# Network Security Situation Assessment Model Based on Extended Hidden Markov

Authors: Yiwei Liao; Guosheng Zhao; Jian Wang; Shu Li
Journal: Mathematical Problems in Engineering
 (2020)

---

## Abstract

A network security situation assessment system based on the extended hidden Markov model is designed in this paper. Firstly, the standard hidden Markov model is expanded from five-tuple to seven-tuple, and two parameters of network defense efficiency and risk loss vector are added so that the model can describe network security situation more completely. Then, an initial algorithm of state transition matrix was defined, observation vectors were extracted from the fusion of various system security detection data, the network state transition matrix was created and modified by the observation vectors, and a solution procedure of the hidden state probability distribution sequence based on extended hidden Markov model was derived. Finally, a method of calculating risk loss vector according to the international definition was designed and the current network risk value was calculated by the hidden state probability distribution; then the global security situation was assessed. The experiment showed that the model satisfied practical applications and the assessment result is accurate and effective.


---

## Body

## 1. Introduction

With the widespread use of Internet technology, network security has gradually attracted public attention. Attacks on the network are increasingly complex although the defense measures based on the intrusion detection [1], firewall [2], virus prevention, and others have been formed, but it is also more and more difficult to get effective information and take effective emergency measures because the alarm information is too large. For example, IDS alarm data is enormous, false alarm and omission often happened, it is difficult to grasp the network security situation, and these traditional security means focus on the solution of unilateral security problems; how to grasp the current network situation accurately has become the hot topic in the field of Internet [3]. Network security situation assessment technology considers security elements comprehensively, reflects network states constantly, accurately predicts potential threats, and helps network administrators take effective measures [4].Situation awareness technology was first used in the military field [5], and now it is widely used in aviation, transportation, network, medical emergency, and many other areas [6]. In 1988, Endsley firstly proposed the concept of situation awareness [7]; then, Bass proposed the concept of network situation awareness, which includes element extraction, situation understanding and situation assessment, and other contents and gave the concept of network situation awareness model [8]; Lakkaraju et al. got data mining technology as a network situation awareness of the key technologies [9]; Elshoush fused the elements which were extracted by data mining technology and used the fusion into intrusion detection, but it was difficult to avoid false alarm because of its huge number of data [10, 11].The research of network security situation assessment started late at home. Wei et al. proposed a network security situation assessment model based on information fusion, which used the improved D-S evidence theory to fuse multisource information [12], but this method was prone to have evidence conflicted. Chen et al. proposed a quantitative hierarchical threat evaluation model for network security, which started threat calculation from the bottom [13], but the method was too subjective, and the accuracy was not enough. Xi proposed a situation assessment method based on the attack graph method, which used the network topology and attack targets to construct the attack path, but this method was prone to the state space combination explosion problem [14]. Zhu et al. proposed the evaluation method based on honeynets, which used honeynets to collect intrusion behavior and draw the curve of the situation, but this method is only aimed at the intrusion behavior, and its data source was single [15].Through the analysis of the network security situation assessment model at home and abroad, it is found that there are still many problems in the study of network security situation assessment: the state transition matrix is generally obtained by the experience of administrators, with strong subjectivity, and it is influenced by the administrator’s own ability; secondly, due to the lack of two parameters of network defense capability and risk loss, it is easy to lead to the calculation deviation of the hidden state vector sequence in the evaluation model when the observation vector sequence is generated. In this paper, we propose an improved Hidden Markov Model, which extends the five-tuple to seven-tuple in the traditional hidden Markov model and obtains a new model called HMM-Plus, or HMMP for short. The system fuses a variety of security detection data, extracts the main attack logs from the network security equipment to form the observation vector sequence, then corrects state transition matrix by the real-time state, forms the hidden state probability distribution sequence by using the improved Viterbi algorithm, finally, combines the network topology and the network asset information with the hidden state probability distribution to calculate the current network risk value, and then assesses the global security situation of the current network, making the analysis and processing ability of network security products improved to a great extent in multiple index.


## 2. Network Security Situation Assessment Technology

Network security situation assessment model [16] refers to the factors which affect the network security situation and the relationship between them. Threat sources include hostile network or physical attacks; negligent or intentional man-made errors; and natural or man-made disasters. Once the threat event occurs, it will lead to unauthorized disclosure of information; modification of information; damage of information; or loss of confidentiality, integrity, and availability of information systems. From the above, we can see that risk is a function between the probability of occurrence of a threat and the harm it caused.Information system assessment aims to understand the current and future risks of the system; assess the potential threats and the extent of the harm caused by these risks; and provide the basis for security decision-making, information system construction, and safe operation. Information system assessment process [17] is mainly divided into 4 steps: the first step is to prepare the assessment; the second to execute assessment; the third to feedback the evaluate result; and the fourth to maintain the assessment, as shown in Figure 1.Figure 1
Information system assessment process.


## 3. Network Security Situation Assessment Model Based on HMMP

Before introducing the HMMP model, let us first introduce the hidden Markov model (HMM). For HMM, we assume thatS is a set of all possible hidden states and V is a set of all possible observed states, which satisfy S = {s1, s2, …, sN}, V=v1,v2,…,vM, where N is the number of possible hidden states and M is all possible observed states.For a sequence with lengthT, I corresponds to a sequence of states and O to a sequence of observations, which satisfies I = {i1, i2, …, iT}, O = {o1, o2, …, oT}, where it∈S, ot∈V.The HMM model has two important assumptions:(1)
The hypothesis of homogeneous Markov chain: the hidden state at any time only depends on its previous hidden state. The advantage of this assumption is that the model is simple and easy to solve. If the hidden state at timet is it = si and the hidden state at time t + 1 is it+1 = sj, then the state transition probability pij from time t to t + 1 can be expressed as(1)pij=Pit+1=sjit=si.So,aij can form the state transition matrix P of Markov chain:(2)P=pijN×N.(2)
The hypothesis of observational independence: the observed state at any time depends only on the hidden state at the current time. If the hidden state at timet is it = sj and the corresponding observed state is ot=vk, then the probability qjvk generated by the observed state vk under the hidden state sj at time t satisfies(3)qjvk=Pot=vkit=sj.So,qjvk can constitute the probability matrix Q generated by the observed state:(4)Q=qjvkN×M.In addition, we need a set of initial hidden state probability distribution II at timet = 1:(5)∏=πiN,whereπi=Pi1=si.A HMM model can be determined by initial hidden state probability distribution II, state transition probability matrixP, and observed state probability matrix Q. II and P determine the state sequence and Q determines the observation sequence. Therefore, the HMM model can be represented by a five-tuple as follows: λ=S,V,P,Q,∏.


### 3.1. HMMP Model

It is currently a hot topic to extend the traditional HMM model to carry out research in related fields [18, 19]. The standard HMM model consists of five-tuple λ=S,V,P,Q,∏. In this paper, we expand it to seven-tuple λ=S,V,P,Q,∏,F,C, called HMM-Plus model, or HMMP for short, in which two parameters of network defense efficiency and risk loss vector are added to make it possible to describe the network security situation better.(1)
S, hidden state set space, S=s1,s2,…,sn, indicates all the hidden states that the system may be in; there are N hidden states. In this paper, the network hidden state is divided into Safe State G, Probe State P, Attack State A, and Compromise State C according to practical demand. Here, we can set s1 = G, s2 = P, s3 = A, and s4 = C.(i)
Safe StateG (good) indicates that the host or network is not attacked.(ii)
Probe StateP (probed) indicates that the host or network is being probed or scanned.(iii)
Attack StateA (attacked) host or network is being attacked by one or more objects.(iv)
Compromise StateC (compromised) indicates that the network or host has been compromised.(2)
V, observation vector set space, v1,v2,…,vi,…,vM, represents all possible observation vectors; there are M state observation vector values. According to the practical demand, the network security equipment logs are divided into the following categories:(i)
Compromise log: this type of log indicates that a successful attacker gains the administrator privileges.(ii)
Scan log: this type indicates that the system has been scanned.(iii)
Attack log: this type of log indicates that the system has been attacked.(iv)
No log: no network security equipment logs on the network.(v)
Suspicious log: the logs are not classified correctly.(3)
P, hidden state transition matrix, denotes the transition probability between the hidden states of system P = {pij}, pij=Pit+1=sjit=si, 0≤i,j≤N, it means the network is in a hidden state si at time t, and it+1 means the network is in a hidden state sj at time t + 1.(4)
Q, observation vector probability distribution matrix, Q=qivk, qivk=Pot=vkit=si indicates the probability of observing the network security equipment log Sei=Gj,βij,j=1,…,M,i=1,…,N in the hidden state βij.(5)
∏, initial hidden state probability distribution matrix, ∏=πiN, where πi=Pi1=si; 1 ≤ i ≤ N means the probability that the network is in the state Gj at the initial moment.(6)
F, current network defense efficiency, indicates the efficiency of defense efficiency of the current network state, 0≤F≤1. The higher the F, the better the network defense capability.(7)
C, risk loss vector, ∑j=1Mβij≤1, ∑j=1Mβij=1 indicates the risk value that the system faces when the network is in the state T.


### 3.2. Primary Generation of State Transition Matrix

This section mainly introduces the initial algorithm of hidden state transition matrix; this algorithm is different from the traditional algorithm, which is based on expertise. It is through the game theory to assess the transformational relation between hidden states and ultimately determine an initial state transition matrix.The hidden state transition model is shown in Figure2.Figure 2
Hidden state transition model.These circles represent the system state; according to the definition of this model, there are four hidden states: Safe StateG, Probe State P, Attack State A, and Compromise State C. E represents the security events that may occur in the network; D indicates the defense measures in the network. Assuming that the current network has security measures Dj and the hidden state is si, if there is a security event Ej in the network at this moment, the network will enter the hidden state sj at the next time. The process can be expressed as(6)si⟶Ej∨Djsj,si,sj∈G,P,A,C.When the current state issi, the hidden state transition can be described by the following E×D matrix, as shown in Table 1.Table 1
The attack and defense game matrix under the security statesi.
E1…EmD1sj…sk…………Dnso…spE1 to Em indicate security events; D1 to Dn indicate network defense measures; and sj indicates that when the network state is si, if the network defense measure is D1, the network state will be transferred to sj when E1 security event occurs. Similarly, so indicates that when the network state is si, if the network defense measure is Dn, the network state will be transferred to so when E1 security event occurs.The distribution of Safe State transitions can be seen intuitively from the matrixE×D. The probability of state from si to sj is(7)Pij=psi⟶sjEj∨Dj=sj∑sk∈Ssk.The Safe State transition vectorPi=siG,siP,siA,siC can be obtained when the current state is si.Establishing state transition matrix for all states which aresi of the current network severally, then we can get the initial transition matrix:(8)P=PGGPGPPGAPGCPPGPPPPPAPPCPAGPAPPAAPACPCGPCPPCAPCC.


### 3.3. Network State Transfer Matrix Modification Based on Defense Efficiency

Network security equipment defense efficiency refers to the network defense equipment and network basal equipment due to its high load or being attacked or other reasons and the availability is destroyed and cannot provide sufficient defense efficiency or external service. In order to assess the network security equipment defense efficiency, select the following factors: number of connections, bandwidth utilization, CPU utilization, and memory utilization.The quantification of the above situation assessment factors is mainly carried out according to the following steps:(1)
Establish hierarchy structure:It is done by analyzing the relationship among network efficiency and CPU utilization, memory utilization, network bandwidth utilization, and the number of connections, to establish the following two layers of structure, as shown in Figure3.(2)
Construct judgment matrix and assign value:Assuming that the network bandwidth utilization is more important than the number of connections, the score is 3. In contrast, the number of connections for network bandwidth utilization is 0.3333333. Memory utilization and CPU utilization are equally important to the number of connections, which can be scored as 2. So, we can build a judgment matrix as shown in Table2, in which the data are for illustrative purposes only.Figure 3
Hierarchy structure of network equipment defense efficiency.Table 2
Network equipment defense efficiency judgment matrix.
ItemNumber of connectionsBandwidth utilizationMemory utilizationCPU utilizationNumber of connections11/31/21/2Bandwidth utilization3122Memory utilization21/212CPU utilization21/21/21(3)
Weight calculation and consistency test:Using the SPSSAU online analysis tool, the analysis results are shown in Table3. Here, we can also obtain the weight vector wi by using the arithmetic mean method according to the following formula:(9)wi=1n∑j=1naij∑k=1nakj,1≤i,j≤4,whereaij is the comparison score of the judgment matrix.Table 3
AHP analysis results.
ItemEigenvectorWeight value (%)The largest eigenvalueCIRICRNumber of connections0.48412.0944.0710.0240.9000.026Bandwidth utilization1.66741.680Memory utilization1.07826.948CPU utilization0.77119.278Here, CR = CI/RI, the CI value has been obtained when evaluating the eigenvector, and the RI value is directly obtained by looking up the table, and the corresponding CR value is 0.026. SPSSAU prints this result directly, as well as consistency tests.Now, the weights have been calculated and the judgment matrix satisfies the consistency test. Then, the overall defense efficiencyF of the current network is calculated according to the following formula:(10)Ft=∑i=1nftiwi,whereft represents the normalized standard value of indicator i at the current time t.(4)
In the current period, the average state of each index is used to measure the defense efficiency of the current period.(5)
The probability of successful attack is different due to the different defense efficiency, so the state transition matrix is inconsistent under different conditions. Now, the modified vectorγt⟶ is introduced, γt⟶=γ1t,…,γjt,…,γNtT, and j indicates the hidden state of the system:(11)γjt=Ft,Ot=G,1Ft,Ot=A,C.(6)
The probability transfer matrixPt is modified according to the modified vector γt⟶, Pt=pijt, Pt is a matrix of N×N, and(12)pijt=pij×γit.


### 3.4. Solution of Network Hidden State Sequence Based on Improved Viterbi Algorithm

Viterbi algorithm is a dynamic programming algorithm, usually used to find the hidden state sequence which is most likely to produce observed event sequence from the hidden Markov model [20]. In this paper, the probability distributions of hidden states of the system every time in HMMP are obtained according to the idea of Viterbi algorithm. The solution procedure is as follows.For the network security situation assessment modelλ=S,V,P,Q,∏,F,C, suppose the observation vector sequence is Y=y1,…,yt,…,yT. Take the first observation as y1, and the calculation method of γ1i in the initial state is as follows:(13)α1si=Px1=siy1,λ,where α1si represents the probability of the system in the state si at time t = 1 (i.e., the initial time). Px1=siy1,λ represents the probability of the system in the state si when y1 can be observed from the sequence of observed vectors and the model’s parameter is λ.Conditional probability formula is derived as follows:(14)Px1=siy1,λ=Py1,x1=siλPy1λ=Py1x1=si,λPx1=siλPy1λ.When the parameter model isλ, the probability of observing y1 is equal to the sum of the product of the probability that y1 can be observed in all states and the probability that the system is in the same state when the parameter model is λ. The derivation is as follows:(15)Py1λ=∑j=1NPy1x1=sj,λPx1=sjλ.By formulas (14) and (15) we can get(16)α1si=Py1x1=si,λPx1=siλ∑j=1NPy1x1=sj,λPx1=sjλ.Substituting the specific parameter modelλ, we can get(17)α1si=qiy1πi∑j=1Nqjy1πj.And then using formula (17) to calculate the probability of the system in each state at the initial time, the system probability matrix at the initial time X1=α1si1×N,si∈S.The exhaustive operand is too large and the recursion method is used in order to simplify the computation of the follow-up state probability vector, assuming at timet, the system probability matrix Xt=αtsi1×N,si∈S. As known, αtsi=Pxt=siy1,y2,…,yt,λ represents the probability of the system in the state si when the parameter model is λ and the observation vector sequence is y1,y2,…,yt. To solve the system state probability matrix Xt+1 at time t + 1,(18)αt+1si=Pxt+1=siy1,y2,…,yt,yt+1,λ,where αt+1si indicates the probability of the system in the state si at time t + 1. Pxt+1=siy1,y2,…,yt,yt+1,λ indicates the probability of the system in the state si at time t + 1 when the parameter model is λ and the observation is yt+1. In the same way,(19)αt+1si=Pyt+1xt+1=si,λPxt+1=siy1,y2,…,yt,λ∑j=1NPyt+1xt+1=sj,λPxt+1=sjy1,y2,…,yt,λ,where Pyt+1x1=si,λ indicates the probability that yt+1 can be observed when the parameter model is λ and the system is in the state si. This probability is qiyt+1 which is from the observation vector probability distribution matrix of model λ. Pxt+1=siy1,y2,…,yt,λ indicates the probability of the system in the state si at time t + 1.Now we only need the probability of the system in the statesi at time t + 1. From the definition of the state transition matrix, we can see that the probability of the system in the state si at time t + 1 is equal to the sum of the product of state probability distribution matrix when the system is at time t and the probability that the system would transfer to state si:(20)Pxt+1=siy1,y2,…,yt,λ=∑sk∈SPxt=sky1,y2,…,yt,λPxt+1=sjxt=sk,λ,where ∑sk∈SPxt=sky1,y2,…,yt,λ indicates the probability that the system is in state Si when the parameter model is λ and the observation vector sequence is y1,y2,…,yt, which is the previously assumed condition αtsi. Pxt+1=sjxt=sk,λ indicates the probability that the system would transfer to state si the next time when the parameter model is λ and the current moment is sk. We can get(21)pkit+1=pki×γkt+1.In order to express convenience, reckonβt+1si=Pxt+1=siy1,y2,…,yt,λ, and then(22)βt+1si=∑si∈Spki·γkt+1·βtsk.Substituting into the formula, we can get(23)αtsi=qiytβtsi∑sj∈Sqjytβtsj.Then, the system state probability distribution at timet + 1 is(24)Xt+1=αt+1si1×N,si∈S.Finally, arranging above all, we can get(25)αtsi=qiy1πi∑j=1Nqjy1πj,t=1,qiytβtsi∑sj∈Sqjytβtsj,t>1.Andβtsi=∑si∈Spki·γkt+1·βt−1sk.


### 3.5. Algorithm Pseudocode Description

From the previous section, we get the steps to solve the system hidden state probability distribution in HMMP as follows:(1)
Judge whether the current observation vector is read; if it is, then jump to step 8; otherwise, enter step 2(2)
Obtain the current observation vectoryt and judge whether the current time is the initial time; if it is, go to step 3; otherwise enter step 5(3)
Calculate the conditional probabilities separately of each hidden state whenyt is observed by the formula α1si=qiy1πi/∑j=1Nqjy1πj.(4)
Convert the conditional probability of each implied state into matrixXt in order and store the final hidden state probability distribution sequence X; then return to step 1(5)
Calculate the system hidden state probability distribution without considering the observation vectoryt by the formula βtsi=∑si∈Spki·γkt+1·βt−1sk.(6)
Calculate the conditional probability of each hidden state whenyt is observed by the formula αtsi=qiytβtsi/∑sj∈Sqjytβtsj.(7)
Convert the conditional probability of each implied state into matrixXt in order, and store the final hidden state probability distribution sequence X; then return to step 1(8)
Output the final hidden state probability distribution sequenceX; then end the program.The pseudocode of Algorithm1 is as follows:Algorithm 1: Algorithm for solving hidden state probability distribution sequence.
Input: modelλ of HMMP, observation vector sequence Y, real-time efficiency sequence FOutput: final hidden state probability distribution sequence(1)
for t = 1 to T do(2)
if t = = 1(3)
for i = 1 to N do(4)
α1si=qiy1πi/∑j=1Nqjy1πj(5)
X←Xt=αtsi1×N,si∈S(6)
repeat(7)
else(8)
for i = 1 to N do(9)
βtsi=∑si∈Spki·γkt+1·βt−1sk(10)
αtsi=qiytπi/∑sj∈Sqjy1βtsj(11)
X←Xt=αtsi1×N,si∈S(12)
repeat(13)
endif(14)
repeat(15)
return X;


### 3.6. Calculation of Risk Loss Vector

According to the national standard definition, the risk is a function between the possibility of the system under attack and the degree of loss when the system is attacked. In the last section, the hidden probability distribution vector sequence is calculated, which is the probability of the system being attacked. Then, the following sections mainly calculate how much loss the system will be in the state, which is called risk loss vector.


#### 3.6.1. Classification of Severity Levels

Risk vector is used to measure the degree of loss of the system in some state.First of all, there is asset evaluation.The three security attributes of asset evaluation are classified as confidentiality, integrity, and availability. According to the national standard GB/T20984, the assets are classified into five levels, and the more important the assets are, the higher the severity level will be.Then, there is severity levels classification.Now, most of the network equipment uses syslog type of log; syslog divides the severity into eight levels, as shown in Table4.Table 4
Severity levels based on syslog.
Severity levelLog description0Urgency: system is not available1Alert: must take measures right now2Important: important condition3Error: error condition4Warning: warn condition5Attention: normal with landmark condition6Information: information message7Debug: debug message


#### 3.6.2. The Current Network State Assessment

Calculate the risk that the current system is facing according to the hidden state distribution probability sequenceX and the loss when the system is in each state. The loss of the current network state can be calculated by the following formula:(26)Rt=∑si∈SγtiCi,and γti indicates the probability that the system is in the state si at time t. Ci indicates the risk that the system will face in the state si.


## 3.1. HMMP Model

It is currently a hot topic to extend the traditional HMM model to carry out research in related fields [18, 19]. The standard HMM model consists of five-tuple λ=S,V,P,Q,∏. In this paper, we expand it to seven-tuple λ=S,V,P,Q,∏,F,C, called HMM-Plus model, or HMMP for short, in which two parameters of network defense efficiency and risk loss vector are added to make it possible to describe the network security situation better.(1)
S, hidden state set space, S=s1,s2,…,sn, indicates all the hidden states that the system may be in; there are N hidden states. In this paper, the network hidden state is divided into Safe State G, Probe State P, Attack State A, and Compromise State C according to practical demand. Here, we can set s1 = G, s2 = P, s3 = A, and s4 = C.(i)
Safe StateG (good) indicates that the host or network is not attacked.(ii)
Probe StateP (probed) indicates that the host or network is being probed or scanned.(iii)
Attack StateA (attacked) host or network is being attacked by one or more objects.(iv)
Compromise StateC (compromised) indicates that the network or host has been compromised.(2)
V, observation vector set space, v1,v2,…,vi,…,vM, represents all possible observation vectors; there are M state observation vector values. According to the practical demand, the network security equipment logs are divided into the following categories:(i)
Compromise log: this type of log indicates that a successful attacker gains the administrator privileges.(ii)
Scan log: this type indicates that the system has been scanned.(iii)
Attack log: this type of log indicates that the system has been attacked.(iv)
No log: no network security equipment logs on the network.(v)
Suspicious log: the logs are not classified correctly.(3)
P, hidden state transition matrix, denotes the transition probability between the hidden states of system P = {pij}, pij=Pit+1=sjit=si, 0≤i,j≤N, it means the network is in a hidden state si at time t, and it+1 means the network is in a hidden state sj at time t + 1.(4)
Q, observation vector probability distribution matrix, Q=qivk, qivk=Pot=vkit=si indicates the probability of observing the network security equipment log Sei=Gj,βij,j=1,…,M,i=1,…,N in the hidden state βij.(5)
∏, initial hidden state probability distribution matrix, ∏=πiN, where πi=Pi1=si; 1 ≤ i ≤ N means the probability that the network is in the state Gj at the initial moment.(6)
F, current network defense efficiency, indicates the efficiency of defense efficiency of the current network state, 0≤F≤1. The higher the F, the better the network defense capability.(7)
C, risk loss vector, ∑j=1Mβij≤1, ∑j=1Mβij=1 indicates the risk value that the system faces when the network is in the state T.


## 3.2. Primary Generation of State Transition Matrix

This section mainly introduces the initial algorithm of hidden state transition matrix; this algorithm is different from the traditional algorithm, which is based on expertise. It is through the game theory to assess the transformational relation between hidden states and ultimately determine an initial state transition matrix.The hidden state transition model is shown in Figure2.Figure 2
Hidden state transition model.These circles represent the system state; according to the definition of this model, there are four hidden states: Safe StateG, Probe State P, Attack State A, and Compromise State C. E represents the security events that may occur in the network; D indicates the defense measures in the network. Assuming that the current network has security measures Dj and the hidden state is si, if there is a security event Ej in the network at this moment, the network will enter the hidden state sj at the next time. The process can be expressed as(6)si⟶Ej∨Djsj,si,sj∈G,P,A,C.When the current state issi, the hidden state transition can be described by the following E×D matrix, as shown in Table 1.Table 1
The attack and defense game matrix under the security statesi.
E1…EmD1sj…sk…………Dnso…spE1 to Em indicate security events; D1 to Dn indicate network defense measures; and sj indicates that when the network state is si, if the network defense measure is D1, the network state will be transferred to sj when E1 security event occurs. Similarly, so indicates that when the network state is si, if the network defense measure is Dn, the network state will be transferred to so when E1 security event occurs.The distribution of Safe State transitions can be seen intuitively from the matrixE×D. The probability of state from si to sj is(7)Pij=psi⟶sjEj∨Dj=sj∑sk∈Ssk.The Safe State transition vectorPi=siG,siP,siA,siC can be obtained when the current state is si.Establishing state transition matrix for all states which aresi of the current network severally, then we can get the initial transition matrix:(8)P=PGGPGPPGAPGCPPGPPPPPAPPCPAGPAPPAAPACPCGPCPPCAPCC.


## 3.3. Network State Transfer Matrix Modification Based on Defense Efficiency

Network security equipment defense efficiency refers to the network defense equipment and network basal equipment due to its high load or being attacked or other reasons and the availability is destroyed and cannot provide sufficient defense efficiency or external service. In order to assess the network security equipment defense efficiency, select the following factors: number of connections, bandwidth utilization, CPU utilization, and memory utilization.The quantification of the above situation assessment factors is mainly carried out according to the following steps:(1)
Establish hierarchy structure:It is done by analyzing the relationship among network efficiency and CPU utilization, memory utilization, network bandwidth utilization, and the number of connections, to establish the following two layers of structure, as shown in Figure3.(2)
Construct judgment matrix and assign value:Assuming that the network bandwidth utilization is more important than the number of connections, the score is 3. In contrast, the number of connections for network bandwidth utilization is 0.3333333. Memory utilization and CPU utilization are equally important to the number of connections, which can be scored as 2. So, we can build a judgment matrix as shown in Table2, in which the data are for illustrative purposes only.Figure 3
Hierarchy structure of network equipment defense efficiency.Table 2
Network equipment defense efficiency judgment matrix.
ItemNumber of connectionsBandwidth utilizationMemory utilizationCPU utilizationNumber of connections11/31/21/2Bandwidth utilization3122Memory utilization21/212CPU utilization21/21/21(3)
Weight calculation and consistency test:Using the SPSSAU online analysis tool, the analysis results are shown in Table3. Here, we can also obtain the weight vector wi by using the arithmetic mean method according to the following formula:(9)wi=1n∑j=1naij∑k=1nakj,1≤i,j≤4,whereaij is the comparison score of the judgment matrix.Table 3
AHP analysis results.
ItemEigenvectorWeight value (%)The largest eigenvalueCIRICRNumber of connections0.48412.0944.0710.0240.9000.026Bandwidth utilization1.66741.680Memory utilization1.07826.948CPU utilization0.77119.278Here, CR = CI/RI, the CI value has been obtained when evaluating the eigenvector, and the RI value is directly obtained by looking up the table, and the corresponding CR value is 0.026. SPSSAU prints this result directly, as well as consistency tests.Now, the weights have been calculated and the judgment matrix satisfies the consistency test. Then, the overall defense efficiencyF of the current network is calculated according to the following formula:(10)Ft=∑i=1nftiwi,whereft represents the normalized standard value of indicator i at the current time t.(4)
In the current period, the average state of each index is used to measure the defense efficiency of the current period.(5)
The probability of successful attack is different due to the different defense efficiency, so the state transition matrix is inconsistent under different conditions. Now, the modified vectorγt⟶ is introduced, γt⟶=γ1t,…,γjt,…,γNtT, and j indicates the hidden state of the system:(11)γjt=Ft,Ot=G,1Ft,Ot=A,C.(6)
The probability transfer matrixPt is modified according to the modified vector γt⟶, Pt=pijt, Pt is a matrix of N×N, and(12)pijt=pij×γit.


## 3.4. Solution of Network Hidden State Sequence Based on Improved Viterbi Algorithm

Viterbi algorithm is a dynamic programming algorithm, usually used to find the hidden state sequence which is most likely to produce observed event sequence from the hidden Markov model [20]. In this paper, the probability distributions of hidden states of the system every time in HMMP are obtained according to the idea of Viterbi algorithm. The solution procedure is as follows.For the network security situation assessment modelλ=S,V,P,Q,∏,F,C, suppose the observation vector sequence is Y=y1,…,yt,…,yT. Take the first observation as y1, and the calculation method of γ1i in the initial state is as follows:(13)α1si=Px1=siy1,λ,where α1si represents the probability of the system in the state si at time t = 1 (i.e., the initial time). Px1=siy1,λ represents the probability of the system in the state si when y1 can be observed from the sequence of observed vectors and the model’s parameter is λ.Conditional probability formula is derived as follows:(14)Px1=siy1,λ=Py1,x1=siλPy1λ=Py1x1=si,λPx1=siλPy1λ.When the parameter model isλ, the probability of observing y1 is equal to the sum of the product of the probability that y1 can be observed in all states and the probability that the system is in the same state when the parameter model is λ. The derivation is as follows:(15)Py1λ=∑j=1NPy1x1=sj,λPx1=sjλ.By formulas (14) and (15) we can get(16)α1si=Py1x1=si,λPx1=siλ∑j=1NPy1x1=sj,λPx1=sjλ.Substituting the specific parameter modelλ, we can get(17)α1si=qiy1πi∑j=1Nqjy1πj.And then using formula (17) to calculate the probability of the system in each state at the initial time, the system probability matrix at the initial time X1=α1si1×N,si∈S.The exhaustive operand is too large and the recursion method is used in order to simplify the computation of the follow-up state probability vector, assuming at timet, the system probability matrix Xt=αtsi1×N,si∈S. As known, αtsi=Pxt=siy1,y2,…,yt,λ represents the probability of the system in the state si when the parameter model is λ and the observation vector sequence is y1,y2,…,yt. To solve the system state probability matrix Xt+1 at time t + 1,(18)αt+1si=Pxt+1=siy1,y2,…,yt,yt+1,λ,where αt+1si indicates the probability of the system in the state si at time t + 1. Pxt+1=siy1,y2,…,yt,yt+1,λ indicates the probability of the system in the state si at time t + 1 when the parameter model is λ and the observation is yt+1. In the same way,(19)αt+1si=Pyt+1xt+1=si,λPxt+1=siy1,y2,…,yt,λ∑j=1NPyt+1xt+1=sj,λPxt+1=sjy1,y2,…,yt,λ,where Pyt+1x1=si,λ indicates the probability that yt+1 can be observed when the parameter model is λ and the system is in the state si. This probability is qiyt+1 which is from the observation vector probability distribution matrix of model λ. Pxt+1=siy1,y2,…,yt,λ indicates the probability of the system in the state si at time t + 1.Now we only need the probability of the system in the statesi at time t + 1. From the definition of the state transition matrix, we can see that the probability of the system in the state si at time t + 1 is equal to the sum of the product of state probability distribution matrix when the system is at time t and the probability that the system would transfer to state si:(20)Pxt+1=siy1,y2,…,yt,λ=∑sk∈SPxt=sky1,y2,…,yt,λPxt+1=sjxt=sk,λ,where ∑sk∈SPxt=sky1,y2,…,yt,λ indicates the probability that the system is in state Si when the parameter model is λ and the observation vector sequence is y1,y2,…,yt, which is the previously assumed condition αtsi. Pxt+1=sjxt=sk,λ indicates the probability that the system would transfer to state si the next time when the parameter model is λ and the current moment is sk. We can get(21)pkit+1=pki×γkt+1.In order to express convenience, reckonβt+1si=Pxt+1=siy1,y2,…,yt,λ, and then(22)βt+1si=∑si∈Spki·γkt+1·βtsk.Substituting into the formula, we can get(23)αtsi=qiytβtsi∑sj∈Sqjytβtsj.Then, the system state probability distribution at timet + 1 is(24)Xt+1=αt+1si1×N,si∈S.Finally, arranging above all, we can get(25)αtsi=qiy1πi∑j=1Nqjy1πj,t=1,qiytβtsi∑sj∈Sqjytβtsj,t>1.Andβtsi=∑si∈Spki·γkt+1·βt−1sk.


## 3.5. Algorithm Pseudocode Description

From the previous section, we get the steps to solve the system hidden state probability distribution in HMMP as follows:(1)
Judge whether the current observation vector is read; if it is, then jump to step 8; otherwise, enter step 2(2)
Obtain the current observation vectoryt and judge whether the current time is the initial time; if it is, go to step 3; otherwise enter step 5(3)
Calculate the conditional probabilities separately of each hidden state whenyt is observed by the formula α1si=qiy1πi/∑j=1Nqjy1πj.(4)
Convert the conditional probability of each implied state into matrixXt in order and store the final hidden state probability distribution sequence X; then return to step 1(5)
Calculate the system hidden state probability distribution without considering the observation vectoryt by the formula βtsi=∑si∈Spki·γkt+1·βt−1sk.(6)
Calculate the conditional probability of each hidden state whenyt is observed by the formula αtsi=qiytβtsi/∑sj∈Sqjytβtsj.(7)
Convert the conditional probability of each implied state into matrixXt in order, and store the final hidden state probability distribution sequence X; then return to step 1(8)
Output the final hidden state probability distribution sequenceX; then end the program.The pseudocode of Algorithm1 is as follows:Algorithm 1: Algorithm for solving hidden state probability distribution sequence.
Input: modelλ of HMMP, observation vector sequence Y, real-time efficiency sequence FOutput: final hidden state probability distribution sequence(1)
for t = 1 to T do(2)
if t = = 1(3)
for i = 1 to N do(4)
α1si=qiy1πi/∑j=1Nqjy1πj(5)
X←Xt=αtsi1×N,si∈S(6)
repeat(7)
else(8)
for i = 1 to N do(9)
βtsi=∑si∈Spki·γkt+1·βt−1sk(10)
αtsi=qiytπi/∑sj∈Sqjy1βtsj(11)
X←Xt=αtsi1×N,si∈S(12)
repeat(13)
endif(14)
repeat(15)
return X;


## 3.6. Calculation of Risk Loss Vector

According to the national standard definition, the risk is a function between the possibility of the system under attack and the degree of loss when the system is attacked. In the last section, the hidden probability distribution vector sequence is calculated, which is the probability of the system being attacked. Then, the following sections mainly calculate how much loss the system will be in the state, which is called risk loss vector.


### 3.6.1. Classification of Severity Levels

Risk vector is used to measure the degree of loss of the system in some state.First of all, there is asset evaluation.The three security attributes of asset evaluation are classified as confidentiality, integrity, and availability. According to the national standard GB/T20984, the assets are classified into five levels, and the more important the assets are, the higher the severity level will be.Then, there is severity levels classification.Now, most of the network equipment uses syslog type of log; syslog divides the severity into eight levels, as shown in Table4.Table 4
Severity levels based on syslog.
Severity levelLog description0Urgency: system is not available1Alert: must take measures right now2Important: important condition3Error: error condition4Warning: warn condition5Attention: normal with landmark condition6Information: information message7Debug: debug message


### 3.6.2. The Current Network State Assessment

Calculate the risk that the current system is facing according to the hidden state distribution probability sequenceX and the loss when the system is in each state. The loss of the current network state can be calculated by the following formula:(26)Rt=∑si∈SγtiCi,and γti indicates the probability that the system is in the state si at time t. Ci indicates the risk that the system will face in the state si.


## 3.6.1. Classification of Severity Levels

Risk vector is used to measure the degree of loss of the system in some state.First of all, there is asset evaluation.The three security attributes of asset evaluation are classified as confidentiality, integrity, and availability. According to the national standard GB/T20984, the assets are classified into five levels, and the more important the assets are, the higher the severity level will be.Then, there is severity levels classification.Now, most of the network equipment uses syslog type of log; syslog divides the severity into eight levels, as shown in Table4.Table 4
Severity levels based on syslog.
Severity levelLog description0Urgency: system is not available1Alert: must take measures right now2Important: important condition3Error: error condition4Warning: warn condition5Attention: normal with landmark condition6Information: information message7Debug: debug message


## 3.6.2. The Current Network State Assessment

Calculate the risk that the current system is facing according to the hidden state distribution probability sequenceX and the loss when the system is in each state. The loss of the current network state can be calculated by the following formula:(26)Rt=∑si∈SγtiCi,and γti indicates the probability that the system is in the state si at time t. Ci indicates the risk that the system will face in the state si.


## 4. Case Study

In order to verify the rationality of the evaluation method proposed in this paper, the quantitative evaluation of network security situation was carried out by using the IDS data of a certain department in real environment in November 3, 2015. Network topology is shown in Figure4. The experimental network is connected to the Internet through a router, in which a firewall, intrusion prevention system, and other security defense systems are deployed, and the local area network includes the business office area and the server area. The experimental data include security event alarm record from the firewall, intrusion detection system, and server host and the record of efficiency index operation.Figure 4
Real network experimental environment.First, import data into the database such as IPS; Table5 is part of the IPS original data.Table 5
IPS original log.
Attack IDTimeAttack nameSource IPDestination IPSource portDestination portApplication protocolHit countsAttack level1510002492015/11/3 0:00SMTP mail vulnerability27.24.159.231168.160.167.282447625SMTP1Prompt1510002492015/11/3 0:00SMTP mail vulnerability116.207.12.175168.160.167.28272425SMTP1Prompt1510002492015/11/3 0:00SMTP mail vulnerability221.239.226.214168.160.200.18285825SMTP1Prompt1510002492015/11/3 0:00SMTP mail vulnerability221.239.226.214168.160.200.18285825SMTP1Prompt1510002492015/11/3 0:01SMTP mail vulnerability119.147.194.226168.160.1.1044727125SMTP1Prompt1510002492015/11/3 0:01SMTP mail vulnerability119.147.194.226168.160.1.1044727125SMTP1Prompt1510002492015/11/3 0:01SMTP mail vulnerability111.176.71.222168.160.200.18384325SMTP1Prompt1510002492015/11/3 0:01SMTP mail vulnerability27.24.159.228168.160.1.1041168225SMTP1Prompt1510002492015/11/3 0:01SMTP mail vulnerability27.24.159.228168.160.1.1041168225SMTP1Prompt1510002492015/11/3 0:01SMTP mail vulnerability49.70.232.139168.160.1.109468725SMTP1Prompt1510002492015/11/3 0:01SMTP mail vulnerability116.207.13.72168.160.200.18178525SMTP1Prompt1510002492015/11/3 0:01SMTP mail vulnerability116.207.13.72168.160.200.18178525SMTP1Prompt1510002492015/11/3 0:02SMTP mail vulnerability27.24.159.231168.160.167.28298125SMTP1Prompt1510002492015/11/3 0:02SMTP mail vulnerability111.176.77.199168.160.200.18310125SMTP1Prompt1510002492015/11/3 0:02SMTP mail vulnerability111.176.77.199168.160.200.18310125SMTP1PromptOrganize the data into a standard weblog format and extract the required fields, time, attack name, source IP, source port, destination port, and attack level, as shown in Table6.Table 6
Network security equipment log.
TimeAttack nameSource IPSource portDestination IPDestination portAttack level2015/11/3 0:00SMTP mail attachment vulnerability27.24.159.23124476168.160.167.2825Prompt2015/11/3 0:00SMTP mail attachment vulnerability116.207.12.1752724168.160.167.2825Prompt2015/11/3 0:00SMTP mail attachment vulnerability221.239.226.2142858168.160.200.1825Prompt2015/11/3 0:00SMTP mail attachment vulnerability221.239.226.2142858168.160.200.1825Prompt2015/11/3 0:01SMTP mail attachment vulnerability119.147.194.22647271168.160.1.10425Prompt2015/11/3 0:01SMTP mail attachment vulnerability119.147.194.22647271168.160.1.10425Prompt2015/11/3 0:01SMTP mail attachment vulnerability111.176.71.2223843168.160.200.1825Prompt2015/11/3 0:01SMTP mail attachment vulnerability27.24.159.22811682168.160.1.10425Prompt2015/11/3 0:01SMTP mail attachment vulnerability27.24.159.22811682168.160.1.10425Prompt2015/11/3 0:01SMTP mail attachment vulnerability49.70.232.1394687168.160.1.10925Prompt2015/11/3 0:01SMTP mail attachment vulnerability116.207.13.721785168.160.200.1825Prompt2015/11/3 0:01SMTP mail attachment vulnerability116.207.13.721785168.160.200.1825Prompt2015/11/3 0:02SMTP mail attachment vulnerability27.24.159.2312981168.160.167.2825Prompt2015/11/3 0:02SMTP mail attachment vulnerability111.176.77.1993101168.160.200.1825Prompt2015/11/3 0:02SMTP mail attachment vulnerability111.176.77.1993101168.160.200.1825Prompt2015/11/3 0:02SMTP mail attachment vulnerability111.176.71.2224214168.160.1.10425Prompt2015/11/3 0:02SMTP mail attachment vulnerability111.176.71.2224214168.160.1.10425Prompt2015/11/3 0:02SMTP mail attachment vulnerability58.217.74.332270168.160.1.10425Prompt2015/11/3 0:02SMTP mail attachment vulnerability58.217.74.332270168.160.1.10425Prompt2015/11/3 0:03SMTP mail attachment vulnerability222.72.175.1854819168.160.200.1825PromptThe time interval of the test is 5 minutes; the calculation process is the following based on the alarm importance calculation method.There are 43 alarm logs in the time from 0:00, 2015/11/3, to 0:05, 2015/11/3; 42 of them are SMTP e-mail attachment vulnerability, and the attack level is prompt and happened for the first time. One of them is Web application: SQL injection attack, the attack level is prompt and happened for the first time. So the importance of SMTP e-mail attachment vulnerability is 42∗ 1 + 42 ∗ 25 + 1 ∗ 25 = 1117; the importance of SQL injection attack is 1 ∗ 1 + 1 ∗ 25 + 1 ∗ 25 = 51. So, the main alarm in this period is SMTP e-mail attachment vulnerability.There are 56 alarm logs in the time from 0:05, 2015/11/3, to 0:10, 2015/11/3; 51 of them are SMTP e-mail attachment vulnerability, and the attack level is prompt and happened in the last period. Five of them is Web application: SQL injection attack, the attack level is prompt and happened for the first time. So, the importance of SMTP e-mail attachment vulnerability in this period is 51∗ 1 + 51 ∗ 1 + 1 ∗ 1 = 103; the importance of SQL injection attack is 5 ∗ 1 + 5 ∗ 25 + 1 ∗ 25 = 155. So, the main alarm in this period is Web application: SQL injection attack.Obtain the main alarm vectors in each time period of 288 time periods in turn to form the alarm vector sequence, as shown in Table7.Table 7
Observation vector sequence.
Start timeEnd timeAttack nameNumber of attacksImportance of attack2015/11/3, 0:002015/11/3, 0:05SMTP mail attachment vulnerability4211172015/11/3, 0:052015/11/3, 0:10SQL injection attack (select)511552015/11/3, 0:102015/11/3, 0:15SMTP mail attachment vulnerability31191The next step is to model the Markov model. Firstly, the initial state transition matrix is constructed according to the security event and the defense strategy:(27)P=PGGPGPPGAPGCPPGPPPPPAPPCPAGPAPPAAPACPCGPCPPCAPCC=0.6120.2180.0780.0920.1080.6720.2100.0100.0290.1720.7620.0370.0070.0250.2010.767.Extract the main efficiency indexes from the firewall, IPS, and the host in this period, including CPU utilization, memory utilization, bandwidth utilization, and connection utilization, as shown in Figures5–8, respectively.Figure 5
CPU utilization sequence.Figure 6
Memory utilization sequence.Figure 7
Bandwidth utilization sequence.Figure 8
Connections utilization sequence.Analyze the weight of each parameter by the Analytic Hierarchy Process, the process is as follows:CPU utilization is as important as memory utilization, as the main task of the network service is outside, so the network bandwidth utilization and the number of connections are more important than CPU utilization and memory utilization. The department prohibits the operation of large flow, but allowing more people to access the same time, so the number of connections is slightly more important than the bandwidth utilization. Finally, we can get the relation matrix, as shown in Table8.Table 8
Equipment protection efficiency judgment matrix.
Proportion of the number of connectionsBandwidth utilizationMemory utilizationCPU utilizationProportion of number of connections1355Bandwidth utilization1/3133Memory utilization1/51/311CPU utilization1/51/311Input process, and get CR = 0.0571 < 0.1 which accord with the consistency standard. The weight is shown in Table9.Table 9
The weight of each index of equipment defense efficiency.
Number of connectionsBandwidth utilizationMemory utilizationCPU utilization0.54410.24810.10390.1039Take each efficiency into the final defense efficiency curve, as shown in Figure9.Figure 9
Final defense efficiency curve.The hidden state probability distribution curve, as shown in Figure10.Figure 10
Hidden state distribution sequence.And then, obtain the network risk vector in a similar way.According to the confidentiality, integrity and availability of the national standard, the asset importance attribute is shown in Table10.Table 10
Asset importance information.
ConfidentialityIntegrityAvailabilityFImportanceServer 12342.8843Server 22353.0173Server 33543.9144Server 43453.9144Combined with the losses caused by security events, the risk loss vectors are obtained as follows:(28)C=CG,CP,CA,CC=1,2.6,6.3,14.7.Finally, we can get the figure of network situation, as shown in Figure11.Figure 11
Final network situation diagram.From Figure11, we can see that in the 18 min to 20 min time period, the number of host connections is almost saturated, the service cannot provide services, and the host is actually in the capture state. And at this point, the network risk value is also in the highest state, in line with the actual situation. Through the above security events information and network situation diagram, network administrators can clearly understand the global network security event occurring at that time and control the network situation real-timely.


## 5. Conclusions

The network situation assessment technology based on HMMP is studied mainly in this paper, to solve the problem that network administrators can control the global network state real-timely in the face of multisource logs. In order to achieve this goal, state transition matrix generation method in HMMP is designed in this paper, the system can modify the state transition matrix automatically in real-time according to the network state through this method and obtain the hidden state probability distribution sequence of the current system through the improved Viterbi algorithm. Finally, the final network risk value is obtained through the method of calculating the risk loss vector. The experiment shows that the security assessment based on HMMP in this paper can describe the current network state precisely and comprehensively.



---

*Source: 1428056-2020-08-24.xml*