Research on Network Security Situation Awareness Based on the LSTM-DT Model

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• Traditional network security often uses binary labels (attack/normal), limiting nuanced understanding.
• Assessing complex network states requires dynamic, quantitative methods.
• Existing models may not accurately reflect real-time network behavior.

Purpose of the Study:

• To develop an advanced network security situation awareness model.
• To introduce the concept of attack probability for more realistic risk assessment.
• To improve the description and prediction of network security states.

Main Methods:

• Constructed a Long Short-Term Memory (LSTM) and Decision Tree (DT) hybrid model (LSTM-DT).
• Introduced attack probability by quantifying attack likelihood and impact.
• Utilized Stack Sparse Auto-Encoder (SSAE) for feature learning and Analytic Hierarchy Process (AHP) for risk indicator weighting.

Main Results:

• Achieved 95% accuracy in network situation awareness.
• Attained 87% accuracy in attack type recognition.
• Demonstrated superior performance in describing complex network environments compared to previous methods.

Conclusions:

• The LSTM-DT model provides a more accurate and comprehensive approach to network security situation awareness.
• Quantifying attack probability significantly enhances the prediction consistency with actual network conditions.
• The proposed method offers a robust solution for understanding and mitigating complex cyber threats.