Network Security Situation Awareness Model Based on Multi-Period Assessment

Abstract:

This article proposes a new model which is called hierarchical network security situation awareness model. The model emphasizes the time dimension in the assessment, it divides the assessment into two parts: short-term and long-term. The data source is the logs, flow data and others generated by equipments. These original data through the data fusion model and the situation evaluation model to obtain the short-term result, this result is the foundation of long-term. Combine the static indicators with dynamic which is calculated by short-term to figure out the long-term result. This model is based on multi-source data, and expand quantitative assessment in the different levels of time dimension, it makes up the security situation assessment in multi-period assessment and has advantage in network security situation prediction.

• Periodical: Applied Mechanics and Materials (Volumes 411-414)
• Pages: 613-618
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.411-414.613
• Online since: September 2013
• Authors: Chun Li, Xiao Liu Shen
• Keywords: Data Fusion, Dynamic Correction, Network Security Situation, Time Dimension

References

[1] Chen XZ, Zheng QH, Guan XH, and Lin CG, Quantitative hierarchical threat evaluation model for network security, Journal of Software, Vol. 17, No. 3, 2006, p.885−897.

[2] Ortalo R, Deswarte Y and Kaâniche M., Experimenting with quantitative evaluation tools for monitoring operational security, IEEE Trans. on Software Engineering, Vol. 25, No. 5, 1999, p.633−651.

DOI: 10.1109/32.815323

[3] Wei Y and Lian YF, A Network Security Situational Awareness Model Based on Log Audit and Performance Correction, Chinese Journal of Computers, Vol. 32, No. 4, 2009, p.763–771.

DOI: 10.3724/sp.j.1016.2009.00763

[4] Feng DG, Zhang Y and Zhang YQ, Survey of information security risk assessment, Journal of China Institute of Communications, Vol. 25, No. 7, 2009, p.10−18.

[5] Lakkaraju K, Yurcik W and Lee AJ, NVisionIP: NetFlow visualizations of system state for security situational awareness, Proc. of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, 2004, p.65− 72.

DOI: 10.1145/1029208.1029219

[6] Liu BX, Wei L and Xu RS, Design and implementation of multi-source log collect system based on agent technology, Computer System and Application, Vol. 2, 2008, pp.71-74.