Cybersecurity Situational Awareness Model using Improved LSTM-Informer

Xin Zhou,Bo Li

DOI: https://doi.org/10.62051/ijcsit.v2n3.05

2024-05-28

International Journal of Computer Science and Information Technology

Abstract:address the problem of low prediction accuracy in current network security situational prediction

What problem does this paper attempt to address?

Network security situation prediction method based on strengthened LSTM neural network

Zhaowei Dong,Xiaoyu Su,Lihui Sun,Kuikui Xu

DOI: https://doi.org/10.1088/1742-6596/1856/1/012056

2021-04-01

Journal of Physics: Conference Series

Abstract:Abstract As an important part of network security situation awareness, network security situation prediction describes the dynamic changes of security situation over time, and predicts future situation values based on historical situation values. In order to improve the accuracy of network security situation prediction, a long- and short-term memory network security situation prediction model based on the Sigmoid weighted reinforcement mechanism is proposed. Firstly, LSTM neural network is used to mine the temporal correlation of network security situation data. Sigmoid weighted linear element is introduced to deal with the gradient problem in the back propagation, and the input value is multiplied by Sigmoid activation function, so as to strengthen the structure of LSTM neural network and improve the accuracy of prediction.Then, the cuckoo search algorithm was used to optimize the super parameters to improve the training time. Finally, the public data set CICIDS2017 was used to verify the model. The simulation experiment results show that the model has a faster convergence rate and smaller errors.
Network Security Situation Prediction Based on LSTM

Feng Gao,Junjie Xia,Di Wu,Wei Wang,Chao Wang,Chang Song

DOI: https://doi.org/10.1109/cbase60015.2023.10439145

2023-01-01

Abstract:Nowadays, network security issues have become more complex and diversified, since various network malicious attacks emerging in an endless stream, existing traditional network security defense methods have been unable to fully meet the requirements of network security. Network Security Situation Awareness (NSSA) technology can predict the future network security situation based on the past network security situation and the current network security situation information. In this paper, a method of network security situation prediction using LSTM neural network model is proposed. First, the theoretical overview of network security situation awareness and LSTM neural network is analyzed. Then, the flow of network security situation prediction based on LSTM is described, and the data set is collected for simulation experiment. The results show that the network security situation prediction algorithm based on LSTM has effective network security prediction ability, and is expected to be gradually popularized in the subsequent work.
A Network Security Situation Prediction Method through the Use of Improved TCN and BiDLSTM

Chengpeng Yao,Yu Yang,Jinwei Yang,Kun Yin

DOI: https://doi.org/10.1155/2022/7513717

IF: 1.43

2022-10-06

Mathematical Problems in Engineering

Abstract:The rapid development of information technology has brought much convenience to human life, but more network threats have also come one after another. Network security situation prediction technology is an effective means to protect against network threats. Currently, the network environment is characterized by high data traffic and complex features, making it difficult to maintain the accuracy of the situation prediction. In this study, a network security situation prediction model based on attention mechanism (AM) improved temporal convolutional network (ATCN) combined with bidirectional long short-term memory (BiDLSTM) network is proposed. The TCN is improved by AM to extract the input temporal features, which has a more stable feature extraction capability compared with the traditional TCN and BiDLSTM, which is more capable of processing temporal data, and is used to perform the situation prediction. Finally, by validating on a real network traffic dataset, the proposed method has better performance on multiple loss functions and has more accurate and stable prediction results than TCN, BiDLSTM, TCN-LSTM, and other time-series prediction methods.

engineering, multidisciplinary,mathematics, interdisciplinary applications
Research on Network Security Situation Awareness Based on the LSTM-DT Model

Haofang Zhang,Chunying Kang,Yao Xiao

DOI: https://doi.org/10.3390/s21144788

IF: 3.9

2021-07-13

Sensors

Abstract:To better understand the behavior of attackers and describe the network state, we construct an LSTM-DT model for network security situation awareness, which provides risk assessment indicators and quantitative methods. This paper introduces the concept of attack probability, making prediction results more consistent with the actual network situation. The model is focused on the problem of the time sequence of network security situation assessment by using the decision tree algorithm (DT) and long short-term memory(LSTM) network. The biggest innovation of this paper is to change the description of the network situation in the original dataset. The original label only has attack and normal. We put forward a new idea which regards attack as a possibility, obtaining the probability of each attack, and describing the network situation by combining the occurrence probability and attack impact. Firstly, we determine the network risk assessment indicators through the dataset feature distribution, and we give the network risk assessment index a corresponding weight based on the analytic hierarchy process (AHP). Then, the stack sparse auto-encoder (SSAE) is used to learn the characteristics of the original dataset. The attack probability can be predicted by the processed dataset by using the LSTM network. At the same time, the DT algorithm is applied to identify attack types. Finally, we draw the corresponding curve according to the network security situation value at each time. Experiments show that the accuracy of the network situation awareness method proposed in this paper can reach 95%, and the accuracy of attack recognition can reach 87%. Compared with the former research results, the effect is better in describing complex network environment problems.

engineering, electrical & electronic,chemistry, analytical,instruments & instrumentation
Predicting with confidence – an improved dynamic cell structure

Yan Liu,Bojan Cukic,Michael Jiang,Zhiwei Xu

DOI: https://doi.org/10.1007/11539087_99

2005-01-01

Abstract:As a special type of Self-Organizing Maps, the Dynamic Cell Structures (DCS) network has topology-preserving adaptive learning capabilities that can, in theory, respond and learn to abstract from a much wider variety of complex data manifolds. However, the highly complex learning algorithm and non-linearity behind the dynamic learning pattern pose serious challenge to validating the prediction performance of DCS and impede its spread in control applications, safety-critical systems in particular. In this paper, we improve the performance of DCS networks by providing confidence measures on DCS predictions. We present the validity index, an estimated confidence interval associated with each DCS output, as a reliability-like measure of the network's prediction performance. Our experiments using artificial data and a case study on a flight control application demonstrate an effective validation scheme of DCS networks to achieve better prediction performance with quantified confidence measures.
An Improved Integrated Prediction Method of Cyber Security Situation Based on Spatial-time Analysis

Zhijie Fan,Zhiping Tan,Chengxiang Tan,Xin Li

DOI: https://doi.org/10.3966/160792642018111906015

2018-01-01

Abstract:Cyber security situation awareness, as an effective supplement in cyber security protection measures, has been one of the research focus in recent years. In particular, cyber security situation prediction has become a hotspot of research. However, the existing cyber security situation prediction methods neglect the influence of future security elements when measuring the future security situation. Another fact is that the relationships among the security elements are always ignored. In this work, we presented an improved integrated cyber security situation prediction method based on spatial-time analysis from a new perspective. We described cyber security elements in different levels by a hierarchical index system. Then we predicted the future security elements independently in time dimension. In the process of spatial dimension prediction, we made a fusion prediction of the future security elements by using Fuzzy Cognitive Maps (FCM), and meanwhile, we corrected the prediction in spatial dimension prediction by using threat intelligence data. Finally, we used DARPA2000 datasets that is from Lincoln Laboratory Scenario (DDOS) to verify and analyze our method. The experimental result shows that the proposed method can model the future cyber security situation in network environment in a more accurate way by comparing with other similar methods.
Research on Deep Spatio-Temporal Model and Its Application in Situation Prediction

Qi Feng,Jinhui Zhang,Xiaoguang Gao,Maoqing Li,Chenxi Ning

DOI: https://doi.org/10.1109/ICCRE57112.2023.10155597

2023-01-01

Abstract:Situation prediction refers to predicting the state information of things in the future on the basis of existing information, and situational information contains complex laws of time and space. Traditional methods only consider a single factor or separate time and space. At the same time, due to the limitations of traditional algorithms, it is not possible to accurately predict air combat events with long interval dependencies. In order to solve these problems, we propose a deep spatio-temporal model based on the dynamic graph convolution and attention mechanisms. The model extracts and analyzes the features of space and time respectively. Experimental results show that the model proposed in this paper has more stable training process and higher prediction accuracy.
Construction and Analysis of QPSO-LSTM Model in Network Security Situation Prediction

Li Wentao

DOI: https://doi.org/10.13052/jcsm2245-1439.1334

2024-04-09

Journal of Cyber Security and Mobility

Abstract:The continuous improvement of artificial intelligence technology has deepened its application in many fields and provided more support for predicting network security situations. QPSO-LSTM model based on LSTM neural network and fused with QPSO algorithm provides more options for improving network security situation prediction, further enhancing the effectiveness of network security situation prediction, and enabling more efficient and accurate prediction and analysis of network security situations. By comparing the applications of different types of algorithms in network security situation prediction, it was found that the QPSO-LSTM model has smaller prediction errors, can achieve higher prediction accuracy, and can also obtain higher F1-score and AUC values; the shorter identifying runtime also lays the foundation for improving the speed and efficiency of network security situation prediction. Therefore, in the field of network security situation prediction, the application of QPSO-LSTM model can provide more support for further improvement and improvement of security situation prediction performance in this field.
Network Security Situation Prediction Based on TCAN-BiGRU Optimized by SSA and IQPSO.

Junfeng Sun,Chenghai Li,Yafei Song,Peng Ni,Jian Wang

DOI: https://doi.org/10.32604/csse.2023.039215

2023-01-01

Abstract:The accuracy of historical situation values is required for traditional network security situation prediction (NSSP). There are discrepancies in the correlation and weighting of the various network security elements. To solve these problems, a combined prediction model based on the temporal convolution attention network (TCAN) and bi-directional gate recurrent unit (BiGRU) network is proposed, which is optimized by singular spectrum analysis (SSA) and improved quantum particle swarm optimization algorithm (IQPSO). This model first decomposes and reconstructs network security situation data into a series of subsequences by SSA to remove the noise from the data. Furthermore, a prediction model of TCAN-BiGRU is established respectively for each subsequence. TCAN uses the TCN to extract features from the network security situation data and the improved channel attention mechanism (CAM) to extract important feature information from TCN. BiGRU learns the before-after status of situation data to extract more feature information from sequences for prediction. Besides, IQPSO is proposed to optimize the hyperparameters of BiGRU. Finally, the prediction results of the subsequence are superimposed to obtain the final predicted value. On the one hand, IQPSO compares with other optimization algorithms in the experiment, whose performance can find the optimum value of the benchmark function many times, showing that IQPSO performs better. On the other hand, the established prediction model compares with the traditional prediction methods through the simulation experiment, whose coefficient of determination is up to 0.999 on both sets, indicating that the combined prediction model established has higher prediction accuracy.
Research on Network Security Situation Awareness System Based on Machine Learning

Yehong Yang

DOI: https://doi.org/10.2991/WARTIA-16.2016.25

2016-05-14

Abstract:With the popularity of computers, the Internet has entered the production and all aspects of social life, but the attendant problem of network security has become the focus of widespread concern. Network security situation awareness to effectively respond to network security issues provide a viable solution: for complex network environments and malicious attacks, a comprehensive analysis of attacks against various parts of the network system, from a macro point of view of network security situation be assess and predict the future of network security situation based on this information. For the predictive accuracy of prediction system for network security situation has improved significantly, and network security situation prediction method based on machine learning for the network security situation prediction have a high degree feasible, in the real network security situation awareness applications have certain research and practical value. Introduction of Network Security Situational Awareness Network security situation is the current status and trends of the entire information from a variety of factors operating conditions of various network devices, network behavior and user behavior constituted. Network security situational awareness can acquire, understand and display the network environment of security elements. Through a series of technical means in time and space, are fully aware of network security and access and associated elements as possible in a pluralistic, and the establishment of a network based on complex behaviors modeling and simulation situational analysis and pre-side system, and then integrate and analyze vast amounts of security associated with the network-related data. Network security situation awareness is a scientific and effective network security situation assessment and use of relevant technologies to make reasonable predictions about trends over time network security, network management personnel in advance to remind the network system for network equipment, network peer node hosts and data resources to make reasonable adjustments, upgrades and backup, network environment to address the risk of possible future harm to the network system, losses may result down to an acceptable range . Extract information network security situation is carried out on the basis of situational awareness that only a comprehensive collection of data and the use of sophisticated index system, to ensure the correctness of the results of the assessment. Therefore, in the design process model or system must pay attention to select a metric system. Network security situation is a source of diverse, different collection methods, different devices collect data formats, network security situation letter from mainly contains configuration, operating status, traffic, user behavior and other information.

Computer Science
A Network Security Situation Prediction Method Based on SSA-GResNeSt

Dongmei Zhao,Guoqing Ji,Yiling Zhang,Xunzheng Han,Shuiguang Zeng

DOI: https://doi.org/10.1109/tnsm.2024.3373663

2024-01-01

IEEE Transactions on Network and Service Management

Abstract:Convolutional neural networks have been widely used in intrusion detection and proactive network defense strategies such as network security situation prediction (NSSP). The interaction between cross-channel features and the dependencies between elements in the input data are essential factors that affect the prediction model’s performance. However, existing works have ignored these, resulting in performance that needs to be improved. To this end, we propose a GResNeSt model that combines the advantages of the global context block and ResNeSt to improve the NSSP performance. The GResNeSt model strengthens traditional convolutional neural networks in two ways: it effectively captures cross-feature interactions and obtains long-range dependencies of the input data. This enhances its performance in capturing associations among different elements, making it more effective in extracting critical information from data to identify network attacks. We used the Salp swarm algorithm to select optimal hyperparameters for improving the model’s performance. Furthermore, based on the attack impact, we calculated network security situation values of two public network datasets. Finally, comprehensive experiments on the datasets verified our model design and demonstrated that our scheme is superior to other models in terms of NSSP ability.
Network Security Situation Prediction Based on Improved Adaptive Grey Verhulst Model

Wei Hu,Jian-hua Li,Xiu-zhen Chen,Xing-hao Jiang

DOI: https://doi.org/10.1007/s12204-010-1025-z

2010-01-01

Abstract:Network security situation is a hot research topic in the field of network security. Whole situation awareness includes the current situation evaluation and the future situation prediction. However, the now-existing research focuses on the current situation evaluation, and seldom discusses the future prediction. Based on the historical research, an improved grey Verhulst model is put forward to predict the future situation. Aiming at the shortages in the prediction based on traditional Verhulst model, the adaptive grey parameters and equaldimensions grey filling methods are proposed to improve the precision. The simulation results prove that the scheme is efficient and applicable.
LSTM-Based Battlefield Electromagnetic Situation Prediction

Hengchang Zhang,Shengjie Zhao,Rongqing Zhang

DOI: https://doi.org/10.1007/978-3-030-89814-4_57

2021-01-01

Abstract:In the modern battlefield, the complex electromagnetic environment has brought considerable challenges to assessing the electromagnetic situation. Traditional electromagnetic situation assessment methods are difficult to process massive high-dimensional data, making it challenging to predict the electromagnetic situation. In recent years, the in-depth development of deep learning has provided a breakthrough in the electromagnetic situation field. However, related research mainly focuses on threat assessment and electromagnetic situation complexity prediction. There are few papers on electromagnetic situation prediction using machine learning. In this paper, we propose an electromagnetic situation prediction method based on long short-term memory (LSTM). We first build an attack-defense model based on deep reinforcement learning to simulate the electromagnetic situation. Then we use LSTM to predict the development of the situation and improve the loss function to reduce the prediction error. Furthermore, we analyze the impact of different situation features on the final win rate and use a small amount of situation information to predict the win rate with high accuracy. The experimental results show that this method can effectively predict the electromagnetic situation, providing excellent decision support for commanders.
VTion-PatchTST: Elevated PatchTST model for network security situation prediction

Shengcai Zhang,Huiju Yi,Dezhi An

DOI: https://doi.org/10.1016/j.compeleceng.2024.109393

IF: 4.152

2024-06-22

Computers & Electrical Engineering

Abstract:The rapid development of network attack techniques increases the risk of the internet being attacked, thus necessitating timely and effective network protection mechanisms. Network security situation prediction is a proactive defense method, the results of which can help formulate defense strategies in advance. The current network security situation prediction mainly focuses on single-step prediction, and the accuracy of multi-step prediction needs to be improved. By introducing three technologies: Variational Mode Decomposition (VMD), Temporal Convolutional Networks (TCN), Feature Fusion, an improved PatchTST model is proposed to solute the issue. VMD decomposes a complex sequence of historical situational values into multiple relatively stable subsequences with different features to make the model channel modeling specific. TCN enhances the ability of the model to extract temporal features. Feature fusion makes predictions more comprehensive through cross-channel linking. Both experiments and evaluations are conducted on the UNSW-NB15 and CIC-IDS2017 public datasets, and nine baseline models are used to compare with the proposed VTion-PatchTST. The experimental results show that the proposed model is more applicable to cybersecurity situation forecasting, with an relative average reduction of 40.3% and 29.0% in Mean Square Error (MSE) and Mean Absolute Error (MAE), respectively.

engineering, electrical & electronic,computer science, interdisciplinary applications, hardware & architecture
Cyber Security Situational Awareness Jointly Utilizing Ball K-Means and RBF Neural Networks

Cheng Peng,Wang Yongli,Yao Boyi,Huang Yuanyuan,Lu Jiazhong,Peng Qiao

DOI: https://doi.org/10.1109/iccwamtip51612.2020.9317377

2020-01-01

Abstract:Low accuracy and slow speed of predictions for cyber security situational awareness. This paper proposes a network security situational awareness model based on accelerated accurate k-means radial basis function (RBF) neural network, the model uses the ball k-means clustering algorithm to cluster the input samples, to get the nodes of the hidden layer of the RBF neural network, speeding up the selection of the initial center point of the RBF neural network, and optimize the parameters of the RBF neural network structure. Finally, use the training data set to train the neural network, using the test data set to test the accuracy of this neural network structure, the results show that this method has a greater improvement in training speed and accuracy than other neural networks.
A Situation Assessment Method with an Improved Fuzzy Deep Neural Network for Multiple UAVs

Lin Zhang,Yian Zhu,Xianchen Shi,Xuesi Li

DOI: https://doi.org/10.3390/info11040194

2020-01-01

Information

Abstract:To improve the intelligence and accuracy of the Situation Assessment (SA) in complex scenes, this work develops an improved fuzzy deep neural network approach to the situation assessment for multiple Unmanned Aerial Vehicle(UAV)s. Firstly, this work normalizes the scene data based on time series and use the normalized data as the input for an improved fuzzy deep neural network. Secondly, adaptive momentum and Elastic SGD (Elastic Stochastic Gradient Descent) are introduced into the training process of the neural network, to improve the learning performance. Lastly, in the real-time situation assessment task for multiple UAVs, conventional methods often bring inaccurate results for the situation assessment because these methods don’t consider the fuzziness of task situations. This work uses an improved fuzzy deep neural network to calculate the results of situation assessment and normalizes these results. Then, the degree of trust of the current result, relative to each situation label, is calculated with the normalized results using fuzzy logic. Simulation results show that the proposed method outperforms competitors.
An Improved Prediction Model for the Network Security Situation.

Jingjing Hu,Dongyan Ma,Chen Liu,Huaizhi Yan,Changzhen Hu

DOI: https://doi.org/10.1007/978-3-030-34139-8_3

2019-01-01

Abstract:This research seeks to improve the long training time of traditional methods that use support vector machine (SVM) for cyber security situation prediction. This paper proposes a cyber security situation prediction model based on the MapReduce and SVM. The base classifier for this model uses an SVM. In order to find the optimal parameters of the SVM, parameter optimization is performed by the Cuckoo Search (CS). Considering the problem of time cost when a data set is too large, we choose to use MapReduce to perform distributed training on SVMs to improve training speed. Experimental results show that the SVM network security situation prediction model using MapReduce and CS has improved the accuracy and decreased the training time cost compared to the traditional SVM prediction model.
Prediction of Cyberspace Security Data Based on the Markov Chain Model

Xinmiao Zhang

DOI: https://doi.org/10.2478/amns.2023.1.00434

2023-06-21

Applied Mathematics and Nonlinear Sciences

Abstract:Abstract In the era of people’s access to information, the network has undergone tremendous development, the connection patterns of network attacks have become endless, and the number of attack network methods is increasing year by year. Based on the Markov model, the author studies the problem of network security authentication and aims to determine the truth of network security. In this way, network security managers can identify current network security issues, and we can gain a better understanding of the current network situation so that we can update our current security network promptly. The development process proposed by the author is simulated and the obtained results are all compared and evaluated. The experimental results show that the hidden Markov model algorithm is improved, the network security situation is better recognized, and the accuracy of the n network security problem is better known. At the same time, it is known to predict network security problems in the future according to the application model of predicting network security problems. Tests have shown that the development process is feasible and effective.
Multi-scale Risk Assessment Model of Network Security Based on LSTM

Yinfei Lv,Huorong Ren,Xuefeng Gao,Tong Sun,Haopeng Zhang,Xinyu Guo

DOI: https://doi.org/10.1007/978-3-030-65955-4_19

2020-01-01

Abstract:As the problem of network security becomes more and more serious, how to accurately perceive the current network security situation and discover the attack behavior in time has become the focus of research in the field of network security. This paper proposes a multi-scale risk assessment model for network security based on Long Short Term Memory neural network (LSTM). The model utilizes the wavelet transform to decompose network traffic time series into sub-sequences of various scales. The LSTM network is used to predict the sub-sequence of wavelet decomposition. By comparing the difference between the actual sub-sequence and the predicted sub-sequence, the model determines whether there is “anomaly” in the network traffic time series. The anomaly detection results of each sub-sequence are summarized into a network security risk value to assess the risk of network security. The introduction of the multi-scale technology improves the detection accuracy of network traffic time series anomaly detection and effectively enhances the reliability of the risk value.
Research on the Key Technologies of Network Security-Oriented Situation Prediction

Yikun Zhu,Zhiling Du

DOI: https://doi.org/10.1155/2021/5527746

2021-05-31

Scientific Programming

Abstract:In today’s increasingly severe network security situation, network security situational awareness provides a more comprehensive and feasible new idea for the inadequacy of various single solutions and is currently a research hotspot in the field of network security. At present, there are still gaps or room for improvement in network security situational awareness in terms of model scheme improvement, comprehensive and integrated consideration, algorithm design optimization, etc. A lot of scientific research investments and results are still needed to improve the form of network security in a long and solid way. In this paper, we propose a network security posture assessment model based on time-varying evidence theory for the existing multisource information fusion technology that lacks consideration of the problem of threat occurrence support rate over time and make the threat information reflect the law of time change by introducing a time parameter in the basic probability assignment value. Thus, the existing hierarchical threat posture quantitative assessment technique is improved and a hierarchical multisource network security threat posture assessment model based on time-varying evidence theory is proposed. Finally, the superiority of the proposed model is verified through experiments.

computer science, software engineering

Cybersecurity Situational Awareness Model using Improved LSTM-Informer

Network security situation prediction method based on strengthened LSTM neural network

Network Security Situation Prediction Based on LSTM

A Network Security Situation Prediction Method through the Use of Improved TCN and BiDLSTM

Research on Network Security Situation Awareness Based on the LSTM-DT Model

Predicting with confidence – an improved dynamic cell structure

An Improved Integrated Prediction Method of Cyber Security Situation Based on Spatial-time Analysis

Research on Deep Spatio-Temporal Model and Its Application in Situation Prediction

Construction and Analysis of QPSO-LSTM Model in Network Security Situation Prediction

Network Security Situation Prediction Based on TCAN-BiGRU Optimized by SSA and IQPSO.

Research on Network Security Situation Awareness System Based on Machine Learning

A Network Security Situation Prediction Method Based on SSA-GResNeSt

Network Security Situation Prediction Based on Improved Adaptive Grey Verhulst Model

LSTM-Based Battlefield Electromagnetic Situation Prediction

VTion-PatchTST: Elevated PatchTST model for network security situation prediction

Cyber Security Situational Awareness Jointly Utilizing Ball K-Means and RBF Neural Networks

A Situation Assessment Method with an Improved Fuzzy Deep Neural Network for Multiple UAVs

An Improved Prediction Model for the Network Security Situation.

Prediction of Cyberspace Security Data Based on the Markov Chain Model

Multi-scale Risk Assessment Model of Network Security Based on LSTM

Research on the Key Technologies of Network Security-Oriented Situation Prediction