基于云的免疫检测器训练和动态更新算法及其在网络安全态势感知系统中的应用研究

Network Security Situation Awareness (NSSA) is a hotspot in current researches of network security, with real-time monitoring and quantitative assessment of network security state, NNSA provides the basis for the development of defense strategy. However, researches of NSSA at present are almost based on the simple correlation analysis of the trials, logs and so on, which results in poor timeliness, weak quantification, low risk detection accuracy and other issues. Accordingly, a network security situation awareness system based on cloud and artificial immune is proposed in this project, which building NNSA from a bionics perspective to accurately evaluate the security situation of network based on the concentration of antibody. First, built the cloud platform, and the detector training and dynamic updating are executed by the cloud nodes; Second, design immune detector training and updating algorithms based on meshing of feature space and hierarchical clustering of self set, which organize the self samples into a hierarchical clustering tree to accelerate the searching of nearest self to improve the efficiency of detector training. Finally, the network security situation awareness methods based on cloud is built to find the way to solve the problem of quantitative description of the dynamic security risks of macro network, LAN, subnet, and host. The successful conduct of this study has very important significance for the construction of a new generation of active network security defense.

网络安全态势感知(NNSA)是网络安全领域的研究热点。NNSA对网络安全威胁进行实时监测和定量评估，为防御策略的制定提供依据。目前网络安全态势感知研究主要建立在审记、日志等原始数据的简单关联分析基础之上，存在时效性差、量化能力弱、风险检测准确率低等问题。据此，本项目提出基于云和人工免疫的网络安全态势感知系统，从仿生学角度建立NNSA，基于抗体浓度准确评估网络安全态势。首先建立云平台，由云节点负责检测器训练和动态更新；其次设计基于特征空间网格划分和自体训练样本层次聚类的免疫检测器训练和更新算法，将各个网格空间内的自体样本组织为层次聚类树以加快最邻近自体的搜索过程，提升检测器训练效率。最后，以此为基础建立基于云的NNSA系统，期望解决宏观网络、区域网络、子网、以及主机面临的动态安全风险的定量刻画问题。本项目的顺利开展为构建新一代积极主动的网络安全防御系统具有十分重要的意义。

传统的网络安全态势感知系统多采用事后分析方法，对系统中的审记、日志等原始数据进行简单关联分析，然后才能得出态势报告，因此传统的态势感知系统存在时效性差、风险量化能力弱、网络安全威胁检测准确率低等问题。 . 针对上述问题，本项目开展了基于免疫的网络安全态势感知系统研究，研究内容包括基于特征空间网格划分的免疫检测器训练算法，基于自体集层次聚类的否定选择算法，基于自体支持向量聚类的肯定选择算法，在此基础上构建了一系列基于免疫的网络安全模型，包括基于云的检测器训练和分发模型，网络安全风险实时定量计算模型，解决了宏观网络、区域网络、子网、以及主机面临的动态安全风险的定量刻画问题。本项目的顺利完成为设计基于实时网络安全风险的主动防御系统提供了技术支撑。. 经过三年的研究，项目组设计了一系列免疫基础算法，包括检测器训练，更新方法，基于免疫的网络安全威胁检测算法，以及网络安全风险的实时、定量计算方法等，相关成果累计发表论文15篇，其中SCI检索9篇，EI检索2篇，申请国家发明专利2项。. 本项目在基于免疫和云计算的网络安全态势研究领域取得的一系列技术突破对于构建新一代积极主动的网络安全防御系统具有十分重要的理论价值和意义。