A Novel and Practical Method for Network Security Situation Prediction

Abstract:

The real-time prediction of network security situation can significantly improve the monitoring and emergency response capability of the network. However, in practice, if there are a large amount of false predictions, the network administrators should become insensitive and will finally ignore all prediction results. In this paper, we try to solve this issue and propose a novel False Positive Adaptive (FPA) method for network security situation prediction. The main idea of our method is using extra information to reduce the number of false positives in prediction. In the model training step, we take advantage of host and network information to eliminate meaningless alerts produced by security tools such as Intrusion Detection System (IDS) and firewall, thus assuring the accuracy of the training samples. In the prediction step, we utilize the detection information from security tools to confirm the prediction results automatically. If the previous predictions are not detected, they will be considered as false positives and the prediction model will be retrained by incremental learning. In our work, the model training and incremental learning is accomplished efficiently by neural network and boosting algorithm.

• Periodical: Applied Mechanics and Materials (Volumes 701-702)
• Pages: 907-910
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.701-702.907
• Online since: December 2014
• Authors: Gao Feng He*, Tao Zhang, Yuan Yuan Ma, Xiao Juan Guan
• Keywords: Boosting Algorithm, Incremental Learning, Network Security Situation Prediction, Threat Confirmation

References

[1] Lingyu Wang, S Jajodia, A Singhal, Pengsu Cheng, S. Noel, K-Zero Day Safety: A Network Security Metric for Measuring the Risk of Unknown Vulnerabilities, IEEE Transactions on Dependable and Secure Computing, vol. 11, no. 1, 2014, pp.30-44.

DOI: 10.1109/tdsc.2013.24

[2] M. R. Endsley, Design and evaluation for situation awareness enhancement, In Proceedings of the Human Factors Society 32nd Annual Meeting, Santa Monica, CA, 1988, pp.97-101.

DOI: 10.1177/154193128803200221

[3] Xiuzhen Chen, Qinghua Zheng, Quantitative Hierarchical Threat Evaluation Model for Network Security, Journal of Software, Vol. 17, No. 4, April 2006, pp.885-897.

[4] A A Cain, D Schuster, Measurement of situation awareness among diverse agents in cyber security, 2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support (CogSIMA), 2014: 124-129.

DOI: 10.1109/cogsima.2014.6816551

[5] Wei Ren, RBFNN-based Prediction of Networks Security Situation, Computer Engineering and Applications, 2006, pp.136-139.

[6] Zongming Lin, Guolong Chen, Wenzhong Guo and Yanhua Liu, PSO-BPNN-based Prediction of Network Security Situation, The 3rd International Conference on Innovative Computing Information and Control, 2008, pp.37-41.

DOI: 10.1109/icicic.2008.436

[7] Jingsong Xu, Qiang Wu, Jian Zhang, Fumin Shen and Zhenmin Tang, Boosting Separability in Semisupervised Learning for Object Classification, IEEE Transactions on Circuits and Systems for Video Technology, 2014, 24(7): 1197-1208.

DOI: 10.1109/tcsvt.2014.2302518