Network Security Situation Awareness Approach Based on Markov Game Model

Zhang, Yong; Tan, Xiaobin; Cui, Xiao-Lin; Xi, Hong-Sheng

doi:10.3724/sp.j.1001.2011.03751

Cited by 38 publications

(18 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…(3) The attempt of the active evaluation model mainly revolves around the attack model, and each article usually contains three components: model definition, model solving algorithm, and solution result. The definition of the model is generally combined with other disciplines, such as Petri network [96,[153][154][155], game theory [108,124,[159][160][161][162], and Bayesian network [114,132], and some articles also focus on the improvement of model description ability [125,126]; the solution algorithm depends on the definition of the model, and it is generally shown together with the solution result. There are lots of literature [109][110][111][112][113][114] trying to improve on this point, such as the reachable path analysis based on attack graph [101,128,129,143,177], defense strategy analysis [111,124,161], and survivability analysis [126].…”

Section: Status Of Domestic Researchmentioning

confidence: 99%

“…θ = {θ A , θ D }is the set of action strategies of both offense and defense. P is the transition probability between game states S. R n = S i × θ × S j ∈(−∞,+∞)), which represents the income function of the person n in the state S i transitioning to the state S j ; GM = {N,S,θ,P,R}, according to this basic definition, after a finite-step (kstep) game process, the system transforms between different states to form a tree structure, the goal of the player is to make their function maximized, and the model's Nash equilibrium strategy f * can be obtained by means of Shapley algorithm or problem transformation solution [162]. The combination of game theory makes the focus of cybersecurity situational awareness rise from technology to management strategy and can portray the psychological activities of each participant, which greatly improves the description ability of the model and the scientific nature of the analysis results.…”

Section: Stochastic Modelmentioning

confidence: 99%

“…The intention of applying the Markov model to the cybersecurity situational awareness is to predict the attack and defense evolution effectively when the initial conditions are met, but there will be a large number of camouflage attacks or covert attacks during the attack. Forcing the application with inefficiency will lead to the extreme result of statistics (overexaggerating the impact of a certain accident or neglecting the impact of a key step), so Markov is generally combined with other models [53,109,162]. To obtain causal knowledge through Markov's method, and to simplify the operation process by one-step transition probability matrix, the model can be performed efficiently under large-scale networks.…”

Section: Stochastic Modelmentioning

confidence: 99%

See 2 more Smart Citations

Analysis framework of network security situational awareness and comparison of implementation methods

Huang

Wang

et al. 2019

J Wireless Com Network

View full text Add to dashboard Cite

Information technology has penetrated into all aspects of politics, economy, and culture of the whole society. The information revolution has changed the way of communication all over the world, promoted the giant development of human society, and also drawn unprecedented attention to network security issues. Studies, focusing on network security, have experienced four main stages: idealized design for ensuring security, auxiliary examination and passive defense, active analysis and strategy formulation, and overall perception and trend prediction. Under the background of the new strategic command for the digital control that all countries are scrambled for, the discussion of network security situational awareness presents new characteristics both in the academic study and industrialization. In this regard, a thorough investigation has been made in the present paper into the literature of network security situational awareness. Firstly, the research status both at home and abroad is introduced, and then, the logical analysis framework is put forward concerning the network security situational awareness from the perspective of the data value chain. The whole process is composed of five successive stages: factor acquisition, model representation, measurement establishment, solution analysis, and situation prediction. Subsequently, the role of each stage and the mainstream methods are elaborated, and the application results on the experimental objects and the horizontal comparison between the methods are explained. In an attempt to provide a panoramic recognition of network security situational awareness, and auxiliary ideas for the industrialization of network security, this paper aims to provide some references for the scientific research and engineering personnel in this field.

show abstract

Section: Status Of Domestic Researchmentioning

confidence: 99%

Section: Stochastic Modelmentioning

confidence: 99%

Section: Stochastic Modelmentioning

confidence: 99%

See 1 more Smart Citation

Analysis framework of network security situational awareness and comparison of implementation methods

Huang

Wang

et al. 2019

J Wireless Com Network

View full text Add to dashboard Cite

show abstract

“…By collecting, analyzing and processing the information from the sensors, we could identify the attack features, such as the source, size, speed, etc [5] . An effective method on NSSA is highly required to help us fuse all available information properly and comprehend the situation value with ease [6] .Bass [7] first put forward the combination of network security and situational awareness. He gave a network security situation awareness framework based on data fusion.…”

mentioning

confidence: 99%

mentioning

confidence: 99%

Network security situation evaluation based on modified D-S evidence theory

Wang

Zhang

2014

Wuhan Univ. J. Nat. Sci.

View full text Add to dashboard Cite

With the rapid development of global information and the increasing dependence on network for people, network security problems are becoming more and more serious. By analyzing the existing security assessment methods, we propose a network security situation evaluation system based on modified D − S evidence theory is proposed. Firstly, we give a modified D − S evidence theory to improve the reliability and rationality of the fusion result and apply the theory to correlation analysis. Secondly, the attack successful support is accurately calculated by matching internal factors with external threats. Multi-module evaluation is established to comprehensively evaluate the situation of network security. Finally we use an example of actual network datasets to validate the network security situation evaluation system. The simulation result shows that the system can not only reduce the rate of false positives and false alarms, but also effectively help analysts comprehensively to understand the situation of network security.With the application of computer network being more widely used and network attack technology constantly renovated, security problems are becoming more and more serious. Although a variety of sensors with different functions are deployed in detection and prevention of attacks, these security tools often generate huge reports with high false positive rate and high false negative rate [1] . The network security situation awareness (NSSA) technology emerge as the times require, it provides a macroscopic view of the current network security, which make the administrator grasp the current network security situation value more quickly and accurately, based on security events and as a basis for taking corresponding measures [2] . Up to date, research on NSSA has not yet formed a unified standard about the NSSA implication and presentation methods [3] . Thus, the network security situation assessment model and its key technology has become the research focus in the field of network security [4] . In order to accurately percept the network security, we need to deploy various types of sensors in network environment. By collecting, analyzing and processing the information from the sensors, we could identify the attack features, such as the source, size, speed, etc [5] . An effective method on NSSA is highly required to help us fuse all available information properly and comprehend the situation value with ease [6] .Bass [7] first put forward the combination of network security and situational awareness. He gave a network security situation awareness framework based on data fusion. The framework was divided into 5 layers to evaluate the security situation by analyzing the identified

show abstract