针对现有网络安全态势预测的信息来源单一、缺乏实时性等问题,通过考察网络安全态势变化特点,提出了基于时间序列分析的预测方法.首先构建主机上一系列隐马尔可夫预测模型,充分利用多源异构信息,刻画不同时刻主机安全态势的前后依赖关系,预测主机下一时刻的安全态势;再综合考虑网络上所有主机安全态势,量化计算出下一时刻的网络安全态势,间接地预测网络安全态势变化规律及发展方向.通过真实网络环境的实验,验证了文中提出的方法在网络安全态势预测中的可行性和有效性.
As the existing network security situation prediction is restricted to its single information source and poor real-time property,a new prediction method fully considering the variation of network security situation is proposed on the basis of time series analysis. In this method,a series of hidden Markov models are constructed to predict the security situation for hosts according to the front and back dependence,and then to predict the trend of network security at the next moment by fully using multi-source heterogeneous information. Moreover,the network security situation at the next moment is quantitatively calculated from all hosts in the network. Thus,the change law and development direction of network security situation can be indirectly predicted. Experimental results in real network environments show that the proposed prediction method of network security situation is feasible and effective.