Abstract:To better understand the behavior of attackers and describe the network state, we construct an LSTM-DT model for network security situation awareness, which provides risk assessment indicators and quantitative methods. This paper introduces the concept of attack probability, making prediction results more consistent with the actual network situation. The model is focused on the problem of the time sequence of network security situation assessment by using the decision tree algorithm (DT) and long short-term memory(LSTM) network. The biggest innovation of this paper is to change the description of the network situation in the original dataset. The original label only has attack and normal. We put forward a new idea which regards attack as a possibility, obtaining the probability of each attack, and describing the network situation by combining the occurrence probability and attack impact. Firstly, we determine the network risk assessment indicators through the dataset feature distribution, and we give the network risk assessment index a corresponding weight based on the analytic hierarchy process (AHP). Then, the stack sparse auto-encoder (SSAE) is used to learn the characteristics of the original dataset. The attack probability can be predicted by the processed dataset by using the LSTM network. At the same time, the DT algorithm is applied to identify attack types. Finally, we draw the corresponding curve according to the network security situation value at each time. Experiments show that the accuracy of the network situation awareness method proposed in this paper can reach 95%, and the accuracy of attack recognition can reach 87%. Compared with the former research results, the effect is better in describing complex network environment problems.

Attack Model and Its Application Based on System States Aggregation

Modeling of the Mimic Defense Based on Heterogeneous Redundancy

Multi-agent based hybrid Intrusion detection system

Process Stability Modeling and Attack Protection of Industrial Control System Based on Reverse Cloud Algorithm Model

Worm Intrusion Alarm Modeling Based on Network Traffic Character

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

Vulnerability Assessment on WAMS Communication System Based on Attack Tree Model

Analysis and Research of Attack Model

A Hierarchical Model for Distributed Attacks

A Model of APT Attack Defense Based on Cyber Threat Detection

An Network Attack Modeling Method Based on MLL-AT

Research on Network Security Situation Awareness Based on the LSTM-DT Model

Transformer-based framework for alert aggregation and attack prediction in a multi-stage attack

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

Detecting Semantic Attack in SCADA System: A Behavioral Model Based on Secondary Labeling of States-Duration Evolution Graph

A Visual Model for Web Applications Security Monitoring

Autoregressive integrated moving average model–based secure data aggregation for wireless sensor networks

A risk assessment model for similar attack scenarios in industrial control system

A Stochastic Modeling of Coordinated Internal and External Attacks

Research on Key Technologies of Network Security Situational Awareness for Attack Tracking Prediction

Modeling Load Redistribution Attacks in Power Systems