摘要
网络安全态势感知不同于传统的安全措施,它可以对网络中各种活动的行为进行辨识,从宏观的角度进行意图理解和影响评估,进而提供合理的决策支持,在提高网络的监控能力、应急响应能力及预测网络安全的发展趋势等方面都具有重要的意义。分别对态势感知和网络安全态势感知的定义进行了归纳梳理,对经典的态势感知模型和新发展的网络安全态势感知模型进行了总结与对比;介绍了网络安全态势感知的关键技术,主要分为基于层次化分析、机器学习、免疫系统和博弈论的技术;介绍了近年来网络安全态势感知在因特网、工控网和物联网中的应用;对其未来发展趋势和待解决的问题进行了总结与展望。
Different from traditional security measures,network security situation awareness can identify the behavior of various activities in the network and conduct intent understanding and impact assessment from a macro perspective so as to provide reasonable decision support.It has great significance in improving network monitoring capabilities,emergency response capabilities,and predicting the development trend of network security.This paper first separately generalizes the definitions of situation awareness and network security situation awareness,and then sorts out the classical and newly developed system models.It introduces the key technologies of network security situation awareness,which is mainly divided into hierarchical analysis,machine learning,immune system and game theory.Then the latest application of network security situation awareness in Internet,industrial control network and Internet of Things are explained.It summarizes and forecasts the future development trends and problems that need to be solved.
作者
石乐义
刘佳
刘祎豪
朱红强
段鹏飞
SHI Leyi;LIU Jia;LIU Yihao;ZHU Hongqiang;DUAN Pengfei(College of Computer and Communication of Engineering,China University of Petroleum,Qingdao,Shandong 266580,China)
出处
《计算机工程与应用》
CSCD
北大核心
2019年第24期1-9,共9页
Computer Engineering and Applications
基金
山东省自然科学基金(No.ZR2019MF034)
国家自然科学基金(No.61772551)
关键词
网络安全
态势感知
数据融合
态势评估
态势预测
network security
situation awareness
data fusion
situation assessment
situation prediction