Heterogeneous Multi-Sensor Data Fusion with Multi-Class Support Vector Machines: Creating Network Security Situation Awareness

Abstract

Multi-sensor Data Fusion and Network SituationAwareness are emerging technique in the field of network security and they help administrators to be aware of the actual security situation of their networks. This paper mainly focuses on heterogeneous multi-sensor data fusion and Situation Awareness. We adopted Snort and NetFlow collector as two sensors to gather real network traffic and fused them use Multi-class Support Vector Machines that could solve a multi class problem. In order to avoid dimension disaster, we employed an effective feature reduction approach to decrease the dimension of input vector and the computation time of Support Vector Machines that improved fusion performance and real time characteristic. Our framework is proved to be feasible and effective and has better performance than Neural Network through a series of experiments that using real network traffic.

Towards a Machine Learning Based Situational Awareness Framework for Cybersecurity: An SDN Implementation

“…The RNN is trained to identify network anomalies and enforce control policies, which by utilizing the benefits of the SDN paradigm. X. Liu et al in [ 21 , 22 ] presented a prototype of a multiclass support vector machine (SVM)-based fusion engine. Their outcomes suggest that the SVMs have potential in real-time IDS applications, due to the faster results and reliability of the SVM approach.…”

Architecture for the Cyber Security Situational Awareness System

“…There are several mathematical algorithms under those four categories. For example, [17] utilises Support Vector Machines (SVMs) as the fusion algorithm for network security situational awareness, and paper [18] proposes a Hierarchical Network Security Situation Assessment Model (HNSSAM) with DS data fusion for cyber security. Spatiotemporal event correlation is used for anomaly detection and for network forensics in study [19].…”

An Approach of Discovering Causal Knowledge for Alert Correlating Based on Data Mining

“…Related researches include Qin and Lee's Bayesian network probability-based correlation and Granger Causality Testbased correlation [10], Steven's attack scenarios recognition method based on the expert system [11], and Nurbol's alert correlation and filtering method based on the hidden Markov model [12]. 3) Some other knowledge-based alert correlation, for example, Liu's heterogeneous multi-sensor data fusion method with multi-class support vector machine [13], Julisch's root cause analysis method [14], Amann's network intrusion detection method with real-time Intelligence [15] and so on.…”

“…Since then, alert correlation becomes a hotspot, which aims to identify attack activities and reconstruct attack scenarios from the multisource alerts. However, there is not a standard definition about alert correlation by far, and researchers generally consider that as an application of data fusion in the field of intrusion detection [3] [4]. We classify the relationships between alerts into three categories, namely redundant, logical, and conflicting [5].…”