# Information Security Situation Awareness Based on Big Data and Artificial Intelligence Technology

Authors: Fuguang Yao
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

The information security threats faced by enterprises are increasing rapidly, and the technology of security attacks is also diversified and developed at a high level. The application of big data technology and artificial intelligence technology in all walks of life continues to deepen. While greatly improving social productivity, it also brings certain information security issues. Security situation awareness technology has become a new research hotspot in the field of network security. Using big data-related technologies to analyze, filter, merge, and identify known and unknown security threats is a new research discovery. This research builds a new cascaded network security situational awareness model based on the traditional and fusion decision tree algorithms. We use an induction algorithm to generate a decision tree on the preprocessed data to classify the data according to the decision rules. Research shows that a new network security situation awareness model is constructed using decision tree calculations. Compared with the traditional model, the classification effect of this model is better.


---

## Body

## 1. Introduction

The rapid development of cloud computing and the Internet has caused an explosive growth of network data. While it brings convenience to people’s work and life, the massive amount of data also brings great security risks to the network. Therefore, the security situation awareness technology is designed, such as the network security situation awareness model based on the Bayesian method and the multinode network security situation prediction awareness model based on the improvedG-K algorithm. These two models detect security events in the network by sensing network security threat data, but the classification effect of the security situation awareness model is not good [1]. This has led to its speedup and scale ratios being lower than expected.For this reason, this research builds a new cascaded network security situational awareness model based on the traditional model fusion decision tree algorithm. The decision tree algorithm is a method of approximating the value of a discrete function [2]. We use an induction algorithm to generate a decision tree on the preprocessed data to classify the data according to the decision rules. The design process of the cascaded network security situational awareness model based on the decision tree algorithm is described in detail below.


## 2. Design of Cascaded Cybersecurity Situational Awareness Model

### 2.1. Set the Category Division Module of the Perception Model

It is very important to accurately classify the types of network security elements in complex networks. Therefore, this research resets the category division module of the perception model based on traditional design.According to the existing network attack elements, it can be seen that the current attack categories include denial of service attacks, detection attacks, remote login attacks, and access rights attacks. The abbreviations for the four types of attacks areDos,Probe,R2L and U2R, respectively. Among them, Dos mainly paralyzes the attacked party’s equipment by sending massive amounts of network data. Probe uses scanning technology to steal the privacy of other hosts. R2L then logs in to a remote computer to steal information based on potential security vulnerabilities. U2R Performs some illegal operations by obtaining the highest authority of the server. Based on experience, it can be known that Dos attacks can pose a major threat to the security situation of cascaded networks, while Probe attacks have a lighter impact [3]. Therefore, the cascaded network elements are divided into five categories: normal online network data and four attack data. Set the identifiers of these categories to 1, 2, 3, 4, and 5. Then, we present the classification module of the perception model to the following manifestation
(1)Gk:ifsm∈Amk,Then,B1,θ1,k,B2,θ2,k,⋯,Bn,θn,k.In formula (1) Gk represents the k rule of the security situation awareness classification module. s1,s2,⋯,sm represents m premise attributes. A1k,A2k,⋯,Amkrepresents the reference value of m premise attributes in rule k. B1,B2,⋯,Bn represents the n categories of the classification problem. θ1,k,θ2,k,⋯,θn,k represents the confidence level of the n conclusion in Rule k.We use the above formula to describe the composition rules of the model classification module and the evidence reasoning algorithm to achieve the training of the model classification to obtain the category of the input data. Therefore, a BRB classification process is established according to the classification rules given above [4]. This process uses the calculation method of the principal component analysis algorithm to reduce the dimensionality in advance and then divides the network data into two parts, the training data set and the test data set. When the training data set enters the classification module of the model, it is divided into several subsets so that each subset contains only two types of data. For example, a subset contains normal data and Dos attack data. The other subset contains normal data and Probe attack data. Therefore, the classification module of the model is only responsible for the classification of two kinds of data. According to formula (1), the calculation process of the two data classifications is obtained
(2)Gk:ifsm∈Amk,Then,B1,θ1,k,B2,θ2,k.We combine several BRB classifiers with building a complete network security situation classification module to achieve different data classification.


### 2.2. The Security Event Detection Mode of the Design Model

A security event detection model with a hierarchical structure is designed based on the set as mentioned above of category division modules of the perception model. This mode performs anomaly detection on different levels of network data and then finds the situation elements from the detection results to assess the situation overall. At the same time, the security event threat data accumulated by the model when the perception model is used to perform the network security situational awareness work provides the original data for the model perception [5]. Therefore, knowledge is formed from the detection and comparison, and then the knowledge is used to adjust the evaluation and security strategy. We use the subsequent time window to detect the adjusted results to achieve a hierarchical cycle perception of the entire process. The security event detection layer is responsible for detecting abnormal behaviors of network-oriented and host-oriented data. The network-oriented data flow is the data flow that enters the cascaded network in order with data packets as the unit. The host-oriented service request flow is the data that enters the branch network or a host in the branch network in flow units. The host-oriented service response flow is the network flow data related to a host’s service request and sent from the host to the outside in the flow unit. Therefore, at the security event detection level, the summary of network information is first recorded when network data flows.We set the length of the time window toD and then use Di to segment i network information. Then, in the time window, extract the network stream data feature (TD) representation of the time window segmentation according to the record content of the summary information. The classification module based on the setting uses TD as the input to detect the security status of the network traffic in the time window. The formula is
(3)resultN=normal,attackgN,abnormal,DetectTD=resultn.In formula (3) gN represents a common attack type. Here, specifically refer toDos,Probe,R2L and U2R. The above is the processing process facing the network data flow. When the model faces the host data stream, it also integrates the basic information of the data stream in advance. First, we use the time window D to integrate the data packets of the subnet and then organize the data records according to the inspection objects. Integrate data with the same IP when detecting service request data flow [6]. When detecting the service response data flow, the data with the same source port in the host outflow is organized together. Therefore, the tissue records of the two detection objects are denoted by flow1 and flow2, respectively. For service request flow and service response flow, we use a time window D to extract the behavior characteristics of the two, which are denoted as F1 and F2, respectively. Finally, the classification module is used to detect the abnormal behavior of the host-oriented data stream. The formula is
(4)result1=normal,attackg1,abnormal,result2=normal,abnormal,DetectF1=result1,DetectF2=result2.Through the above calculation process, the optimized design of the model security event detection mode is realized.


### 2.3. Establish a Perception Model Based on the Decision Tree Algorithm

To achieve a refined distinction between different security events, it is necessary to rely on more advanced algorithms to separate the normal data from the attack data by dividing the subset of the classification module [7]. Therefore, a cascaded network security situation awareness model based on a decision tree algorithm is constructed. The basic structure of the model is shown in Figure 1.Figure 1
Cascade network security situation awareness model based on decision tree algorithm.According to the model structure shown in Figure1, the algorithm is a model that relies on the decision tree algorithm. The model comprises multiple decision trees, and the output result is determined by the mode of the output results of all decision trees [8]. The designed perception model has three layers, which perform security situation awareness on different data streams in top-down order. The final perception result is obtained through the posture projection of the leaf nodes. It is known that the model contains a large number of decision trees, and the decision tree algorithm is a method of dividing the space into hyperplanes. When the algorithm performs data segmentation, the space where the data is located is divided into two in advance so that each leaf node in the space is in a disjoint area. When data is separated simultaneously, it gradually decreases according to the dimensional characteristics of the input sample and finally enters any one of the M regions. Each area at this time represents a different data category. Under the control of the decision tree algorithm, each decision tree has no interrelated nature. Therefore, a large number of decision trees form a forest. Discriminate the input new sample category through each decision tree in the forest. According to each decision tree, select the most category to confirm the attack type of the network data. The processing process of the decision tree algorithm for network attack data is shown in Table 1 below.Table 1
Data processing process of decision tree algorithm.
StepAlgorithm execution process1EnterN pieces of data, generate the number of decision trees based on the data attributes, and randomly select the number of data features in the model training process2Process the attack data in a sampling manner to obtain the training data set3Select and classify the feature attributes of the training data set to generate a decision tree4Add decision trees to the forest5Judge whether all decision trees in the forest reach the initially set value6Traverse the decision tree in the forest, judge the records in the data set, and use the node with the most classification results as the output result.We use the decision tree algorithm to separate the attack data mixed with the normal data in the subset to establish a cascaded network security situational awareness model.


## 2.1. Set the Category Division Module of the Perception Model

It is very important to accurately classify the types of network security elements in complex networks. Therefore, this research resets the category division module of the perception model based on traditional design.According to the existing network attack elements, it can be seen that the current attack categories include denial of service attacks, detection attacks, remote login attacks, and access rights attacks. The abbreviations for the four types of attacks areDos,Probe,R2L and U2R, respectively. Among them, Dos mainly paralyzes the attacked party’s equipment by sending massive amounts of network data. Probe uses scanning technology to steal the privacy of other hosts. R2L then logs in to a remote computer to steal information based on potential security vulnerabilities. U2R Performs some illegal operations by obtaining the highest authority of the server. Based on experience, it can be known that Dos attacks can pose a major threat to the security situation of cascaded networks, while Probe attacks have a lighter impact [3]. Therefore, the cascaded network elements are divided into five categories: normal online network data and four attack data. Set the identifiers of these categories to 1, 2, 3, 4, and 5. Then, we present the classification module of the perception model to the following manifestation
(1)Gk:ifsm∈Amk,Then,B1,θ1,k,B2,θ2,k,⋯,Bn,θn,k.In formula (1) Gk represents the k rule of the security situation awareness classification module. s1,s2,⋯,sm represents m premise attributes. A1k,A2k,⋯,Amkrepresents the reference value of m premise attributes in rule k. B1,B2,⋯,Bn represents the n categories of the classification problem. θ1,k,θ2,k,⋯,θn,k represents the confidence level of the n conclusion in Rule k.We use the above formula to describe the composition rules of the model classification module and the evidence reasoning algorithm to achieve the training of the model classification to obtain the category of the input data. Therefore, a BRB classification process is established according to the classification rules given above [4]. This process uses the calculation method of the principal component analysis algorithm to reduce the dimensionality in advance and then divides the network data into two parts, the training data set and the test data set. When the training data set enters the classification module of the model, it is divided into several subsets so that each subset contains only two types of data. For example, a subset contains normal data and Dos attack data. The other subset contains normal data and Probe attack data. Therefore, the classification module of the model is only responsible for the classification of two kinds of data. According to formula (1), the calculation process of the two data classifications is obtained
(2)Gk:ifsm∈Amk,Then,B1,θ1,k,B2,θ2,k.We combine several BRB classifiers with building a complete network security situation classification module to achieve different data classification.


## 2.2. The Security Event Detection Mode of the Design Model

A security event detection model with a hierarchical structure is designed based on the set as mentioned above of category division modules of the perception model. This mode performs anomaly detection on different levels of network data and then finds the situation elements from the detection results to assess the situation overall. At the same time, the security event threat data accumulated by the model when the perception model is used to perform the network security situational awareness work provides the original data for the model perception [5]. Therefore, knowledge is formed from the detection and comparison, and then the knowledge is used to adjust the evaluation and security strategy. We use the subsequent time window to detect the adjusted results to achieve a hierarchical cycle perception of the entire process. The security event detection layer is responsible for detecting abnormal behaviors of network-oriented and host-oriented data. The network-oriented data flow is the data flow that enters the cascaded network in order with data packets as the unit. The host-oriented service request flow is the data that enters the branch network or a host in the branch network in flow units. The host-oriented service response flow is the network flow data related to a host’s service request and sent from the host to the outside in the flow unit. Therefore, at the security event detection level, the summary of network information is first recorded when network data flows.We set the length of the time window toD and then use Di to segment i network information. Then, in the time window, extract the network stream data feature (TD) representation of the time window segmentation according to the record content of the summary information. The classification module based on the setting uses TD as the input to detect the security status of the network traffic in the time window. The formula is
(3)resultN=normal,attackgN,abnormal,DetectTD=resultn.In formula (3) gN represents a common attack type. Here, specifically refer toDos,Probe,R2L and U2R. The above is the processing process facing the network data flow. When the model faces the host data stream, it also integrates the basic information of the data stream in advance. First, we use the time window D to integrate the data packets of the subnet and then organize the data records according to the inspection objects. Integrate data with the same IP when detecting service request data flow [6]. When detecting the service response data flow, the data with the same source port in the host outflow is organized together. Therefore, the tissue records of the two detection objects are denoted by flow1 and flow2, respectively. For service request flow and service response flow, we use a time window D to extract the behavior characteristics of the two, which are denoted as F1 and F2, respectively. Finally, the classification module is used to detect the abnormal behavior of the host-oriented data stream. The formula is
(4)result1=normal,attackg1,abnormal,result2=normal,abnormal,DetectF1=result1,DetectF2=result2.Through the above calculation process, the optimized design of the model security event detection mode is realized.


## 2.3. Establish a Perception Model Based on the Decision Tree Algorithm

To achieve a refined distinction between different security events, it is necessary to rely on more advanced algorithms to separate the normal data from the attack data by dividing the subset of the classification module [7]. Therefore, a cascaded network security situation awareness model based on a decision tree algorithm is constructed. The basic structure of the model is shown in Figure 1.Figure 1
Cascade network security situation awareness model based on decision tree algorithm.According to the model structure shown in Figure1, the algorithm is a model that relies on the decision tree algorithm. The model comprises multiple decision trees, and the output result is determined by the mode of the output results of all decision trees [8]. The designed perception model has three layers, which perform security situation awareness on different data streams in top-down order. The final perception result is obtained through the posture projection of the leaf nodes. It is known that the model contains a large number of decision trees, and the decision tree algorithm is a method of dividing the space into hyperplanes. When the algorithm performs data segmentation, the space where the data is located is divided into two in advance so that each leaf node in the space is in a disjoint area. When data is separated simultaneously, it gradually decreases according to the dimensional characteristics of the input sample and finally enters any one of the M regions. Each area at this time represents a different data category. Under the control of the decision tree algorithm, each decision tree has no interrelated nature. Therefore, a large number of decision trees form a forest. Discriminate the input new sample category through each decision tree in the forest. According to each decision tree, select the most category to confirm the attack type of the network data. The processing process of the decision tree algorithm for network attack data is shown in Table 1 below.Table 1
Data processing process of decision tree algorithm.
StepAlgorithm execution process1EnterN pieces of data, generate the number of decision trees based on the data attributes, and randomly select the number of data features in the model training process2Process the attack data in a sampling manner to obtain the training data set3Select and classify the feature attributes of the training data set to generate a decision tree4Add decision trees to the forest5Judge whether all decision trees in the forest reach the initially set value6Traverse the decision tree in the forest, judge the records in the data set, and use the node with the most classification results as the output result.We use the decision tree algorithm to separate the attack data mixed with the normal data in the subset to establish a cascaded network security situational awareness model.


## 3. Simulation and Result Analysis

To verify the actual application performance of the cascaded network security situation awareness model based on the decision tree algorithm designed above, we design the following simulation. To avoid the singleness of the experimental results, we use the model in this paper as the test object of the experimental group [9]. We divided the subjects into control group A and control group B according to the traditional Bayes-based method and improved G-K algorithm. Compare the performance of the three sets of perception models in the process of detecting cascaded network security.


### 3.1. Security Situation Division

The experimental group selected 3156 samples as the basic test conditions. The distribution of the samples is shown in Table2.Table 2
Classification of the sample data of the experimental group.
Training data setTest data setNormal1000 pcsNormal200 pcsDos1000 pcsDos200 pcsProbe310Probe60 pcsR2L120 pcsR2L25U2R200 pcsU2R40The model design method proposed this time uses the decision tree algorithm to reduce the dimensionality and then follows the classifier as shown in Figure2. We divide the training data in Table 2 into ten groups, and each BRB classifier takes any of them as the source of training data.Figure 2
Schematic diagram of the classification structure of the confidence rule library.We set up all BRB modules in Figure2 with the same initial parameters. The initial parameters of the module are shown in Table 3.Table 3
The initial parameters of each BRB module in the perception model.
RuleWeightsProperty reference valueConclusion confidence110, 00.5, 0.5210, 0.50.5, 0.5310, 10.5, 0.5410.5, 00.5, 0.5510.5, 0.50.5, 0.5610.5, 10.5, 0.5711, 00.5, 0.5811, 0.50.5, 0.5911, 10.5, 0.5Then, we use the model in this paper to optimize the parameters in Table3. Figure 3 shows the classification results of the optimized BRB classifier for the network security situation [10]. The abscissa in Figure 3 represents the type of cascaded network data, and the ordinate represents the classification recognition rate of the model. According to the data in Figure 3, it can be seen that for some data sets, the classification detection output of the model in this paper has reached 100%, and the classification effect of only a few data sets is low.Figure 3
The model’s security posture classification results.


### 3.2. Security Situation Awareness Model Classification Effect Test

To make the experimental test results more intuitive, we compare the classification effect of the model in this paper with the classification effect of the two control models from the perspective of network security situation classification output. The result is shown in Figure4. According to the test results in Figure 4, it can be seen that the model in this paper has a good classification effect on five different network data sets with the assistance of the decision tree algorithm [11]. The results of calculating the classification difference of the three test groups are shown in Table 4.Figure 4
Comparison of model classification effects of different test groups.Table 4
Differences in classification effects of different models.
Data setTest groupControl group AControl group BNormal99.54%96.5%100.00%Dos100.00%100.00%100.00%Probe98.82%95.36%25.35%R2L100.00%100.00%0.00%U2R74.69%61.50%0.00%According to the data in Table4, the three models’ average classification effects are calculated to be 94.61%, 90.67%, and 45.07%, respectively. The classification and recognition effects of the experimental group were 3.94% and 49.54% higher than that of the two control groups, respectively. It can be seen that the application of this model has a better data security situation classification effect.


### 3.3. Acceleration Ratio and Scale Ratio Test of the Security Situation Awareness Model

Under normal circumstances, there is a certain degree of loss because of communication between the data link and the nodes [12]. Coupled with some limitations of each computing node, it is not easy to improve the model’s linear speedup ratio and scale ratio. Figure 5 shows the speedup ratio and scale ratio test results of the three test groups.Figure 5
Speedup ratio and scale ratio test results.
(a)
Test group(b)
Control group A(c)
Control group BAccording to the time data and network data in Figure5, it can be seen that the speedup ratio and scale ratio of the experimental group model have good optimization effects. It can be seen that the network security situational awareness model designed in this paper has better time efficiency, space consumption, and stability when facing diversified network big data. When the two control groups face the same network big data, their speedup and scale ratios are relatively average [13]. It can be seen that although the time efficiency of the traditional model in the face of big network data meets the design requirements, its space consumption and stability have not reached the expected goals. In summary, the traditional model does not have superior performance due to its algorithm classification effect.


## 3.1. Security Situation Division

The experimental group selected 3156 samples as the basic test conditions. The distribution of the samples is shown in Table2.Table 2
Classification of the sample data of the experimental group.
Training data setTest data setNormal1000 pcsNormal200 pcsDos1000 pcsDos200 pcsProbe310Probe60 pcsR2L120 pcsR2L25U2R200 pcsU2R40The model design method proposed this time uses the decision tree algorithm to reduce the dimensionality and then follows the classifier as shown in Figure2. We divide the training data in Table 2 into ten groups, and each BRB classifier takes any of them as the source of training data.Figure 2
Schematic diagram of the classification structure of the confidence rule library.We set up all BRB modules in Figure2 with the same initial parameters. The initial parameters of the module are shown in Table 3.Table 3
The initial parameters of each BRB module in the perception model.
RuleWeightsProperty reference valueConclusion confidence110, 00.5, 0.5210, 0.50.5, 0.5310, 10.5, 0.5410.5, 00.5, 0.5510.5, 0.50.5, 0.5610.5, 10.5, 0.5711, 00.5, 0.5811, 0.50.5, 0.5911, 10.5, 0.5Then, we use the model in this paper to optimize the parameters in Table3. Figure 3 shows the classification results of the optimized BRB classifier for the network security situation [10]. The abscissa in Figure 3 represents the type of cascaded network data, and the ordinate represents the classification recognition rate of the model. According to the data in Figure 3, it can be seen that for some data sets, the classification detection output of the model in this paper has reached 100%, and the classification effect of only a few data sets is low.Figure 3
The model’s security posture classification results.


## 3.2. Security Situation Awareness Model Classification Effect Test

To make the experimental test results more intuitive, we compare the classification effect of the model in this paper with the classification effect of the two control models from the perspective of network security situation classification output. The result is shown in Figure4. According to the test results in Figure 4, it can be seen that the model in this paper has a good classification effect on five different network data sets with the assistance of the decision tree algorithm [11]. The results of calculating the classification difference of the three test groups are shown in Table 4.Figure 4
Comparison of model classification effects of different test groups.Table 4
Differences in classification effects of different models.
Data setTest groupControl group AControl group BNormal99.54%96.5%100.00%Dos100.00%100.00%100.00%Probe98.82%95.36%25.35%R2L100.00%100.00%0.00%U2R74.69%61.50%0.00%According to the data in Table4, the three models’ average classification effects are calculated to be 94.61%, 90.67%, and 45.07%, respectively. The classification and recognition effects of the experimental group were 3.94% and 49.54% higher than that of the two control groups, respectively. It can be seen that the application of this model has a better data security situation classification effect.


## 3.3. Acceleration Ratio and Scale Ratio Test of the Security Situation Awareness Model

Under normal circumstances, there is a certain degree of loss because of communication between the data link and the nodes [12]. Coupled with some limitations of each computing node, it is not easy to improve the model’s linear speedup ratio and scale ratio. Figure 5 shows the speedup ratio and scale ratio test results of the three test groups.Figure 5
Speedup ratio and scale ratio test results.
(a)
Test group(b)
Control group A(c)
Control group BAccording to the time data and network data in Figure5, it can be seen that the speedup ratio and scale ratio of the experimental group model have good optimization effects. It can be seen that the network security situational awareness model designed in this paper has better time efficiency, space consumption, and stability when facing diversified network big data. When the two control groups face the same network big data, their speedup and scale ratios are relatively average [13]. It can be seen that although the time efficiency of the traditional model in the face of big network data meets the design requirements, its space consumption and stability have not reached the expected goals. In summary, the traditional model does not have superior performance due to its algorithm classification effect.


## 4. Conclusion

This study used decision tree calculations to construct a new network security situational awareness model based on the traditional design and achieved good application results. Because the greedy strategy is adopted in the tree building process, it will inevitably lead to the model’s poor ability to consider the overall situation and the optimal local situation. Therefore, in future work, we will consider optimizing the decision tree algorithm to strengthen the global perception ability of the perception model to break the limitation of local optimization.



---

*Source: 2989118-2021-10-22.xml*