Abstract
Network Security Situation Awareness (NSSA) is a security theory which can perceive the network threat from a global perspective. In this paper, we present a Cognitive Awareness-Control Model (CACM) for NSSA. CACM adopts the cross-layer architecture and cognitive circle which can break through the interactive barrier between different network layers. Firstly, we propose a decision-level fusion method in which different weights are assigned for different data sources so that the fusion accuracy can be improved. Secondly, a hierarchical quantification approach is discussed which can avoid inferring the complex memberships among network components. Finally, a cognitive regulation mechanism is analysed in order to solve the issue of automatic control. The simulation experiments show that our model can perceive and regulate the threat situation effectively. To the best of our knowledge, this is the first discussion which utilizes cognitive awareness-control to solve the regulation problem of NSSA.
1. Introduction
Network technology becomes an indispensable part of politics and economy either globally or locally. It has reached a higher level than ever before in serving national security and interests. However, due to the heterogeneity, the complexity and the continuous expansion of the scale in current network system, traditional network security techniques are short of adaptability and effective coordination to deal with the network security problems. This results in heavy economic losses, bad social effect and fatal security accidents. Network Security Situation Awareness (NSSA) meets the demands of network system and is regarded as one of the solutions to face the security challenges. It can fuse the alerts acquired from multiple security data sources and perceive the security threat in a real-time manner.
8. Conclusion and future work
NSSA has become a novel technology in defending the networks from being compromised. Through analyzing the model, the fusion algorithm, the awareness method and the cognitive computing, we come to the conclusion that the research on NSSA is pushing ahead form awareness to awareness-control. In the framework of CACM, we proposed our heterogeneous multi-source fusion algorithm, hierarchical awareness method and HS-QRL mechanism to deal with the problem of cognitive awareness-control. We examined our model and validated the effectiveness and feasibility of the proposed methods througha series of simulation experiments. The results show that the model and the methods can perceive the evolution trends of the security situation and possess the favorable cognitive ability by constructing a closed feedback circle. This study has achieved the purpose of autonomous awareness-control which can be used for promoting the security level and providing a new approach to resisting against the attacks aiming at the monitored network.
