A Hierarchical P2P Model and a Data Fusion Method for Network Security Situation Awareness System  

作　　者：GUO Fangfang HU Yibing XIU Longting FENG Guangsheng WANG Shuaishuai 

机构地区：[1]Computer Science and Technology Department,Harbin Engineering University

出　　处：《Wuhan University Journal of Natural Sciences》2016年第2期126-132,共7页武汉大学学报（自然科学英文版）

基　　金：Supported by the National Natural Science Foundation of China(61370212);the Research Fund for the Doctoral Program of Higher Education of China(20122304130002);the Natural Science Foundation of Heilongjiang Province(ZD 201102);the Fundamental Research Fund for the Central Universities(HEUCFZ1213,HEUCF100601)

摘　　要：A hierarchical peer-to-peer（P2P）model and a data fusion method for network security situation awareness system are proposed to improve the efficiency of distributed security behavior monitoring network.The single point failure of data analysis nodes is avoided by this P2P model,in which a greedy data forwarding method based on node priority and link delay is devised to promote the efficiency of data analysis nodes.And the data fusion method based on repulsive theory-Dumpster/Shafer（PSORT-DS）is used to deal with the challenge of multi-source alarm information.This data fusion method debases the false alarm rate.Compared with improved Dumpster/Shafer（DS）theoretical method based on particle swarm optimization（PSO）and classical DS evidence theoretical method,the proposed model reduces false alarm rate by 3%and 7%,respectively,whereas their detection rate increases by 4%and 16%,respectively.A hierarchical peer-to-peer（P2P）model and a data fusion method for network security situation awareness system are proposed to improve the efficiency of distributed security behavior monitoring network.The single point failure of data analysis nodes is avoided by this P2P model,in which a greedy data forwarding method based on node priority and link delay is devised to promote the efficiency of data analysis nodes.And the data fusion method based on repulsive theory-Dumpster/Shafer（PSORT-DS）is used to deal with the challenge of multi-source alarm information.This data fusion method debases the false alarm rate.Compared with improved Dumpster/Shafer（DS）theoretical method based on particle swarm optimization（PSO）and classical DS evidence theoretical method,the proposed model reduces false alarm rate by 3%and 7%,respectively,whereas their detection rate increases by 4%and 16%,respectively.

关 键 词：distributed security behavior monitoring peer-to- peer （P2P） data fusion DS evidence theory PSO algorithm 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]