# Evaluation and Prediction Method of System Security Situational Awareness Index Based on HMM Model

Authors: Mengjie Qian
Journal: Scientific Programming
 (2022)

---

## Abstract

In recent years, with the continuous development and progress of information technology and science and technology, big data has entered all walks of life, integrated into the lives of the public, and has become a necessity for social operation; the gradual development of artificial intelligence has also made life in modern times. People in society are more and more convenient. However, the development of science and technology is also accompanied by corresponding problems, and the war in information has gradually started. This paper simulates the possible information security through the hidden Markov model and then verifies the feasibility and effectiveness of the situation assessment method and the situation prediction method, in order to effectively evaluate the relevant information security level and effectively predict the accuracy of the situation value. The experimental results show that the fluctuation of the situation value corresponds to the different attack behaviors carried out by the attacker, accurately describes the information security status of the system, and verifies the effectiveness and accuracy of the situational awareness method proposed in this paper, while the situation prediction method based on ARIMA predictable short-term changes in situational values can be used for short-term forecasts that require high accuracy.


---

## Body

## 1. Introduction

In recent years, with the continuous improvement of people's economic income, mobile phones and computers have become the necessities of every family. Cybersecurity cases often occur in our lives, our cyberspace security is facing severe challenges, and many enterprises or organizations will also face cyberattacks, such as the once-famous “Aurora Attack,” which attacked Google's mail server attacked. Some foreign hacker organizations hope to steal our country's military secrets and understand our country's political and economic situation by attacking our country's software. In China, some criminals use the Internet to attack some websites to steal the internal data of the websites and defraud some elderly people through the Internet. These situations affect the social atmosphere and reduce the happiness of residents' lives. As these problems become increasingly prominent, it should be put on the agenda to improve system security protection capabilities, pay attention to network security, and monitor and predict possible events. When defending, improve your defense methods and fully understand the network security dynamics; you need to find potential threats as soon as possible, find out possible malicious behaviors, determine the source of the attack, provide important information for eliminating security threats and update network data in a timely manner, and actively fight against security risks.With the continuous development and progress of information technology and technology, issues related to big data, artificial intelligence, and security posture have entered people's lives, and everyone has gradually become familiar with these once unfamiliar words. Company executives make decisions through big data [1]; the DBES problem [2]; the use of wireless mesh networks [3]; the deployment of intelligent transportation systems [4]; the rise of big data in cloud computing [5]; evaluation research on bank performance [6]; emergence of behavior-oriented artificial intelligence [7]; predicting lake level fluctuations [8]; birth of AIDR [9]; artificial intelligence applications [10]; birth of ADS system [11]; prediction of security situation [11]; security aggregation and configuration related data [12]; analysis of sources and identification methods of information risks [13]; application of artificial intelligence in music education [14]; performance improvement of water pollution monitoring and rapid decision-making systems [15]; network security situation prediction [16]; the combination of artificial intelligence algorithms and physical modeling [17]; and so on.


## 2. Theoretical Basis

### 2.1. Situational Awareness

#### 2.1.1. Related Situational Awareness Profiles

Situational awareness was first proposed by Endsley et al. in 1988. It is defined as “the extraction and understanding of the surrounding environmental factors within a certain time and space, and the prediction of the future development trend.” Situational awareness originated from the military field and was soon applied to other fields. The application of situational awareness in network security is even more extensive and far-reaching; in enterprise information security management, the defense-discovery-repair approach is adopted [18].


#### 2.1.2. Situational Awareness Model

The three-layer situational awareness model visually represented in Figure1 is a widely accepted general theoretical model given by Endsley. The model is composed of situational element extraction, situational understanding, and situational prediction and plays an important role in the subsequent research on network security situational awareness systems.Figure 1
3-layer situational awareness model.


#### 2.1.3. Security Situation Forecast

Security situation prediction is the highest level technology in the whole situational awareness model [19]. The prediction of network security situation plays an important role in the defense of network security. The definition of situation prediction is to make a preestimation of the events or scenarios that will occur in the future to determine the probability of its occurrence, which usually requires rigorous investigation and observation, and artificial intelligence algorithms such as machine learning and deep learning can discover and identify potential patterns in input data and output of the required prediction information. They have achieved great success in computer vision, natural language processing, and other fields and are widely used in artificial intelligence algorithms. They have also been used in network security situation prediction and achieved initial results. Therefore, according to certain scientific basis, through the analysis and study of relevant factors, a specific prediction model as shown in Figure 2 is established.Figure 2
Security situation prediction model.


#### 2.1.4. Cybersecurity Situational Awareness

The network situation is a network state and changing trend, which is affected by factors such as different types of network operating conditions, network behaviors, and user behaviors. These behaviors are combined together to form a network situation. In a large-scale network environment, we can select those security elements for analysis, fully understand the changes in the network situation, and use big data technology to process different types of information. The perception platform integrates user terminals, through different types of perception data sources, fully explores technologies, understands intelligent algorithms, and improves the sensitivity of the network security situational awareness platform.Situational awareness describes the network system and requires a full understanding of its microstate, which is reflected by various connection parameters. After in-depth mining of parameters, determine the correlation and development trend of information, and use related tools (algorithms or measures) to detect and perceive, and associate the data and information from detection and perception in some way to form knowledge. This completes a basic process of situational awareness as shown in Figure3.Figure 3
Conceptual model of network security situational awareness.We know that the biggest feature of network situational awareness [20] is the need to measure the physical network. The following abilities serve as support:(1)
Big data processing capability: the Internet is huge, and a large amount of concurrent data traffic is transmitted through each node. In this kind of data reanalysis, Network maintenance personnel cannot meet the requirements of the end-of-network activity and the characteristics of the network situation rate. Therefore, the sampling method to detect abnormal network activities cannot meet the requirements. Network situational awareness must have the ability of very good processing power for massive data.(2)
Fine analysis capability: the detection of data packets must meet fine-grained requirements, and various data streams and parameters must be efficiently retrieved and matched. To achieve a good perception of the network microstate, in addition to the traditional key physical parameters (source and destination addresses, ports, and protocol types), situational awareness technology must also have the ability to identify multiple logical parameters.(3)
Protocol identification capability: as an important parameter, the protocol type is very important to accurately identify it. In the process of implementing situational awareness, in addition to identifying widely used Internet standard protocols (such as TCP/IP protocol suite, etc.), other nonstandard and private protocols should also be captured as much as possible. Security poses a threat. For the identified protocol features (fingerprints), a fingerprint database shall be formed, which shall be continuously updated and maintained to support the effective matching retrieval function.(4)
Reliable operation capability: situational awareness technology equipment needs to have reliable operation capability to ensure long-term normal operation. Any interruption of the operation process may cause inaccurate perception information.(5)
Business diversion capability: after all kinds of information are accurately identified, they should be redirected in a certain way; that is, after classifying the information, the next step is processed in a targeted manner. This can not only make the data information more accurate, but also greatly reduce the background processing load, improve operating efficiency, and save memory capacity.


## 2.1. Situational Awareness

### 2.1.1. Related Situational Awareness Profiles

Situational awareness was first proposed by Endsley et al. in 1988. It is defined as “the extraction and understanding of the surrounding environmental factors within a certain time and space, and the prediction of the future development trend.” Situational awareness originated from the military field and was soon applied to other fields. The application of situational awareness in network security is even more extensive and far-reaching; in enterprise information security management, the defense-discovery-repair approach is adopted [18].


### 2.1.2. Situational Awareness Model

The three-layer situational awareness model visually represented in Figure1 is a widely accepted general theoretical model given by Endsley. The model is composed of situational element extraction, situational understanding, and situational prediction and plays an important role in the subsequent research on network security situational awareness systems.Figure 1
3-layer situational awareness model.


### 2.1.3. Security Situation Forecast

Security situation prediction is the highest level technology in the whole situational awareness model [19]. The prediction of network security situation plays an important role in the defense of network security. The definition of situation prediction is to make a preestimation of the events or scenarios that will occur in the future to determine the probability of its occurrence, which usually requires rigorous investigation and observation, and artificial intelligence algorithms such as machine learning and deep learning can discover and identify potential patterns in input data and output of the required prediction information. They have achieved great success in computer vision, natural language processing, and other fields and are widely used in artificial intelligence algorithms. They have also been used in network security situation prediction and achieved initial results. Therefore, according to certain scientific basis, through the analysis and study of relevant factors, a specific prediction model as shown in Figure 2 is established.Figure 2
Security situation prediction model.


### 2.1.4. Cybersecurity Situational Awareness

The network situation is a network state and changing trend, which is affected by factors such as different types of network operating conditions, network behaviors, and user behaviors. These behaviors are combined together to form a network situation. In a large-scale network environment, we can select those security elements for analysis, fully understand the changes in the network situation, and use big data technology to process different types of information. The perception platform integrates user terminals, through different types of perception data sources, fully explores technologies, understands intelligent algorithms, and improves the sensitivity of the network security situational awareness platform.Situational awareness describes the network system and requires a full understanding of its microstate, which is reflected by various connection parameters. After in-depth mining of parameters, determine the correlation and development trend of information, and use related tools (algorithms or measures) to detect and perceive, and associate the data and information from detection and perception in some way to form knowledge. This completes a basic process of situational awareness as shown in Figure3.Figure 3
Conceptual model of network security situational awareness.We know that the biggest feature of network situational awareness [20] is the need to measure the physical network. The following abilities serve as support:(1)
Big data processing capability: the Internet is huge, and a large amount of concurrent data traffic is transmitted through each node. In this kind of data reanalysis, Network maintenance personnel cannot meet the requirements of the end-of-network activity and the characteristics of the network situation rate. Therefore, the sampling method to detect abnormal network activities cannot meet the requirements. Network situational awareness must have the ability of very good processing power for massive data.(2)
Fine analysis capability: the detection of data packets must meet fine-grained requirements, and various data streams and parameters must be efficiently retrieved and matched. To achieve a good perception of the network microstate, in addition to the traditional key physical parameters (source and destination addresses, ports, and protocol types), situational awareness technology must also have the ability to identify multiple logical parameters.(3)
Protocol identification capability: as an important parameter, the protocol type is very important to accurately identify it. In the process of implementing situational awareness, in addition to identifying widely used Internet standard protocols (such as TCP/IP protocol suite, etc.), other nonstandard and private protocols should also be captured as much as possible. Security poses a threat. For the identified protocol features (fingerprints), a fingerprint database shall be formed, which shall be continuously updated and maintained to support the effective matching retrieval function.(4)
Reliable operation capability: situational awareness technology equipment needs to have reliable operation capability to ensure long-term normal operation. Any interruption of the operation process may cause inaccurate perception information.(5)
Business diversion capability: after all kinds of information are accurately identified, they should be redirected in a certain way; that is, after classifying the information, the next step is processed in a targeted manner. This can not only make the data information more accurate, but also greatly reduce the background processing load, improve operating efficiency, and save memory capacity.


## 2.1.1. Related Situational Awareness Profiles

Situational awareness was first proposed by Endsley et al. in 1988. It is defined as “the extraction and understanding of the surrounding environmental factors within a certain time and space, and the prediction of the future development trend.” Situational awareness originated from the military field and was soon applied to other fields. The application of situational awareness in network security is even more extensive and far-reaching; in enterprise information security management, the defense-discovery-repair approach is adopted [18].


## 2.1.2. Situational Awareness Model

The three-layer situational awareness model visually represented in Figure1 is a widely accepted general theoretical model given by Endsley. The model is composed of situational element extraction, situational understanding, and situational prediction and plays an important role in the subsequent research on network security situational awareness systems.Figure 1
3-layer situational awareness model.


## 2.1.3. Security Situation Forecast

Security situation prediction is the highest level technology in the whole situational awareness model [19]. The prediction of network security situation plays an important role in the defense of network security. The definition of situation prediction is to make a preestimation of the events or scenarios that will occur in the future to determine the probability of its occurrence, which usually requires rigorous investigation and observation, and artificial intelligence algorithms such as machine learning and deep learning can discover and identify potential patterns in input data and output of the required prediction information. They have achieved great success in computer vision, natural language processing, and other fields and are widely used in artificial intelligence algorithms. They have also been used in network security situation prediction and achieved initial results. Therefore, according to certain scientific basis, through the analysis and study of relevant factors, a specific prediction model as shown in Figure 2 is established.Figure 2
Security situation prediction model.


## 2.1.4. Cybersecurity Situational Awareness

The network situation is a network state and changing trend, which is affected by factors such as different types of network operating conditions, network behaviors, and user behaviors. These behaviors are combined together to form a network situation. In a large-scale network environment, we can select those security elements for analysis, fully understand the changes in the network situation, and use big data technology to process different types of information. The perception platform integrates user terminals, through different types of perception data sources, fully explores technologies, understands intelligent algorithms, and improves the sensitivity of the network security situational awareness platform.Situational awareness describes the network system and requires a full understanding of its microstate, which is reflected by various connection parameters. After in-depth mining of parameters, determine the correlation and development trend of information, and use related tools (algorithms or measures) to detect and perceive, and associate the data and information from detection and perception in some way to form knowledge. This completes a basic process of situational awareness as shown in Figure3.Figure 3
Conceptual model of network security situational awareness.We know that the biggest feature of network situational awareness [20] is the need to measure the physical network. The following abilities serve as support:(1)
Big data processing capability: the Internet is huge, and a large amount of concurrent data traffic is transmitted through each node. In this kind of data reanalysis, Network maintenance personnel cannot meet the requirements of the end-of-network activity and the characteristics of the network situation rate. Therefore, the sampling method to detect abnormal network activities cannot meet the requirements. Network situational awareness must have the ability of very good processing power for massive data.(2)
Fine analysis capability: the detection of data packets must meet fine-grained requirements, and various data streams and parameters must be efficiently retrieved and matched. To achieve a good perception of the network microstate, in addition to the traditional key physical parameters (source and destination addresses, ports, and protocol types), situational awareness technology must also have the ability to identify multiple logical parameters.(3)
Protocol identification capability: as an important parameter, the protocol type is very important to accurately identify it. In the process of implementing situational awareness, in addition to identifying widely used Internet standard protocols (such as TCP/IP protocol suite, etc.), other nonstandard and private protocols should also be captured as much as possible. Security poses a threat. For the identified protocol features (fingerprints), a fingerprint database shall be formed, which shall be continuously updated and maintained to support the effective matching retrieval function.(4)
Reliable operation capability: situational awareness technology equipment needs to have reliable operation capability to ensure long-term normal operation. Any interruption of the operation process may cause inaccurate perception information.(5)
Business diversion capability: after all kinds of information are accurately identified, they should be redirected in a certain way; that is, after classifying the information, the next step is processed in a targeted manner. This can not only make the data information more accurate, but also greatly reduce the background processing load, improve operating efficiency, and save memory capacity.


## 3. Hidden Markov Model

Hidden Markov model is a commonly used probability model in statistics. In this section, the concept of hidden Markov model is introduced from the classic stock market problem, and then three types of problems and solutions of hidden Markov model are introduced. The observation sequence problem extends the one-dimensional hidden Markov model to a multidimensional hidden Markov model.


### 3.1. Overview of Hidden Markov Models (HMM)

Hidden Markov model (HMM) is a powerful probabilistic modeling tool for characterizing implicit stochastic processes with observable sequences. HMM have been used in areas such as signal processing, pattern recognition, and machine learning. At the beginning of the twentieth century, Andrei Markov proposed the mathematical theory of Markov Process. Until 1960, Baum and his colleagues proposed and developed the hidden Markov theory model.Figure4 depicts a simple example of a Markov process used to describe changes in the stock market. This stochastic process divides the daily changes of the stock market into three states: A city, B city, and a volatile market, which correspond to three observations of a stock's stock price rising, falling, and remaining unchanged. The transition between states is a Markov process with limited time discrete state space, also known as a Markov chain.Figure 4
Markov process example.Assuming that the probability that the stock is in city A on the first day is 0.7, if it is observed that the stock is rising-falling-falling for three consecutive days, then it can be inferred that the changing state of the stock for three consecutive days is city A-city B-city B, and we can calculate the probability of this happening as(1)p=0.7×0.2×0.5.If each state is allowed to correspond to multiple observations, for example, when the stock is in market A, not only is there an increase in one observation, but also a decrease or shock may be observed, and the Markov chain can be extended to a hidden Markov model. This change can make the model more expressive. In Figure5, the stock may also fluctuate or decline slightly in the state of city A. If the stock is observed to rise-fall-fall for three consecutive days, it cannot be said that the stock must be in the B market, so the stock state is “hidden” and can exist in any state sequence with a certain probability.Figure 5
Hidden Markov model example.The mathematical definition of hidden Markov model can be given as follows:(2)λ=A,B,π.S is the set of hidden states and V is the set of observable states:(3)S=s1,s2,…,sN,V=v1,v2,…,vM.Then define the hidden state sequenceQ of length T and the corresponding observation sequence O:(4)Q=q1,q2,…,qT,O=o1,o2,…,oT.A is the implicit state transition matrix. The elementaij of the matrix represents the probability of transitioning from state i to state j. Note that the state transition probability is independent of time:(5)A=aij,aij=Pqt=Sj|qt−1=Si.B is the observation matrix, and the elementbik of the matrix represents the probability of observing vk in the hidden state i of the system. This probability is also independent of time:(6)B=bik,bik=Pxt=vk|qt=Si.π is the initial probability distribution matrix, and the elements represent the probability that the system is in each hidden state at the initial moment:(7)π=πi,πi=Pq1=Si.The HMM makes two assumptions. The first one is called the Markov assumption, which considers that the current state of the system only depends on the state of the system at the previous moment, which is expressed as(8)Pqt|q1t−1=Pqt|qt−1.The second assumption is called the independence assumption, which considers that the observed state of the system only depends on the implicit state of the system at the current moment, which is expressed as(9)Pot|o1t−1,q1t=Pot|qt.


### 3.2. Hidden Markov Three Kinds of Problems

For HMM to be useful in practical applications, three problems related to them must be solved, which are estimation problem, decoding problem, and learning problem.


#### 3.2.1. Estimation Problem

Given an HMM modelλ, calculate the probability PO|λ of occurrence of observation sequence O. This problem can be viewed as evaluating the ability of a known model to predict a given sequence of observations, and by comparing PO|λ the most appropriate model can be selected. Given a sequence of hidden states Q, the probability of observing sequence O is(10)PO|Q,λ=∏t=1TPot|qt,λ=bq1o1bq2o2⋯bqToT.The probability of occurrence of the hidden state sequenceQ is(11)PQ|λ=πq1aq1q2aq2q3⋯aqr−1qr.Given a model, the observation probability can be calculated:(12)PO|λ=∑QPO|Q,λPQ|λ=∑q1⋯qrπq1bq1o1aq1q2bq2o2aq2q3⋯aqr−1qrbqToT.From this, the probability of occurrence of observation sequence O for a given model can be calculated, but its time complexity is in the exponential form with respect to timeT (to be precise, it requires 2T.NT calculations). There are a large number of identical operations in the abovementioned calculation process, and these redundant operations can be reduced by means of cache calculation, so as to achieve the purpose of reducing the time complexity. The meshed grid is used to cache the operations that need to be repeated in the calculation process, and the grid can be moved forward until time T to obtain the result. This method is called the forward algorithm. To this end, an intermediate variable α needs to be introduced, which represents the probability that the implicit state is si and the observation sequence o1,o2,⋯,ot is at time t:(13)αti=Po1o2⋯ot,qt=si|λ.The specific algorithm is as follows:(1)
Initialization:(14)α1i=πibio1,1≤i≤N.(2)
Recursion:(15)αt+1j=∑i−1Nαtiαijbjot+1,1≤t≤T−1,1≤j≤N.(3)
Termination:(16)PO|λ=∑i−1NαTi.Strictly speaking, the forward algorithm can solve the evaluation problem, but in order to solve the learning problem, a backward algorithm must be introduced, which can also solve the evaluation problem. Similar to the forward algorithm, define an intermediate variableβ, given the state si at time t, the probability of observing the sequence from ot+1 to oT:(17)β1i=Pot+1ot+2⋯oT|qt=si˙,λ.Unlike the forward algorithm, the backward algorithm recurses from the back to the front. The specific algorithm is as follows:(1)
Initialization:(18)βTi=1,1≤i≤N.(2)
Recursion:(19)βti=∑j=1NaijbjOt+1βt+1j,t=T−1,T−2,⋯1,1≤i≤N.(3)
Termination:(20)PO|λ=∑i=1Nπibio1βii.


#### 3.2.2. Decoding Problem

The purpose of decoding is to find the hidden state sequence that is most likely to produce a given observation sequence, that is, the known modelλ, and to find the hidden state sequence Q that makes the observation sequence O most likely to appear. The best solution to the decoding problem is to use the Viterbi algorithm, which is another grid algorithm, similar to the forward algorithm, except that the probability at each moment is maximized instead of summing. We can define(21)δti=maxq1,q2,⋯,t−1Pq1q2⋯qt=sio1,o2,…,ot|λ,which is the probability of the most likely hidden state path that makes the observation sequence appear up to timet. The Viterbi algorithm is as follows:(1)
Initialization:(22)δti=πibio1，1≤i≤N,Ψ1i=0.(2)
Recursion:(23)δtj=max1≤i≤Nδtiaijbjo1,2≤t≤T,1≤j≤N,Ψ1j=argmax1≤i≤Nδtiaij,2≤t≤T,1≤j≤N.(3)
Termination:(24)P∗=max1≤i≤Nδri,qr∗=argmax1≤i≤Nδri.(4)
Backtracking of the optimal state sequence:(25)qt∗=Ψt+1qt+1∗,t=T−1,T−2,…1.The main difference between the Viterbi algorithm and the forward algorithm is that the Viterbi algorithm maximizes the probability in the recursive process, rather than summing it up, and stores the state when the probability is the largest, so as to end the used backtracking.Backtracking allows finding the optimal sequence of states from the states stored in the recursive steps, and there is no easy way to find a suboptimal sequence of states.


#### 3.2.3. Learning Problems

Learning problems are divided into two categories: supervised and unsupervised, corresponding to two standard solutions. Learning problems are divided into two categories: supervised and unsupervised, corresponding to two standard solutions. If the training data set used to solve the learning problem is supervised, that is, when the observation sequence is given, the corresponding hidden state sequence is also specified, and a supervised learning algorithm is used. If the training data set is unsupervised, that is, only the observation sequence is given, the unsupervised learning algorithm, also known as the B-W algorithm, can be used.The B-W algorithm, jointly proposed by Baum and his colleagues, is a very classic algorithm for solving model parameter selection problems.In order to describe the estimation process of HMM parameters, the B-W algorithm first defines an intermediate variable to represent the probability of statesi at time t and state si+1 at time t+1 under the premise of given model parameters and observation sequence:(26)ξti,j=Pqt=si,qt+1=sj|O,λ.The B-W algorithm uses the forward algorithm at timet and the backward algorithm at time t+1, which cleverly combines the forward algorithm and the backward algorithm, also known as the forward-backward algorithm, and ξti,j is also called the forward algorithm Backward variable.According to the Bayesian formula, the forward-backward variable announcement can be written as:(27)ξti,j=αtiaijbjOt+1βt+1jPO|λ,ξti,j=αtiaijbjOt+1βt+1j∑i=1N∑j=1NαtiaijbjOt+1βt+1j,In the formula, the numerator term isPqt=si,qt+1=sj,O|λ, and the denominator term is PO|λ, which is obtained by the full probability formula.Defineγti as the probability that the model is in state si at time t, and establish the relationship between γti and ξti,j as follows:(28)γti=∑j=1Nξti,j.The value obtained by the summation ofγti at time t can be used to represent the expectation of the number of visits to state si, that is, the expectation of the number of transitions from state si. Likewise, the result of summing ξti,j over time can be used to express the expectation of the number of transfers from si to sj.The idea of the B-W algorithm is to iteratively obtain the new model parameterλ¯. Once PO|λ¯>PO|λ is found, λ¯ is assigned to λ and iteratively calculates until PO|λ no longer changes significantly. Therefore, unfortunately, this algorithm can only obtain the local optimum. In order to calculate λ¯ efficiently, a helper function for λ¯ is introduced:(29)Lλ,λ¯=∑QlogPO,Q|λPO,Q|λ¯.The expectation of the joint distributionPO,Q|λ is based on the conditional probability PO,Q|λ¯.The log-likelihood functionfλ=logPO,Q|λ is a concave function, according to Jensen's inequality:(30)fEλ=fEλ¯≥Efλ.Both sides of the above equation can be written as(31)Efλ=∑QlogPO,Q|λPO,Q|λ¯=Lλ,λ¯,fEλ¯=∑QlogPO,Q|λPO,Q|λ¯=logPO|λ¯,logPO|λ¯≥Lλ,λ¯.No matter howλ¯ changes, as long as Lλ,λ¯ is increased, the infimum of PO|λ can be increased, and then maximizing Lλ,λ¯ can increase the probability of PO|λ, namely,(32)maxλ¯Lλ,λ¯⇒PO|λ¯≥PO|λ.Therefore, iterative calculation can makePO|λ converge to the maximum point. (33)PO,Q|λ=πq1bq1o1aq1q2bq2o2aq2q3⋯bqroraqr−1qr.Lλ,λ¯ can be split into three items:(34)Lλ,λ¯=∑QlogPO,Q|λPO,Q|λ¯,Lλ,λ¯=∑Qlogπq1PO,Q|λ¯+∑Q∑t=1T−1logaqrqr+1PO,Q|λ¯+∑Q∑t=1TlogbqrotPO,Q|λ¯.For solving the above problems, there are three natural constraints:(35)∑i=1Nπi¯=1,∑j=1Naij¯=1,1≤i≤N,∑k⇐1Mbj¯k=1,1≤j≤N.According to the Lagrange multiplier method, combined with the above constraints, the extreme value of each component ofLλ,λ¯ can be obtained, and the one-step optimal estimation of the HMM parameters can be obtained:(36)π¯i=γti,aij¯=∑t=1T−1ξti,j∑t=1T−1γti,bj¯k=∑t=1,ot=vkT−1γti∑t=1T−1γti.The new model parameterλ is obtained iteratively from the above. Once PO|λ¯≥PO|λ is found, λ¯ is assigned to λ, and the iterative calculation is performed until PO|λ no longer changes significantly, and the final stone is used as the parameter estimation result of HMM.The B-W algorithm cleverly uses the idea of maximum likelihood estimation to obtain the model parameterλ that maximizes PO|λ.


### 3.3. A Brief Introduction to Multidimensional Hidden Markov Models

For the n-dimensional mutually coupled observation sequenceO1,O2,…,On, it can be modeled as λ1,λ2,…,λn, respectively:(37)P1O1,O2,…,On=POl∏m=1,m≠lnPOm|Ql,where l,m=1,2,…,n.The n-dimensional HMM learning algorithm is(38)Ql=aryQlmaxPOl,Ql∏m=1,m≠lnPOm|Ql.


## 3.1. Overview of Hidden Markov Models (HMM)

Hidden Markov model (HMM) is a powerful probabilistic modeling tool for characterizing implicit stochastic processes with observable sequences. HMM have been used in areas such as signal processing, pattern recognition, and machine learning. At the beginning of the twentieth century, Andrei Markov proposed the mathematical theory of Markov Process. Until 1960, Baum and his colleagues proposed and developed the hidden Markov theory model.Figure4 depicts a simple example of a Markov process used to describe changes in the stock market. This stochastic process divides the daily changes of the stock market into three states: A city, B city, and a volatile market, which correspond to three observations of a stock's stock price rising, falling, and remaining unchanged. The transition between states is a Markov process with limited time discrete state space, also known as a Markov chain.Figure 4
Markov process example.Assuming that the probability that the stock is in city A on the first day is 0.7, if it is observed that the stock is rising-falling-falling for three consecutive days, then it can be inferred that the changing state of the stock for three consecutive days is city A-city B-city B, and we can calculate the probability of this happening as(1)p=0.7×0.2×0.5.If each state is allowed to correspond to multiple observations, for example, when the stock is in market A, not only is there an increase in one observation, but also a decrease or shock may be observed, and the Markov chain can be extended to a hidden Markov model. This change can make the model more expressive. In Figure5, the stock may also fluctuate or decline slightly in the state of city A. If the stock is observed to rise-fall-fall for three consecutive days, it cannot be said that the stock must be in the B market, so the stock state is “hidden” and can exist in any state sequence with a certain probability.Figure 5
Hidden Markov model example.The mathematical definition of hidden Markov model can be given as follows:(2)λ=A,B,π.S is the set of hidden states and V is the set of observable states:(3)S=s1,s2,…,sN,V=v1,v2,…,vM.Then define the hidden state sequenceQ of length T and the corresponding observation sequence O:(4)Q=q1,q2,…,qT,O=o1,o2,…,oT.A is the implicit state transition matrix. The elementaij of the matrix represents the probability of transitioning from state i to state j. Note that the state transition probability is independent of time:(5)A=aij,aij=Pqt=Sj|qt−1=Si.B is the observation matrix, and the elementbik of the matrix represents the probability of observing vk in the hidden state i of the system. This probability is also independent of time:(6)B=bik,bik=Pxt=vk|qt=Si.π is the initial probability distribution matrix, and the elements represent the probability that the system is in each hidden state at the initial moment:(7)π=πi,πi=Pq1=Si.The HMM makes two assumptions. The first one is called the Markov assumption, which considers that the current state of the system only depends on the state of the system at the previous moment, which is expressed as(8)Pqt|q1t−1=Pqt|qt−1.The second assumption is called the independence assumption, which considers that the observed state of the system only depends on the implicit state of the system at the current moment, which is expressed as(9)Pot|o1t−1,q1t=Pot|qt.


## 3.2. Hidden Markov Three Kinds of Problems

For HMM to be useful in practical applications, three problems related to them must be solved, which are estimation problem, decoding problem, and learning problem.


### 3.2.1. Estimation Problem

Given an HMM modelλ, calculate the probability PO|λ of occurrence of observation sequence O. This problem can be viewed as evaluating the ability of a known model to predict a given sequence of observations, and by comparing PO|λ the most appropriate model can be selected. Given a sequence of hidden states Q, the probability of observing sequence O is(10)PO|Q,λ=∏t=1TPot|qt,λ=bq1o1bq2o2⋯bqToT.The probability of occurrence of the hidden state sequenceQ is(11)PQ|λ=πq1aq1q2aq2q3⋯aqr−1qr.Given a model, the observation probability can be calculated:(12)PO|λ=∑QPO|Q,λPQ|λ=∑q1⋯qrπq1bq1o1aq1q2bq2o2aq2q3⋯aqr−1qrbqToT.From this, the probability of occurrence of observation sequence O for a given model can be calculated, but its time complexity is in the exponential form with respect to timeT (to be precise, it requires 2T.NT calculations). There are a large number of identical operations in the abovementioned calculation process, and these redundant operations can be reduced by means of cache calculation, so as to achieve the purpose of reducing the time complexity. The meshed grid is used to cache the operations that need to be repeated in the calculation process, and the grid can be moved forward until time T to obtain the result. This method is called the forward algorithm. To this end, an intermediate variable α needs to be introduced, which represents the probability that the implicit state is si and the observation sequence o1,o2,⋯,ot is at time t:(13)αti=Po1o2⋯ot,qt=si|λ.The specific algorithm is as follows:(1)
Initialization:(14)α1i=πibio1,1≤i≤N.(2)
Recursion:(15)αt+1j=∑i−1Nαtiαijbjot+1,1≤t≤T−1,1≤j≤N.(3)
Termination:(16)PO|λ=∑i−1NαTi.Strictly speaking, the forward algorithm can solve the evaluation problem, but in order to solve the learning problem, a backward algorithm must be introduced, which can also solve the evaluation problem. Similar to the forward algorithm, define an intermediate variableβ, given the state si at time t, the probability of observing the sequence from ot+1 to oT:(17)β1i=Pot+1ot+2⋯oT|qt=si˙,λ.Unlike the forward algorithm, the backward algorithm recurses from the back to the front. The specific algorithm is as follows:(1)
Initialization:(18)βTi=1,1≤i≤N.(2)
Recursion:(19)βti=∑j=1NaijbjOt+1βt+1j,t=T−1,T−2,⋯1,1≤i≤N.(3)
Termination:(20)PO|λ=∑i=1Nπibio1βii.


### 3.2.2. Decoding Problem

The purpose of decoding is to find the hidden state sequence that is most likely to produce a given observation sequence, that is, the known modelλ, and to find the hidden state sequence Q that makes the observation sequence O most likely to appear. The best solution to the decoding problem is to use the Viterbi algorithm, which is another grid algorithm, similar to the forward algorithm, except that the probability at each moment is maximized instead of summing. We can define(21)δti=maxq1,q2,⋯,t−1Pq1q2⋯qt=sio1,o2,…,ot|λ,which is the probability of the most likely hidden state path that makes the observation sequence appear up to timet. The Viterbi algorithm is as follows:(1)
Initialization:(22)δti=πibio1，1≤i≤N,Ψ1i=0.(2)
Recursion:(23)δtj=max1≤i≤Nδtiaijbjo1,2≤t≤T,1≤j≤N,Ψ1j=argmax1≤i≤Nδtiaij,2≤t≤T,1≤j≤N.(3)
Termination:(24)P∗=max1≤i≤Nδri,qr∗=argmax1≤i≤Nδri.(4)
Backtracking of the optimal state sequence:(25)qt∗=Ψt+1qt+1∗,t=T−1,T−2,…1.The main difference between the Viterbi algorithm and the forward algorithm is that the Viterbi algorithm maximizes the probability in the recursive process, rather than summing it up, and stores the state when the probability is the largest, so as to end the used backtracking.Backtracking allows finding the optimal sequence of states from the states stored in the recursive steps, and there is no easy way to find a suboptimal sequence of states.


### 3.2.3. Learning Problems

Learning problems are divided into two categories: supervised and unsupervised, corresponding to two standard solutions. Learning problems are divided into two categories: supervised and unsupervised, corresponding to two standard solutions. If the training data set used to solve the learning problem is supervised, that is, when the observation sequence is given, the corresponding hidden state sequence is also specified, and a supervised learning algorithm is used. If the training data set is unsupervised, that is, only the observation sequence is given, the unsupervised learning algorithm, also known as the B-W algorithm, can be used.The B-W algorithm, jointly proposed by Baum and his colleagues, is a very classic algorithm for solving model parameter selection problems.In order to describe the estimation process of HMM parameters, the B-W algorithm first defines an intermediate variable to represent the probability of statesi at time t and state si+1 at time t+1 under the premise of given model parameters and observation sequence:(26)ξti,j=Pqt=si,qt+1=sj|O,λ.The B-W algorithm uses the forward algorithm at timet and the backward algorithm at time t+1, which cleverly combines the forward algorithm and the backward algorithm, also known as the forward-backward algorithm, and ξti,j is also called the forward algorithm Backward variable.According to the Bayesian formula, the forward-backward variable announcement can be written as:(27)ξti,j=αtiaijbjOt+1βt+1jPO|λ,ξti,j=αtiaijbjOt+1βt+1j∑i=1N∑j=1NαtiaijbjOt+1βt+1j,In the formula, the numerator term isPqt=si,qt+1=sj,O|λ, and the denominator term is PO|λ, which is obtained by the full probability formula.Defineγti as the probability that the model is in state si at time t, and establish the relationship between γti and ξti,j as follows:(28)γti=∑j=1Nξti,j.The value obtained by the summation ofγti at time t can be used to represent the expectation of the number of visits to state si, that is, the expectation of the number of transitions from state si. Likewise, the result of summing ξti,j over time can be used to express the expectation of the number of transfers from si to sj.The idea of the B-W algorithm is to iteratively obtain the new model parameterλ¯. Once PO|λ¯>PO|λ is found, λ¯ is assigned to λ and iteratively calculates until PO|λ no longer changes significantly. Therefore, unfortunately, this algorithm can only obtain the local optimum. In order to calculate λ¯ efficiently, a helper function for λ¯ is introduced:(29)Lλ,λ¯=∑QlogPO,Q|λPO,Q|λ¯.The expectation of the joint distributionPO,Q|λ is based on the conditional probability PO,Q|λ¯.The log-likelihood functionfλ=logPO,Q|λ is a concave function, according to Jensen's inequality:(30)fEλ=fEλ¯≥Efλ.Both sides of the above equation can be written as(31)Efλ=∑QlogPO,Q|λPO,Q|λ¯=Lλ,λ¯,fEλ¯=∑QlogPO,Q|λPO,Q|λ¯=logPO|λ¯,logPO|λ¯≥Lλ,λ¯.No matter howλ¯ changes, as long as Lλ,λ¯ is increased, the infimum of PO|λ can be increased, and then maximizing Lλ,λ¯ can increase the probability of PO|λ, namely,(32)maxλ¯Lλ,λ¯⇒PO|λ¯≥PO|λ.Therefore, iterative calculation can makePO|λ converge to the maximum point. (33)PO,Q|λ=πq1bq1o1aq1q2bq2o2aq2q3⋯bqroraqr−1qr.Lλ,λ¯ can be split into three items:(34)Lλ,λ¯=∑QlogPO,Q|λPO,Q|λ¯,Lλ,λ¯=∑Qlogπq1PO,Q|λ¯+∑Q∑t=1T−1logaqrqr+1PO,Q|λ¯+∑Q∑t=1TlogbqrotPO,Q|λ¯.For solving the above problems, there are three natural constraints:(35)∑i=1Nπi¯=1,∑j=1Naij¯=1,1≤i≤N,∑k⇐1Mbj¯k=1,1≤j≤N.According to the Lagrange multiplier method, combined with the above constraints, the extreme value of each component ofLλ,λ¯ can be obtained, and the one-step optimal estimation of the HMM parameters can be obtained:(36)π¯i=γti,aij¯=∑t=1T−1ξti,j∑t=1T−1γti,bj¯k=∑t=1,ot=vkT−1γti∑t=1T−1γti.The new model parameterλ is obtained iteratively from the above. Once PO|λ¯≥PO|λ is found, λ¯ is assigned to λ, and the iterative calculation is performed until PO|λ no longer changes significantly, and the final stone is used as the parameter estimation result of HMM.The B-W algorithm cleverly uses the idea of maximum likelihood estimation to obtain the model parameterλ that maximizes PO|λ.


## 3.2.1. Estimation Problem

Given an HMM modelλ, calculate the probability PO|λ of occurrence of observation sequence O. This problem can be viewed as evaluating the ability of a known model to predict a given sequence of observations, and by comparing PO|λ the most appropriate model can be selected. Given a sequence of hidden states Q, the probability of observing sequence O is(10)PO|Q,λ=∏t=1TPot|qt,λ=bq1o1bq2o2⋯bqToT.The probability of occurrence of the hidden state sequenceQ is(11)PQ|λ=πq1aq1q2aq2q3⋯aqr−1qr.Given a model, the observation probability can be calculated:(12)PO|λ=∑QPO|Q,λPQ|λ=∑q1⋯qrπq1bq1o1aq1q2bq2o2aq2q3⋯aqr−1qrbqToT.From this, the probability of occurrence of observation sequence O for a given model can be calculated, but its time complexity is in the exponential form with respect to timeT (to be precise, it requires 2T.NT calculations). There are a large number of identical operations in the abovementioned calculation process, and these redundant operations can be reduced by means of cache calculation, so as to achieve the purpose of reducing the time complexity. The meshed grid is used to cache the operations that need to be repeated in the calculation process, and the grid can be moved forward until time T to obtain the result. This method is called the forward algorithm. To this end, an intermediate variable α needs to be introduced, which represents the probability that the implicit state is si and the observation sequence o1,o2,⋯,ot is at time t:(13)αti=Po1o2⋯ot,qt=si|λ.The specific algorithm is as follows:(1)
Initialization:(14)α1i=πibio1,1≤i≤N.(2)
Recursion:(15)αt+1j=∑i−1Nαtiαijbjot+1,1≤t≤T−1,1≤j≤N.(3)
Termination:(16)PO|λ=∑i−1NαTi.Strictly speaking, the forward algorithm can solve the evaluation problem, but in order to solve the learning problem, a backward algorithm must be introduced, which can also solve the evaluation problem. Similar to the forward algorithm, define an intermediate variableβ, given the state si at time t, the probability of observing the sequence from ot+1 to oT:(17)β1i=Pot+1ot+2⋯oT|qt=si˙,λ.Unlike the forward algorithm, the backward algorithm recurses from the back to the front. The specific algorithm is as follows:(1)
Initialization:(18)βTi=1,1≤i≤N.(2)
Recursion:(19)βti=∑j=1NaijbjOt+1βt+1j,t=T−1,T−2,⋯1,1≤i≤N.(3)
Termination:(20)PO|λ=∑i=1Nπibio1βii.


## 3.2.2. Decoding Problem

The purpose of decoding is to find the hidden state sequence that is most likely to produce a given observation sequence, that is, the known modelλ, and to find the hidden state sequence Q that makes the observation sequence O most likely to appear. The best solution to the decoding problem is to use the Viterbi algorithm, which is another grid algorithm, similar to the forward algorithm, except that the probability at each moment is maximized instead of summing. We can define(21)δti=maxq1,q2,⋯,t−1Pq1q2⋯qt=sio1,o2,…,ot|λ,which is the probability of the most likely hidden state path that makes the observation sequence appear up to timet. The Viterbi algorithm is as follows:(1)
Initialization:(22)δti=πibio1，1≤i≤N,Ψ1i=0.(2)
Recursion:(23)δtj=max1≤i≤Nδtiaijbjo1,2≤t≤T,1≤j≤N,Ψ1j=argmax1≤i≤Nδtiaij,2≤t≤T,1≤j≤N.(3)
Termination:(24)P∗=max1≤i≤Nδri,qr∗=argmax1≤i≤Nδri.(4)
Backtracking of the optimal state sequence:(25)qt∗=Ψt+1qt+1∗,t=T−1,T−2,…1.The main difference between the Viterbi algorithm and the forward algorithm is that the Viterbi algorithm maximizes the probability in the recursive process, rather than summing it up, and stores the state when the probability is the largest, so as to end the used backtracking.Backtracking allows finding the optimal sequence of states from the states stored in the recursive steps, and there is no easy way to find a suboptimal sequence of states.


## 3.2.3. Learning Problems

Learning problems are divided into two categories: supervised and unsupervised, corresponding to two standard solutions. Learning problems are divided into two categories: supervised and unsupervised, corresponding to two standard solutions. If the training data set used to solve the learning problem is supervised, that is, when the observation sequence is given, the corresponding hidden state sequence is also specified, and a supervised learning algorithm is used. If the training data set is unsupervised, that is, only the observation sequence is given, the unsupervised learning algorithm, also known as the B-W algorithm, can be used.The B-W algorithm, jointly proposed by Baum and his colleagues, is a very classic algorithm for solving model parameter selection problems.In order to describe the estimation process of HMM parameters, the B-W algorithm first defines an intermediate variable to represent the probability of statesi at time t and state si+1 at time t+1 under the premise of given model parameters and observation sequence:(26)ξti,j=Pqt=si,qt+1=sj|O,λ.The B-W algorithm uses the forward algorithm at timet and the backward algorithm at time t+1, which cleverly combines the forward algorithm and the backward algorithm, also known as the forward-backward algorithm, and ξti,j is also called the forward algorithm Backward variable.According to the Bayesian formula, the forward-backward variable announcement can be written as:(27)ξti,j=αtiaijbjOt+1βt+1jPO|λ,ξti,j=αtiaijbjOt+1βt+1j∑i=1N∑j=1NαtiaijbjOt+1βt+1j,In the formula, the numerator term isPqt=si,qt+1=sj,O|λ, and the denominator term is PO|λ, which is obtained by the full probability formula.Defineγti as the probability that the model is in state si at time t, and establish the relationship between γti and ξti,j as follows:(28)γti=∑j=1Nξti,j.The value obtained by the summation ofγti at time t can be used to represent the expectation of the number of visits to state si, that is, the expectation of the number of transitions from state si. Likewise, the result of summing ξti,j over time can be used to express the expectation of the number of transfers from si to sj.The idea of the B-W algorithm is to iteratively obtain the new model parameterλ¯. Once PO|λ¯>PO|λ is found, λ¯ is assigned to λ and iteratively calculates until PO|λ no longer changes significantly. Therefore, unfortunately, this algorithm can only obtain the local optimum. In order to calculate λ¯ efficiently, a helper function for λ¯ is introduced:(29)Lλ,λ¯=∑QlogPO,Q|λPO,Q|λ¯.The expectation of the joint distributionPO,Q|λ is based on the conditional probability PO,Q|λ¯.The log-likelihood functionfλ=logPO,Q|λ is a concave function, according to Jensen's inequality:(30)fEλ=fEλ¯≥Efλ.Both sides of the above equation can be written as(31)Efλ=∑QlogPO,Q|λPO,Q|λ¯=Lλ,λ¯,fEλ¯=∑QlogPO,Q|λPO,Q|λ¯=logPO|λ¯,logPO|λ¯≥Lλ,λ¯.No matter howλ¯ changes, as long as Lλ,λ¯ is increased, the infimum of PO|λ can be increased, and then maximizing Lλ,λ¯ can increase the probability of PO|λ, namely,(32)maxλ¯Lλ,λ¯⇒PO|λ¯≥PO|λ.Therefore, iterative calculation can makePO|λ converge to the maximum point. (33)PO,Q|λ=πq1bq1o1aq1q2bq2o2aq2q3⋯bqroraqr−1qr.Lλ,λ¯ can be split into three items:(34)Lλ,λ¯=∑QlogPO,Q|λPO,Q|λ¯,Lλ,λ¯=∑Qlogπq1PO,Q|λ¯+∑Q∑t=1T−1logaqrqr+1PO,Q|λ¯+∑Q∑t=1TlogbqrotPO,Q|λ¯.For solving the above problems, there are three natural constraints:(35)∑i=1Nπi¯=1,∑j=1Naij¯=1,1≤i≤N,∑k⇐1Mbj¯k=1,1≤j≤N.According to the Lagrange multiplier method, combined with the above constraints, the extreme value of each component ofLλ,λ¯ can be obtained, and the one-step optimal estimation of the HMM parameters can be obtained:(36)π¯i=γti,aij¯=∑t=1T−1ξti,j∑t=1T−1γti,bj¯k=∑t=1,ot=vkT−1γti∑t=1T−1γti.The new model parameterλ is obtained iteratively from the above. Once PO|λ¯≥PO|λ is found, λ¯ is assigned to λ, and the iterative calculation is performed until PO|λ no longer changes significantly, and the final stone is used as the parameter estimation result of HMM.The B-W algorithm cleverly uses the idea of maximum likelihood estimation to obtain the model parameterλ that maximizes PO|λ.


## 3.3. A Brief Introduction to Multidimensional Hidden Markov Models

For the n-dimensional mutually coupled observation sequenceO1,O2,…,On, it can be modeled as λ1,λ2,…,λn, respectively:(37)P1O1,O2,…,On=POl∏m=1,m≠lnPOm|Ql,where l,m=1,2,…,n.The n-dimensional HMM learning algorithm is(38)Ql=aryQlmaxPOl,Ql∏m=1,m≠lnPOm|Ql.


## 4. Experimental Results and Analysis

By selecting the gateway computer that is easy to be attacked, the system is connected to the signal and the ATS intranet at the same time, as the attack object of the experiment. Select DDoS as the main attack method, conduct vulnerability scanning, MS17-010 vulnerability attack, and DDoS attack. Based on the above data, relevant experimental analysis was carried out.


### 4.1. Situation Assessment Experiment Results and Analysis

By collecting the situational factor index data of gateway computer, CI, and ZC when the system is running normally, the maximum likelihood estimation method is used to fit the probability distribution of the data, and the K-S test is used to determine the distribution and parameters of the data. Then, according to the distribution of the data, the Lloyd–Max method is used to divide the data into states, and the state division interval with the minimum quantization error is obtained.Taking the gateway computer as an example, the change and distribution of CPU usage within 1 hour are shown in Figures6 and 7. The real data and the CDF curve of the fitted t distribution basically coincide, and the K-S test result is passed; it can be considered that the gateway computer CPU usage follows a t distribution with parameters u = 10.6727, σ  = 0.5594, and ν  = 4.3870.Figure 6
Change of CPU usage in the gateway computer.Figure 7
Comparison of data of gateway computer and CDF of fittingt distribution.The change and distribution of RAM usage within 1 hour are shown in Figures8 and 9. The real data and the CDF curve fitting the Gaussian distribution basically coincide, and the K-S test result is passed; it can be considered that the RAM usage of the gateway computer obeys the Gaussian distribution. The parameters are u = 29.4752 and σ  = 0.3447.Figure 8
Change of RAM usage in the gateway computer.Figure 9
Comparison of RAM data of gateway computer and CDF of fitting Gaussian distribution.Figures10 and 11 show the change and distribution of the network sending rate within 1 hour. The real data basically coincides with the CDF curve fitting the t distribution, and has passed the K-S test. It can be considered that the gateway computer network sending rate obeys the t distribution. The parameters are u = 16.1603, σ=0.3524, and ν=3.7766.Figure 10
Change of transmission rate of the gateway computer network.Figure 11
Comparison of network transmission rate of gateway computer and CDF of fitting Gaussian distribution.Figures12 and 13 show the change and distribution of the network reception rate within 1 hour. The real data basically coincides with the CDF curve fitting the t distribution and has passed the K-S test. It can be considered that the gateway computer network reception rate obeys the t distribution. The parameters are u = 21.5830, σ  = 1.0182, and ν  = 4.3939.Figure 12
Change of receiving rate of the gateway computer network.Figure 13
Comparison of receiving rate of gateway computer network and fitting t distribution.The distribution and distribution parameters of each index data of the gateway computer are summarized as shown in Table1. The table lists the distribution and parameters of the gateway computer's CPU usage, RAM usage, network sending rate, and network receiving rate. Since the gateway computer is running, there is basically no data interaction with the disk, and the read rate and write rate of the disk are usually 0, so we will not do much research on it here.Table 1
Distribution and parameters of indicators of gateway computer.
IndexObey the distributionParameterCPU usaget distributionu = 10.6727, σ  = 0.5594, ν  = 4.3870RAM usageGaussian distributionu = 29.4752, σ  = 0.3447Network sending ratet distributionu = 16.1603, σ=0.3524, ν=3.7766Network reception ratet distributionu = 21.5830, σ  = 1.0182, ν  = 4.3939After obtaining the distribution of each indicator data, the Lloyd–Max algorithm can be used to quantify the data. The quantification interval of each indicator is shown in Table2.Table 2
Quantitative interval of indicators of gateway computer.
IndexQuantization intervalCPU usage010.2095 11.1813 12.8721 100.0000RAM usage027.1261 29.1398 32.0861 100.0000Network sending rate014.6692 15.9972 16.8667 30.0000Network reception rate019.4237 21.3072 22.9721 40.0000In the same steps, the distribution and distribution parameters of each index of CI are obtained, as shown in Table3. Since CI performs a large number of logical operations during the running process, it consumes a lot of CPU, and the average CPU usage rate reaches about 61%. However, the memory space occupied by the CI application software when running is smaller than that of the gateway application software, so the average RAM usage of the CI is slightly lower than that of the gateway computer.Table 3
Distribution and parameters of indicators of CI.
IndexObey the distributionParameterCPU usaget distributionu = 61.2727, σ  = 0.7584, ν  = 5.0870RAM usageGaussian distributionu = 19.5752, σ  = 0.5047Network sending ratet distributionu = 8.3603, σ=0.3124, ν=0.7766Network reception ratet distributionu = 21.0120, σ  = 0.7182, ν  = 0.8939The Lloyd–Max algorithm is used to quantify the data of each index of the CI, and the combined index is shown in Table4.Table 4
Quantitative interval of indicators of CI.
IndexQuantization intervalCPU usage059.2095 59.1813 61.8721 100.0000RAM usage016.9261 19.1398 22.0861 100.0000Network sending rate06.66920 10.9972 17.8667 30.0000Network reception rate013.4237 19.3072 25.9721 40.0000Table5 shows the distribution and distribution parameters of ZC index data. ZC simulation software does not have great hardware requirements, so the average of its CPU usage and RAM usage is at a low level.Table 5
Distribution and parameters of indicators of ZC.
IndexObey the distributionParameterCPU usaget distributionu = 15.9727, σ  = 0.2584RAM usageGaussian distributionu = 21.5752, σ  = 0.1047Network sending ratet distributionu = 9.3603, σ=0.3124, ν=0.7726Network reception ratet distributionu = 19.0120, σ  = 1.3182, ν  = 0.9339The Lloyd–Max algorithm is used to quantify the data of various indicators of ZC, and the quantification interval of each indicator is shown in Table6.Table 6
Quantitative interval of indicators of ZC.
IndexQuantization intervalCPU usage014.2095 16.1813 19.8721 100.0000RAM usage018.9261 21.1398 24.8861 100.0000Network sending rate07.66920 12.9872 18.8667 30.0000Network reception rate013.4937 19.9072 25.9891 40.0000Figure14 shows the change trend of the basic operation situation value of the system obtained by simulation. It can be seen from the figure that the change of situation value can be divided into three stages according to time. Around 20s, the situational value suddenly increased from 0 to 0.4, which is consistent with the vulnerability scanning event conducted by the attacker at this time. The posture value then returned to 0, indicating that the attacker had been scanning for vulnerabilities for a short period of time and had no other activity for a period of time. During the period of 34s to 54s, the situation value fluctuated between 0.4 and 0.9, and there was an obvious upward trend. During this period, the attacker used the MS-17010 vulnerability to attack the system and obtained the administrators of the devices in the system (permission), implanted the DDoS virus on the device, and then stopped activities for a period of time, and the situation value also returned to 0. During the period of 60s to 100s, the situation value fluctuates around 0.8, which is consistent with the event that the attackers control the devices of the system to launch DDoS attacks on the gateway computer. The attacker then ceased activity, and the situational value returned to 0.Figure 14
Change trend of situation value.The experimental results show that the fluctuation of the situation value corresponds to the different attack behaviors carried out by the attacker, which accurately describes the information security status of the system and verifies the effectiveness and accuracy of the situation awareness method proposed in this paper. And the time node of the change of the situation value is synchronized with the time node of the attacker's attack, which also verifies the real-time performance of the situation assessment method.


### 4.2. Situation Forecasting Experiment Results and Analysis

This section selects the trend of situation change from 60s to 70s and uses the first 20 data points as training samples and the last 10 data points as comparison samples to verify the situation prediction method. The selected data is shown in Figure15. Using ADF to check that the situation sequence is not a stationary sequence, the sequence needs to be stationary.Figure 15
The training sample set.The selected situation sequence is differentiated once, and the obtained difference sequence passes the ADF stationarity test. Therefore, the sequence difference is stopped, and the subsequent steps of ARIMA can be used to predict the situation sequence. The difference result is shown in Figure16.Figure 16
The result of 1 difference of situation values.The training samples are fitted by the ARIMA method [22]. Determine the model parameters of ARIMA as p = 3, d = 1, q = 4. The parameters in the formula are obtained by using the maximum likelihood estimation method: the constant term μ=−0.026513; the three autoregressive coefficients are ϕ1=−0.20651, ϕ2=−0.33681, and ϕ3=−0.4685; the four moving average coefficients are θ1=−0.54385, θ2=0.24325, θ3=−0.78119, and θ4=0.081789. Figure 17 shows the situation prediction result using this estimation model. It can be seen from the figure that the predicted value is basically consistent with the trend of the actual value. This shows that the ARIMA model has a high prediction accuracy for the information security situation value of the train control system.Figure 17
The result of the situation value prediction.The experimental results show that the situation prediction method based on ARIMA can effectively predict the short-term changes of the situation value, but because the ARIMA method produces the characteristic that the sequence tends to be stable, the predicted value will converge near the mean value of the real value, which cannot reflect the fluctuation of the situation value. It is suitable for short-term forecasts with high accuracy requirements.


## 4.1. Situation Assessment Experiment Results and Analysis

By collecting the situational factor index data of gateway computer, CI, and ZC when the system is running normally, the maximum likelihood estimation method is used to fit the probability distribution of the data, and the K-S test is used to determine the distribution and parameters of the data. Then, according to the distribution of the data, the Lloyd–Max method is used to divide the data into states, and the state division interval with the minimum quantization error is obtained.Taking the gateway computer as an example, the change and distribution of CPU usage within 1 hour are shown in Figures6 and 7. The real data and the CDF curve of the fitted t distribution basically coincide, and the K-S test result is passed; it can be considered that the gateway computer CPU usage follows a t distribution with parameters u = 10.6727, σ  = 0.5594, and ν  = 4.3870.Figure 6
Change of CPU usage in the gateway computer.Figure 7
Comparison of data of gateway computer and CDF of fittingt distribution.The change and distribution of RAM usage within 1 hour are shown in Figures8 and 9. The real data and the CDF curve fitting the Gaussian distribution basically coincide, and the K-S test result is passed; it can be considered that the RAM usage of the gateway computer obeys the Gaussian distribution. The parameters are u = 29.4752 and σ  = 0.3447.Figure 8
Change of RAM usage in the gateway computer.Figure 9
Comparison of RAM data of gateway computer and CDF of fitting Gaussian distribution.Figures10 and 11 show the change and distribution of the network sending rate within 1 hour. The real data basically coincides with the CDF curve fitting the t distribution, and has passed the K-S test. It can be considered that the gateway computer network sending rate obeys the t distribution. The parameters are u = 16.1603, σ=0.3524, and ν=3.7766.Figure 10
Change of transmission rate of the gateway computer network.Figure 11
Comparison of network transmission rate of gateway computer and CDF of fitting Gaussian distribution.Figures12 and 13 show the change and distribution of the network reception rate within 1 hour. The real data basically coincides with the CDF curve fitting the t distribution and has passed the K-S test. It can be considered that the gateway computer network reception rate obeys the t distribution. The parameters are u = 21.5830, σ  = 1.0182, and ν  = 4.3939.Figure 12
Change of receiving rate of the gateway computer network.Figure 13
Comparison of receiving rate of gateway computer network and fitting t distribution.The distribution and distribution parameters of each index data of the gateway computer are summarized as shown in Table1. The table lists the distribution and parameters of the gateway computer's CPU usage, RAM usage, network sending rate, and network receiving rate. Since the gateway computer is running, there is basically no data interaction with the disk, and the read rate and write rate of the disk are usually 0, so we will not do much research on it here.Table 1
Distribution and parameters of indicators of gateway computer.
IndexObey the distributionParameterCPU usaget distributionu = 10.6727, σ  = 0.5594, ν  = 4.3870RAM usageGaussian distributionu = 29.4752, σ  = 0.3447Network sending ratet distributionu = 16.1603, σ=0.3524, ν=3.7766Network reception ratet distributionu = 21.5830, σ  = 1.0182, ν  = 4.3939After obtaining the distribution of each indicator data, the Lloyd–Max algorithm can be used to quantify the data. The quantification interval of each indicator is shown in Table2.Table 2
Quantitative interval of indicators of gateway computer.
IndexQuantization intervalCPU usage010.2095 11.1813 12.8721 100.0000RAM usage027.1261 29.1398 32.0861 100.0000Network sending rate014.6692 15.9972 16.8667 30.0000Network reception rate019.4237 21.3072 22.9721 40.0000In the same steps, the distribution and distribution parameters of each index of CI are obtained, as shown in Table3. Since CI performs a large number of logical operations during the running process, it consumes a lot of CPU, and the average CPU usage rate reaches about 61%. However, the memory space occupied by the CI application software when running is smaller than that of the gateway application software, so the average RAM usage of the CI is slightly lower than that of the gateway computer.Table 3
Distribution and parameters of indicators of CI.
IndexObey the distributionParameterCPU usaget distributionu = 61.2727, σ  = 0.7584, ν  = 5.0870RAM usageGaussian distributionu = 19.5752, σ  = 0.5047Network sending ratet distributionu = 8.3603, σ=0.3124, ν=0.7766Network reception ratet distributionu = 21.0120, σ  = 0.7182, ν  = 0.8939The Lloyd–Max algorithm is used to quantify the data of each index of the CI, and the combined index is shown in Table4.Table 4
Quantitative interval of indicators of CI.
IndexQuantization intervalCPU usage059.2095 59.1813 61.8721 100.0000RAM usage016.9261 19.1398 22.0861 100.0000Network sending rate06.66920 10.9972 17.8667 30.0000Network reception rate013.4237 19.3072 25.9721 40.0000Table5 shows the distribution and distribution parameters of ZC index data. ZC simulation software does not have great hardware requirements, so the average of its CPU usage and RAM usage is at a low level.Table 5
Distribution and parameters of indicators of ZC.
IndexObey the distributionParameterCPU usaget distributionu = 15.9727, σ  = 0.2584RAM usageGaussian distributionu = 21.5752, σ  = 0.1047Network sending ratet distributionu = 9.3603, σ=0.3124, ν=0.7726Network reception ratet distributionu = 19.0120, σ  = 1.3182, ν  = 0.9339The Lloyd–Max algorithm is used to quantify the data of various indicators of ZC, and the quantification interval of each indicator is shown in Table6.Table 6
Quantitative interval of indicators of ZC.
IndexQuantization intervalCPU usage014.2095 16.1813 19.8721 100.0000RAM usage018.9261 21.1398 24.8861 100.0000Network sending rate07.66920 12.9872 18.8667 30.0000Network reception rate013.4937 19.9072 25.9891 40.0000Figure14 shows the change trend of the basic operation situation value of the system obtained by simulation. It can be seen from the figure that the change of situation value can be divided into three stages according to time. Around 20s, the situational value suddenly increased from 0 to 0.4, which is consistent with the vulnerability scanning event conducted by the attacker at this time. The posture value then returned to 0, indicating that the attacker had been scanning for vulnerabilities for a short period of time and had no other activity for a period of time. During the period of 34s to 54s, the situation value fluctuated between 0.4 and 0.9, and there was an obvious upward trend. During this period, the attacker used the MS-17010 vulnerability to attack the system and obtained the administrators of the devices in the system (permission), implanted the DDoS virus on the device, and then stopped activities for a period of time, and the situation value also returned to 0. During the period of 60s to 100s, the situation value fluctuates around 0.8, which is consistent with the event that the attackers control the devices of the system to launch DDoS attacks on the gateway computer. The attacker then ceased activity, and the situational value returned to 0.Figure 14
Change trend of situation value.The experimental results show that the fluctuation of the situation value corresponds to the different attack behaviors carried out by the attacker, which accurately describes the information security status of the system and verifies the effectiveness and accuracy of the situation awareness method proposed in this paper. And the time node of the change of the situation value is synchronized with the time node of the attacker's attack, which also verifies the real-time performance of the situation assessment method.


## 4.2. Situation Forecasting Experiment Results and Analysis

This section selects the trend of situation change from 60s to 70s and uses the first 20 data points as training samples and the last 10 data points as comparison samples to verify the situation prediction method. The selected data is shown in Figure15. Using ADF to check that the situation sequence is not a stationary sequence, the sequence needs to be stationary.Figure 15
The training sample set.The selected situation sequence is differentiated once, and the obtained difference sequence passes the ADF stationarity test. Therefore, the sequence difference is stopped, and the subsequent steps of ARIMA can be used to predict the situation sequence. The difference result is shown in Figure16.Figure 16
The result of 1 difference of situation values.The training samples are fitted by the ARIMA method [22]. Determine the model parameters of ARIMA as p = 3, d = 1, q = 4. The parameters in the formula are obtained by using the maximum likelihood estimation method: the constant term μ=−0.026513; the three autoregressive coefficients are ϕ1=−0.20651, ϕ2=−0.33681, and ϕ3=−0.4685; the four moving average coefficients are θ1=−0.54385, θ2=0.24325, θ3=−0.78119, and θ4=0.081789. Figure 17 shows the situation prediction result using this estimation model. It can be seen from the figure that the predicted value is basically consistent with the trend of the actual value. This shows that the ARIMA model has a high prediction accuracy for the information security situation value of the train control system.Figure 17
The result of the situation value prediction.The experimental results show that the situation prediction method based on ARIMA can effectively predict the short-term changes of the situation value, but because the ARIMA method produces the characteristic that the sequence tends to be stable, the predicted value will converge near the mean value of the real value, which cannot reflect the fluctuation of the situation value. It is suitable for short-term forecasts with high accuracy requirements.


## 5. Conclusion

Information security is an issue that every country should pay attention to. The article is short and mainly explains the use of the hidden Markov model. After simulating the information security experiment, the feasibility and effectiveness of the situation assessment method and the situation prediction method are carried out. After a brief verification, the results also show that the situation assessment method based on the hidden Markov model can effectively assess the level of information security. However, with the passage of time, this method will gradually converge to the mean value of the situation value sequence, so it cannot reflect the fluctuation of the situation. Therefore, the long-term prediction of the situation value can become a follow-up research direction. This article only provides a superficial understanding of security situational awareness and ignores some details in the analysis process. It is hoped that the article can provide ideas for future situational awareness research in the future.



---

*Source: 6800135-2022-04-12.xml*