Cyber Security Situation Awareness Based on Data Mining

Abstract:

Situation awareness is a kind of the third generation of information security technology, which aims to provide the global security views of the cyberspace for administrators. A framework of cyber security situation awareness based on data mining is proposed in this paper. The framework can be viewed from two perspectives, one is data flow, which presents the abstracting of cyber data, and the other one is logic view, which presents the procedure of situation awareness. The frameworks core component is correlation state machine, which is an extension of state machine. The correlation state machine is a data structure of achieving situation awareness, which is created based on the technology of data mining. After being created, it can be used to assess and predict the threat situation to achieve cyber knowledge. We conclude with an example of how the framework can be applied to real world to provide cyber security situation for administrators.

• Periodical: Advanced Materials Research (Volumes 756-759)
• Pages: 4336-4342
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.756-759.4336
• Online since: September 2013
• Authors: Jie Liu, Xue Wei Feng, Jin Li, Dong Xia Wang
• Keywords: Correlation State Machine, Cyber Security, Situation Awareness, Threat Assessment, Threat Prediction

References

[1] Bass T. Multi-Sensor Data Fusion for next Generation Distributed Intrusion Detection Systems [C]. 1999 IRIS National Symposium on Sensor and Data Fusion, Laurel, USA, 1999(1): 24-27.

[2] Bass T. Intrusion Detection Systems and Multi-Sensor Data Fusion: Creating Cyberspace Situation Awareness [J]. Communications of the ACM, 2000, 43(4): 99-105.

[3] Feng Xuewei, Wang Dongxia. A Framework of Network Security Situation Analysis Based on the Technologies of Event Correlation and Situation Assessment. 2011 International workshop on Frontiers of Secure Networks.

DOI: 10.1109/imis.2011.43

[4] Wang Huiqiang, Lai Jibao, Hu Mingming. Research on the key implement technology of network security situation awareness[J]. Geomatics and Information Science of Wuhan University. 2008, Vol. 33 No. 10 (in Chinese).

[5] Wang Yanbo, Wang Huiqiang, Wang Xiufeng, Yu Ming. Design of multi-source and heterogeneous log sensor for network situational awareness. Transducer and Microsystem Technologies. 2010. Vol. 29 No. 3 (in Chinese).

DOI: 10.1109/iccsit.2010.5564777

[6] Liu Xin, Wang Xiaoqiang, Zhu Peidong, Peng Yuxing. Security Evaluation for Inter-Domain Routing System in the Internet[J]. Journal of Computer Research and Development. 2009. 46(10): 1669-1677 (in Chinese).

[7] Feng Xuewei, Wang Dongxia. Analyzing and Correlating Security Events Using State Machine. 2010 International workshop on Frontiers of Secure Networks.

DOI: 10.1109/cit.2010.476

[8] Liu Nian, Liu Sunjun, Liu Yong, Zhao Hui. Method of Network Security Situation Awareness Based on Artificial Immunity System[J]. Computer Science. 2010. Vol. 37 No. 1 (in Chinese).

[9] Gorodetsky V, Karsaev O, Samoilov V. On-line update of situation assessment based on asynchronous data streams[C] /Knowledge-Based Intelligent Information and Engineering Systems. Berlin/Heidelberg: Springer，2004：1136-1142.

DOI: 10.1007/978-3-540-30132-5_154

[10] Chen Xiuzhen，Zhen Qinghua，Guan Xiaohong，et al. Quantitative hierarchical threat evaluation model for network security[J]. Jouranl of Software，2006，17(4)：885－897 (in Chinese).

[11] Yegneswaran V, Barford P, Paxson V. Using Honeynets for Internet situation awareness [C/OL] /Pro of ACM/ USENIX Hotnets IV. 2005[2008-01-12]. http: /www. icir. org/vern/papers/sit-aware-hotnet05. pdf.

[12] GENSHE CHEN DAN SHEN CHIMAN KWAN . Game Theoretic Approach to Threat Prediction and Situation Awareness. JOURNAL OF ADVANCES IN INFORMATION FUSION VOL. 2, NO. 1 JUNE (2007).

DOI: 10.1109/icif.2006.301670

[13] Zhang Yong, Network Security Situation Awareness Model Research and System Implementation. A dissertation for doctor' s degree. University of Science and Technology of China. 2010. 5.