后又分别全面的分析了软件定义网络和态势感知的重点技术,通过对于这些技术要点的重点分析,为以后进一步深入研究网络的安全态势感知这项技术,提供了一个良好的借鉴作用.     

基于改进的递归神经网络的网络安全态势预测

本文利用神经网络处理非线性、复杂性等优势,基于改进的递归神经网络预测网络安全态势,实验结果证明该方法运行效率较高,运行结果与实际值相比,误差较低,精确性较高。     

基于改进的递归神经网络的网络安全态势预测

本文利用神经网络处理非线性、复杂性等优势,基于改进的递归神经网络预测网络安全态势,实验结果证明该方法运行效率较高,运行结果与实际值相比,误差较低,精确性较高。     

基于攻击者角度的网络安全评估方法研究

针对网络安全的评估问题,提出了基于攻击者角度的评估模型,并以此为依据建立评估指标体系。在此基础上,借助AHP灰色理论对网络的安全属性在网络攻击过程中遭受的破坏程度进行定量计算,并从攻击者的角度定性分析网络的安全性能。实验结果表明,该方法能够综合评估网络信息安全。     

基于贝叶斯攻击图的SDN安全预测方法

现有研究者采用威胁建模和安全分析系统的方法评估和预测软件定义网络（software defined network, SDN）安全威胁,但该方法未考虑SDN控制器的漏洞利用概率以及设备在网络中的位置,安全评估不准确。针对以上问题,根据设备漏洞利用概率和设备关键度结合PageRank算法,设计了一种计算SDN中各设备重要性的算法;根据SDN攻击图和贝叶斯理论设计了一种度量设备被攻击成功概率的方法。在此基础上设计了一种基于贝叶斯攻击图的SDN安全预测算法,预测攻击者的攻击路径。实验结果显示,该方法能够准确预测攻击者的攻击路径,为安全防御提供更准确的依据。     

基于VPRS的网络安全威胁评估方法

网络安全威胁评估是对网络威胁响应和预警的前提和基础,提出采用变精度粗糙集理论进行威胁评估的方法.该方法利用安全要素和威胁等级建立决策表,通过对决策表约简,获取决策规则,计算整个网络的安全等级.仿真实验表明,采用该方法的评估结果更加准确、直观.     

一种基于云模型的网络态势综合评估方法

针对网络态势评估中存在的模糊性、随机性和指标量化不统一等问题,提出了一种基于云模型的网络态势综合评估方法。综合考虑实数型、区间型和模糊型指标并统一用云模型量化表示,采用主观与客观相结合的赋权方式,并利用云相似性理论进行网络态势综合评估。对通信网络态势评估的实例分析表明,该方法能够合理地实现网络态势的定性及定量评估,并且保留了评估过程中的不确定性。     

基于贝叶斯网络的攻击图方法在网络安全评估中的应用

随着网络的发展,网络安全评估成为网络维护中不可或缺的组成部分,尽管攻击图、攻击树和其他技术已被广泛地用于预测所有漏洞,但仍然缺少一个有效的手段来量化地分析网络安全.介绍一个新方法构建一个带标记的攻击图,图中的每个节点都被标注了一个概率值用来说明该漏洞被成功利用的可能性,每条边都代表了漏洞间的关联.采用通用漏洞评分系统(CVSS)作为基础计算每个漏洞被利用的概率,采用贝叶斯网络计算累积的概率,并用一些典型场景评估了该方法的有效性和准确性.