Abstract:Network security situation awareness provides the unique high level security view based upon the security alert events. But the complexities and diversities of security alert data on modern networks make such analysis extremely difficult. In this paper, we analyze the existing problems of network security situation awareness system and propose a framework for network security situation awareness based on knowledge discovery. The framework consists of the modeling of network security situation and the generation of network security situation. The purpose of modeling is to construct the formal model of network security situation measurement based upon the D-S evidence theory, and support the general process of fusing and analyzing security alert events collected from security situation sensors. The generation of network security situation is to extract the frequent patterns and sequential patterns from the dataset of network security situation based upon knowledge discovery method and transform these patterns to the correlation rules of network security situation, and finally to automatically generate the network security situation graph. Application of the integrated Network Security Situation Awareness system (Net-SSA) shows that the proposed framework supports for the accurate modeling and effective generation of network security situation.

Real Time Situational Awareness Model for Large-scale Networks

Modeling of Network Situation Awareness

Industrial control network security situation awareness based on improved C-SVC

Survey of Network Situation Awareness System

System Architecture and Key Technologies of Network Security Situation Awareness System YHSAS

Research on Network Security Situation Awareness System Architecture Based on Multi-source Heterogeneous Sensors

Research and Implement of Security Situation Awareness System YH-SSAS

A Survey of Network Security Situational Awareness Technology

CNSSA: A Comprehensive Network Security Situation Awareness System

A Multi-Level Analysis Framework in Network Security Situation Awareness

Network Security Situation: from Awareness to Awareness-Control

Alert Analysis and Threat Evaluation in Network Situation Awareness

Multi-source and Multi-Dimensional Network Security Situational Awareness Model

Novel Multi-Heterogeneous Sensor Based Network Security Situation Awareness Model

Network Security Situation Awareness Based on Spatio-temporal Correlation of Alarms

Network Security Situation Awareness System Based on Knowledge Discovery

Network Security Situation Awareness Adaptive Control Model Based on Cognitive Network

Network Security Situation Awareness Technology Based on Multi-source Heterogeneous Data

A Novel Extended Algorithm for Network Security Situation Awareness

A Network Security Situation Awareness Model Based on Risk Assessment

Network Security Situation Awareness Model Based on Autonomic Computing