Research on a Critical Link Discovery Method for Network Security Situational Awareness

Area of Science:

• Computer Science
• Network Security
• Information Theory

Background:

• Traditional single-layer network models are insufficient for analyzing large-scale, complex internet structures.
• Modern network security situational awareness (NSSA) requires advanced methods to understand evolving network environments.
• The diversification of network components necessitates a shift towards multi-layer network analysis.

Purpose of the Study:

• To develop a novel metric for assessing link importance in multi-layer network topologies for NSSA.
• To address the limitations of existing methods in capturing the complexity of layered network structures.
• To enhance the accuracy and effectiveness of critical link discovery in network security.

Main Methods:

• Proposed a three-layer network model encompassing physical device, business application, and user role networks.
• Introduced the multi-layer-dependent link entropy (MDLE) metric.
• MDLE integrates link-local betweenness centrality and mapping entropy, considering link dependencies across layers.

Main Results:

• MDLE demonstrated superior ordering monotonicity in critical link discovery compared to traditional metrics.
• Destruction simulations showed higher efficacy for MDLE in identifying vulnerable links.
• The metric effectively aggregates link importance contributions across different network layers.

Conclusions:

• The MDLE metric is well-suited for critical link discovery in multi-layer network topologies.
• This approach enhances network security situational awareness by providing a more comprehensive analysis.
• The findings support the adoption of multi-layer network models and advanced metrics for robust network security.