Comprehensive analysis of network security situational awareness methods and models

Abstract

The research of Network security situational awareness (NSSA) is very important because it can improve the network monitoring abilities, Emergency response capacity and predict the development trend of network security. Based on the concept model of situational awareness, This paper expounds on the situational awareness of the three main research content: extraction the factors of NSSA, situation understanding and situation prediction. The Focuses on the core problem each stage needs to be solved, main algorithms and advantages and disadvantages of these algorithms. Finally, the implementation of the development trends of the related theory and application in different stages are analyzed and prospected.

Survey of Attack Projection, Prediction, and Forecasting in Cyber Security

“…To the best of our knowledge, prediction and forecasting methods in cyber security were not surveyed in such scope yet, although several surveys of particular tasks and use cases were published in recent years. Wei and Jiang [7] in 2013 analyzed the problem of network security situation prediction and compared predictions of NSSA using neural networks, time series, and support vector machines, although mostly to illustrate the limitations of the available methods. Yang et al [3] formalized the task of attack projection and surveyed literature on the topic in 2014.…”

Predictive methods in cyber defense: Current experience and research challenges

“…The last use case presented here is the forecasting of a global or network-wide security situation [23,7]. Instead of focusing on an ongoing attack or a particular possible intrusion, the goal is to perceive a holistic state of an information system, network, or the whole Internet.…”

“…For example, Yang et al [4] formalized the task of attack projection, surveyed literature on the topic, and listed three categories: prediction based on attack plans, estimates of attackers capabilities and intentions, and predictions by learning attack patterns and attacker's behavior. Wei and Jiang [23] analyzed the problem of network security situation forecasting and compared the methods based on neural networks, time series, and support vector machines, while Leau and Manickam [7] surveyed the methods with a theoretical background in machine learning, Markov models, and Grey theory. An overview of intrusion prediction methods was presented by Abdlhamed et al [25], who split related work into two groups, prediction methods and intrusion detection enhancement.…”

“…As we can see in the examples above, predictive methods in cybersecurity are not an isolated research direction, but often overlap with others, such as with the cyber situational awareness [4,23,7] and intrusion detection [25,8]. Attack intention recognition is a very closely related research direction that uses very similar methods and approaches (e.g., graph models) as attack projection.…”

Network Security Classification Assessment Based on Fuzzy Mathematics

“…Now, we will analyze the security environment variables of the network by the situation awareness module [7] , and finally get the eight element values as shown in Table 2. Step 1,2: We can construct membership matrix:…”