Research on Network Security Situation Awareness Based on the LSTM-DT Model

• Published in: Sensors (Basel, Switzerland) Vol. 21; no. 14; p. 4788
• Main Authors: Zhang, Haofang, Kang, Chunying, Xiao, Yao
• Format: Journal Article
• Language: English
• Published: Basel MDPI AG 13.07.2021; MDPI
• Subjects: Accuracy; Algorithms; Analytic hierarchy process; Artificial intelligence; Datasets; decision tree; Indicators; long short-term memory network; Malware; network security situation assessment; Neural networks; Risk assessment; Situational awareness; Sparsity; stack sparse auto-encoder; China
• ISSN: 1424-8220; 1424-8220
• DOI: 10.3390/s21144788

To better understand the behavior of attackers and describe the network state, we construct an LSTM-DT model for network security situation awareness, which provides risk assessment indicators and quantitative methods. This paper introduces the concept of attack probability, making prediction results more consistent with the actual network situation. The model is focused on the problem of the time sequence of network security situation assessment by using the decision tree algorithm (DT) and long short-term memory(LSTM) network. The biggest innovation of this paper is to change the description of the network situation in the original dataset. The original label only has attack and normal. We put forward a new idea which regards attack as a possibility, obtaining the probability of each attack, and describing the network situation by combining the occurrence probability and attack impact. Firstly, we determine the network risk assessment indicators through the dataset feature distribution, and we give the network risk assessment index a corresponding weight based on the analytic hierarchy process (AHP). Then, the stack sparse auto-encoder (SSAE) is used to learn the characteristics of the original dataset. The attack probability can be predicted by the processed dataset by using the LSTM network. At the same time, the DT algorithm is applied to identify attack types. Finally, we draw the corresponding curve according to the network security situation value at each time. Experiments show that the accuracy of the network situation awareness method proposed in this paper can reach 95%, and the accuracy of attack recognition can reach 87%. Compared with the former research results, the effect is better in describing complex network environment problems.