A review of key algorithms for network security situation awareness research

Abstract

With the rapid development of Internet technology, network threats are also increasing rapidly. Traditional ways of dealing with network threats, such as intrusion detection technology and malicious code detection technology, reveal the shortcomings of poor quantitative analysis and poor prediction of future situations. In order to cope with today's complex and changing network situation, network security situation awareness technology has gained more attention. Network security situation awareness consists of three layers: situation element extraction, situation understanding and situation prediction, and a complete network security situation awareness model is constructed through the three parts. The paper introduces the concept and development of network security situation awareness, describes the current mainstream algorithms and their advantages and disadvantages for each layer, and finally summarizes and outlooks on the problems of current mainstream algorithms and the trends of future development.