基于融合的网络安全态势量化感知  

Quantitative awareness of network security situation based on fusion

作　　者：刘效武[1] 王慧强[2] 吕宏武[2] 安述照 

机构地区：[1]曲阜师范大学计算机科学学院,山东日照276826 [2]哈尔滨工程大学计算机科学与技术学院,哈尔滨150001 [3]青岛酒店管理学院信息工程技术系,山东青岛266100

出　　处：《吉林大学学报（工学版）》2013年第6期1650-1657,共8页Journal of Jilin University:Engineering and Technology Edition

基　　金：国家自然科学基金重大研究计划项目(90718003);山东省高等学校科技计划项目(J11LG09);曲阜师范大学青年基金项目(XJ201025)

摘　　要：为了解决网络安全态势感知的多源融合和量化感知问题,利用粒子群寻优的方式对D-S证据融合的不同信度数据源赋予不同融合权值,实现多源融合。在融合的基础上,对正态分布进行离散化处理,推导出具有环境适应能力的威胁因子获取方法,实现态势要素提取,并结合要素量化,最终提出公式化的网络安全态势量化感知方法,生成服务级、主机级和网络系统级的态势演化曲线。仿真实验表明:本文提出的融合方法能提高检测率,减低误警率,形式公式化的量化感知方法能够感知威胁状况的动态变化情况,达到了有效监控网络的目的。In order to solve the problems of multi-source fusion and quantitative awareness in the network security situation awareness, the particle swarm optimization is applied to search the exponent weight for different reliability data source for the D-S evidence fusion, and the multi-source fusion was obtained. Based on the fusion, the threaten gene acquisition method with adaptability was studied through the discretization to normal distribution, and the situation factor extraction was accomplished. According to the fusion and factor extraction, a formal network security situation awareness method was proposed. This method could generate service, host and network system level situation evolution curves. Simulation experiments show that the proposed fusion method can increase the detection rate and decrease the false detection rate. The formal quantitative method is able to be aware of the dynamic change of the threat and meets the goal of monitoring the network in an effective manner.

关 键 词：计算机应用 网络安全态势感知 多源融合 量化感知 

分 类 号：TP393.4[自动化与计算机技术—计算机应用技术]