基于粗糙集的网络安全态势要素提取研究

发布时间：2018-02-26 12:47

本文关键词： 网络安全态势感知态势提取粗糙集属性约简并行约简　出处：《河北师范大学》2017年硕士论文　论文类型：学位论文

【摘要】：先进技术推动互联网行业迅速发展,人们生活得到便利的同时不可避免的被网络安全问题困扰。现有的网络安全产品以被动防御为主,为了更好的应对复杂多变的网络攻击,网络安全态势感知技术作为一种主动的网络安全防御技术应运而生,通过态势提取、态势评估及态势预测三个过程保障网络安全。态势要素提取技术是态势感知的基础,直接影响态势评估与预测的结果。本文以网络安全态势感知为应用背景,深入研究了适用于网络态势要素的提取方法。建立了基于粗糙集的态势要素提取模型及计算方法,用于提高态势要素提取的准确性,从而为网络工作者进行态势评估与预测提供更可靠的决策依据。主要工作包括以下几个部分:(1)探究构建态势要素提取模型归纳总结了网络安全态势感知技术与态势要素提取技术的相关概念,态势要素提取是整个态势感知过程的前提,态势要素质量至关重要,因此本文根据态势要素信息特点重新定义了态势要素提取的要求,构建出基于粗糙集的网络安全态势要素提取模型。(2)提出基于并行约简的态势要素提取方法态势要素原始数据具有数据量大且动态更新速度快的特点,传统约简算法不能应对态势要素数据约简要求,为解决这一问题本文提出一种基于并行约简的态势要素提取方法,在保证分类不受影响的情况下,将单个决策信息表扩展到多个,利用条件熵构造属性重要度矩阵,根据定义的并行约简规则删除冗余属性,从而实现对态势要素数据的精简与缩维,通过实例具体阐述了算法的具体流程。(3)提出基于邻域粗糙集的态势要素提取方法现实中的态势要素原始数据往往是多种数据类型并存的,通过离散化处理极容易影响态势要素的信息质量,为解决这一问题,本文提出一种基于邻域粗糙集的态势要素提取方法,该方法用邻域关系替代等价关系,可以直接处理连续型数据,从而避免数据类型转换过程中造成的数据信息丢失,同时为减少因人为设定邻域半径而导致的误差,本文采用标准差阈值集作为邻域划分标准,有效避免了人为操作对结果的影响,从而保障了态势要素提取的准确度。(4)验证态势要素提取方法的有效性针对本文提出的基于并行约简的态势要素提取方法与基于邻域粗糙集的态势要素提取方法分别进行仿真实验,选用网络安全数据集NSL-KDD进行测试,实验结果表明经过本文所提出的算法约简后的数据集相比原数据集进行攻击类型识别时在保证分类正确率不变的情况下分类建模时间明显缩短,相比其他约简算法具有较高的召回率和较低的误警率,从而有效证明本文所提算法在网络安全态势要素提取方面具有良好的性能。
[Abstract]:Advanced technology promotes the rapid development of the Internet industry, and people's lives are facilitated and inevitably troubled by network security problems. The existing network security products are mainly passive defense, in order to better deal with complex and changeable network attacks. As an active network security defense technology, network security situational awareness (NSA) technology is the foundation of situational awareness, which is based on the three processes of situation extraction, situation assessment and situation prediction. In this paper, based on the application background of network security situation awareness, the extraction method suitable for network situation elements is deeply studied. A rough set based situation factor extraction model and its calculation method are established. To improve the accuracy of situational element extraction, The main work includes the following parts: 1) explore and build the situation factor extraction model, summarize the network security situation awareness technology and state. Related concepts of potential factor extraction technology, The extraction of situational elements is the premise of the whole process of situational awareness, and the quality of situational elements is very important, so this paper redefines the requirements of extracting situational elements according to the characteristics of the information of situational elements. In this paper, a rough set based model for extracting network security situation elements is constructed. (2) A parallel reduction based approach for extracting situation elements is proposed. The original data of situation elements has the characteristics of large amount of data and fast dynamic updating speed. Traditional reduction algorithm can not meet the requirement of data reduction of situational elements. In order to solve this problem, this paper proposes a method of extracting situational elements based on parallel reduction, which can ensure that classification is not affected. In this paper, a single decision information table is extended to several, and the attribute importance matrix is constructed by using conditional entropy, and the redundant attributes are deleted according to the defined parallel reduction rules, so that the data of situation elements can be reduced and reduced. This paper expounds the concrete flow of the algorithm through an example. It puts forward a method of extracting situational elements based on neighborhood rough set. In reality, the original data of situational elements often coexist with many kinds of data types. It is easy to affect the information quality of situational elements by discretization. In order to solve this problem, a method of extracting situational elements based on neighborhood rough set is proposed in this paper, in which the equivalent relationship is replaced by neighborhood relation. In order to reduce the error caused by artificial setting neighborhood radius, the standard deviation threshold set is used as the neighborhood partition standard in order to avoid the loss of data information caused by the conversion of data types directly, so as to reduce the error caused by the artificial setting of neighborhood radius. It effectively avoids the effect of artificial operation on the result. Therefore, the accuracy of situational element extraction is guaranteed. 4) to verify the validity of the method of situational element extraction. In this paper, the method of situational element extraction based on parallel reduction and the method based on neighborhood rough set are proposed. Don't do the simulation, The network security data set NSL-KDD is selected to test, The experimental results show that the proposed algorithm can shorten the modeling time of classification when compared with the original data set when the classification accuracy is invariable. Compared with other reduction algorithms, the proposed algorithm has higher recall rate and lower false alarm rate, which effectively proves that the proposed algorithm has good performance in network security situation extraction.
【学位授予单位】：河北师范大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08;TP18

【相似文献】