Research on Network Security Situation Awareness Based on the LSTM-DT Model

Abstract

To better understand the behavior of attackers and describe the network state, we construct an LSTM-DT model for network security situation awareness, which provides risk assessment indicators and quantitative methods. This paper introduces the concept of attack probability, making prediction results more consistent with the actual network situation. The model is focused on the problem of the time sequence of network security situation assessment by using the decision tree algorithm (DT) and long short-term memory(LSTM) network. The biggest innovation of this paper is to change the description of the network situation in the original dataset. The original label only has attack and normal. We put forward a new idea which regards attack as a possibility, obtaining the probability of each attack, and describing the network situation by combining the occurrence probability and attack impact. Firstly, we determine the network risk assessment indicators through the dataset feature distribution, and we give the network risk assessment index a corresponding weight based on the analytic hierarchy process (AHP). Then, the stack sparse auto-encoder (SSAE) is used to learn the characteristics of the original dataset. The attack probability can be predicted by the processed dataset by using the LSTM network. At the same time, the DT algorithm is applied to identify attack types. Finally, we draw the corresponding curve according to the network security situation value at each time. Experiments show that the accuracy of the network situation awareness method proposed in this paper can reach 95%, and the accuracy of attack recognition can reach 87%. Compared with the former research results, the effect is better in describing complex network environment problems.

Research on Network Security Situational Awareness Based on Crawler Algorithm

“…Situational awareness has emerged as a hot topic in the cyber security industry, due to its capacity to improve decision-making by applying a three-layer model of observation, understanding, and prediction [12,13]. In the early stage when security situational awareness was proposed, literature [14] proposed a security situational awareness model based on simple weighting method and gray theory; literature [14] proposed a network security situational assessment scheme based on attack mode identification; literature [15] summarized the current research direction and found that the research work mainly focused on the simple static evaluation, and the dynamic analysis from the possible transformation of attack activities was seriously insufficient, including early warning analysis and other aspects; Reference [16] discusses that the security situational awareness elements are extracted from the attacker, the defender, and the network environment, and a security situational prediction method based on the analysis of the spatiotemporal dimension is further formed. Reference [17] applies the LAMBDA language to support the elaboration of the template and matching process.…”

Anomalous Network Traffic Detection Method Based on an Elevated Harris Hawks Optimization Method and Gated Recurrent Unit Classifier

“…Recurrent Neural Network (RNN) [ 8 ] is a deep learning network for processing serialized data. By introducing recurrent connections between hidden layer units in adjacent time steps, RNN can effectively use historical information and it can make decisions on time series data, so it is widely used in the field of network traffic detection [ 9 , 10 , 11 ]. However, the phenomenon of exploding or vanishing gradients after multi-stage propagation of all time series data will cause the neural network to lose its long-term learning ability.…”

A New Model for Network Security Situation Assessment of the Industrial Internet

“…(3) Assessment methods based on semiquantitative information first set the initial parameters of the model according to expert experience and then use quantitative data to train the model to obtain the network security situation values. Some example methods include dynamic Bayesian networks [24], hidden Markov models [25], D-S and BP neural networks [26], D-S and radial basis perceptron (RBP) neural networks [27], long short-term memory networks and decision tree algorithms [28]. Such methods consider both qualitative knowledge and quantitative data and utilize expert knowledge for modeling in the early stage to ensure that the model can accurately evaluate the security situation of the complex Industrial Internet network system when few data samples are available.…”