CN102185735A - Network security situation prediction method - Google Patents
Network security situation prediction method Download PDFInfo
- Publication number
- CN102185735A CN102185735A CN2011101052724A CN201110105272A CN102185735A CN 102185735 A CN102185735 A CN 102185735A CN 2011101052724 A CN2011101052724 A CN 2011101052724A CN 201110105272 A CN201110105272 A CN 201110105272A CN 102185735 A CN102185735 A CN 102185735A
- Authority
- CN
- China
- Prior art keywords
- learning machine
- safety situation
- network safety
- network
- network security
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention discloses a network security situation prediction method in the technical field of network information security. The method comprises the following steps of: analyzing the hazard degrees of each network security threat by using a grey clustering analysis method, and further constructing a hierarchical network security situation index system, obtaining network security situation values of each time monitoring point, constructing a time sequence, constructing the time sequence into a training sample set, and performing iterative training on the training sample set by utilizing an integrated learning Boosting algorithm to obtain a weak learning machine sequence meeting error requirements; obtaining a strong learning machine by utilizing the method for calculating the weighted sum of the weak learning machine sequence; and finishing predicting the network security situation values of future time monitoring points by using the strong learning machine. The method is relatively higher in adaptability and relatively lower in prediction error rate in terms of reduction in network security situation value prediction errors.
Description
Technical field
The invention belongs to the network information security technology field, relate in particular to a kind of network safety situation Forecasting Methodology.
Background technology
Develop rapidly along with the Internet technology, the importance of network security and increasing to influence of society, network security problem is also more and more outstanding, and becomes the key issue that Internet and every network service and application further develop the solution of needing badly gradually.Network intrusions and attack are just towards trend developments such as distribution, scale, complicated, indirectization in addition; certainly will higher requirement be proposed to the safety product technology; and existing safety product (as IDS, IPS, fire compartment wall etc.) can only provide the most basic intrusion detection information, can't provide believable prediction alarm to the security postures of future network.Therefore press for the security postures prediction alarm that new technology of research realizes large scale network.The method that is widely used for describing the network security situation at present is network safety situation and network safety situation value prediction.So-called network safety situation is meant by whole network current safe state and variation tendencies that factor constituted such as various network device operation conditions, network behavior and user behaviors.The network safety situation prediction is meant in large-scale network environment, obtains, understands, shows and predict development in future trend to causing the security factor that network situation changes.The network safety situation Forecasting Methodology mainly is to use the method for single learning machine in the artificial intelligence at present, the network safety situation value of some historical discrete times monitoring point is abstracted into time series, and then with the network safety situation forecasting problem as the regression analysis problem, utilize single learning machine to find the solution, this process mainly comprises three parts, is respectively tectonic network safety index system, computing network security postures value, sets up the network safety situation forecast model.
Tectonic network safety index system is that the all-network security threat that will be referred to network security is configured to the index system structure according to certain rule, calculates thereby be fit to the network safety situation value.The building method of index system will determine directly whether the network safety situation value can accurately reflect the actual situation of current network, the present invention introduces grey clustering analysis GCA (Grey Clustering Analysis) method thus, thereby has obtained accurately reflecting the index system of current network safe condition.
Computing network security postures value process is exactly to utilize intrusion detection that the diverse network safety means provide category and time statistics as a result, be input to the network security index system again, with the multiplied by weight of every kind of network security threats corresponding in the network security index system, thereby obtain the network safety situation value of each historical time monitoring point.
At present the Forecasting Methodology of network safety situation value mainly is to utilize single learning machine methods such as neural net, SVMs, and the methodical error of single learning machine is relatively large, be prone to over-fitting phenomenon, computational process complexity.The present invention adopts integrated study Boosting algorithm to finish the prediction of network safety situation value for this reason, has effectively improved precision of prediction.
Summary of the invention
Big at single learning machine methodical error of mentioning in the above-mentioned background technology, be prone to deficiencies such as over-fitting phenomenon, computational process complexity, the present invention proposes a kind of network safety situation Forecasting Methodology.
Technical scheme of the present invention is that a kind of network safety situation Forecasting Methodology is characterized in that said method comprising the steps of:
Step 1: use grey clustering analysis method to analyze every kind of network security threats x
1, x
2, L, x
nThe extent of injury, and then construct the network safety situation index system T of stratification;
Step 2: with the historical intrusion detection result of Network Security Device order, be input to successively among the network safety situation index system T of stratification, obtain the network safety situation value V of each time supervision point i according to time supervision point i
i
Step 3: use the sliding window method with network safety situation value V
iBe configured to time series S, and time series S is configured to the readable training sample set S of integrated study Boosting algorithm
Train
Step 4: utilize integrated study Boosting algorithm to training sample set S
TrainCarry out the iteration training, obtain weak learning machine sequences h, utilize method to obtain strong learning machine H again the weighted sum of weak learning machine sequences h
j
Step 5: utilize strong learning machine H
jFinish the network safety situation value prediction of following time supervision point, and set strong learning machine H
jLife cycle, if strong learning machine H
jReach its life cycle, then return step 3.
Described step 1 may further comprise the steps:
Step 1.1: the white function matrix of structure global index;
Step 1.2: determine the grey cluster coefficient according to white function;
Step 1.3: calculate every kind of network security threats x
1, x
2, L, x
nThe grey cluster coefficient, and determine its grey cluster ownership;
Step 1.4: the grey cluster result is configured to hierarchical network security postures index system T;
Step 1.5: determine the index t among the index system T
1, t
2, L t
nFinal weights omega with respect to the network safety situation value.
Described step 2 may further comprise the steps:
Step 2.1: the Network Security Device intrusion detection of adding up each time supervision point i is r as a result
i
Step 2.2: with r
iDo multiplication with the weight matrix ω of network safety situation index system T, obtain the network safety situation value V of time supervision point i
i
Described step 4 may further comprise the steps:
Step 4.1: set integrated study Boosting algorithm maximum iteration time k, and set the weak learning algorithm that integrated study Boosting algorithm is called;
Step 4.2: standardization training sample set S
Train
Step 4.3: the primary data sample collection D that sets integrated study Boosting algorithm;
Step 4.4: with ω
f(l) be probability sample drawn collection D from primary data sample collection D
f, and, obtain weak learning machine h by weak learning algorithm training
f
Step 4.5: calculate weak learning machine h
fTraining error ε
f
Step 4.6: calculate weak learning machine h
fWeight
f
Step 4.7: the weight of upgrading training sample;
Step 4.8: when satisfying one of following two conditions, then execution in step 4.9; Otherwise return step 4.4;
Condition 1: integrated study Boosting algorithm reaches maximum iteration time k;
Condition 2: sample set D
fNo longer change;
Step 4.9: export strong learning machine H
j
Weak learning algorithm is core vector regression CVR in the described step 4.1.
Training error ε in the described step 4.5
fComputing formula be:
In the formula:
ε
fBe training error, f ∈ [1 ..., k];
ω
f(l) for extracting probability.
Weight in the described step 4.6
fComputing formula be:
In the formula:
α
fBe weak learning machine h
fWeight.
Strong learning machine H in the described step 4.9
jComputing formula be:
In the formula:
H
jBe strong learning machine;
Sign is a sign function;
α
lBe weak learning machine h
lWeight.
Adopt the present invention that network safety situation is predicted, not only overcome original defective, and improved the accuracy rate of prediction based on single learning machine situation value prediction technology.
Description of drawings
Fig. 1 is a network safety situation Forecasting Methodology flow chart;
Fig. 2 is the network safety situation index system generative process flow chart based on grey clustering analysis method;
Fig. 3 is a sliding window method schematic diagram;
Fig. 4 is the weak learning machine flow chart of integrated study Boosting algorithm training;
Fig. 5 is the strong learning machine prediction network safety situation process schematic diagram that utilizes integrated study Boosting algorithm to obtain.
Embodiment
Below in conjunction with accompanying drawing, preferred embodiment is elaborated.Should be emphasized that following explanation only is exemplary, rather than in order to limit the scope of the invention and to use.
Set up the network safety situation index system and calculate the prerequisite that the situation value is the network safety situation prediction.For this reason, the present invention introduces and based on grey clustering analysis method original diverse network security threat is analyzed, and then obtains the stratification index system; After obtaining the stratification index system, can computing network security postures value, and discrete-time series become training sample set according to the sliding window method construct; Training sample set is input in the integrated study Boosting algorithm, by learning machine a little less than the integrated study Boosting algorithm invokes--core vector regression CVR (Core Vector Regression) carries out the sample set training to obtain weak learning machine sequence, again the weighting of weak learning machine sequence is become strong learning machine; Utilize strong learning machine to finish the prediction of network safety situation value at last.From the part to integral body, make integrated study Boosting algorithm can be suitable for more generally network safety situation forecasting problem like this.
Fig. 1 is a kind of network safety situation Forecasting Methodology flow chart provided by the invention.Among Fig. 1, method provided by the invention comprises following step:
Step 1: use grey clustering analysis method to analyze every kind of network security threats x
1, x
2, L, x
nThe extent of injury, n is a network security threats kind sum, and then constructs the network safety situation index system T of stratification;
Grey clustering analysis GCA (Grey Clustering Analysis) is more outstanding a kind of of performance in the clustering method, it utilizes the gray scale membership function to differentiate the classification ownership of sample to be clustered, it is advantageous that does not need the large sample collection to support, and can disclose unconspicuous implicit contact between each sample built-in attribute.Setting up process based on the network safety situation index system of grey clustering analysis among the present invention mainly is made of following five steps:
Step 1.1: the white function matrix of structure global index;
If sample X={x to be clustered
1, L x
i, L x
m, cluster index Y={y
1, L y
j, L y
n, S different cluster ash class arranged, each object x
iFor the cluster index y
jThe white function that is had is d
Ij, i=1,2, L, m, j=1,2, L, n sets up matrix D=[d
Ij],
Step 1.2: determine the grey cluster coefficient according to white function;
Following formula is three class white functions, f (d
Ij) be the albefaction weight function of the j ash class of i cluster index, f (d
Ij) ∈ [0,1], λ
IjBe f (d
Ij) threshold values.
The upper limit is estimated white function
Moderately estimate white function
Lower limit is estimated white function
Step 1.3: calculate every kind of network security threats x
1, x
2, L, x
nThe grey cluster coefficient, and determine its grey cluster ownership;
Sample to be tested is done albefaction handle, obtain the white function f (d of the relative j ash of i index class
Ij), obtain the threshold values λ of each grey class
Ij, and then ask the cluster of the j ash class of i index to weigh
Then obtaining the grey cluster coefficient is
σ
IjReflect that i cluster object is under the jurisdiction of the degree of j ash class.Obtain cluster row vector σ
i=(σ
I1, σ
I2L σ
Is), S is grey class number.σ
cBe the Grey Clustering Decision-Making matrix, as the following formula:
If certain is arranged
Satisfy
Claim cluster object i to belong to grey class k
*Promptly at cluster row vector σ
iIn find out maximum cluster coefficients, grey class is grey class under the cluster object i under this maximum cluster coefficients.
Step 1.4: the grey cluster result is configured to hierarchical network security postures index system T;
As Fig. 2, choose in this example the gray scale classification for " by force ", " in ", " weak " three classes, distinguish the extent of injury of map network security threat.
Step 1.5: determine the index t among the index system T
1, t
2, L t
nFinal weights omega with respect to the network safety situation value.
This stage need be determined the influence coefficient of every kind of Cyberthreat for the network safety situation value, utilize analytic hierarchy process (AHP) to set up in the stratification index system structure judgment matrix in twos between every layer of all index and find the solution the characteristic vector of judgment matrix, thereby obtain the influence coefficient of every layer the relative last layer element of each element, successively determine the final influence coefficient of diverse network attack with the method for weighted sum at last the network safety situation value.Step 1.5 is made up of following two sub-steps,
The first step: network attack weight assignment
Look for some association area experts that diverse network is threatened and provide weight according to its extent of injury.The general weight that adopts 1-9, weight 1 extent of injury is minimum, rises successively, and the extent of injury of weight 9 is the highest.Utilize the Delphi method to obtain expert's average weight that diverse network threatens again, as the sample of analytic hierarchy process (AHP).
Second step: utilize analytic hierarchy process (AHP) to determine the final weight allocation of evaluation system
According to " local earlier; that the back is whole " strategy, calculate diverse network attack with respect to rule layer ownership " by force " in its grey cluster index system, " in ", the influence coefficient of " weak " three major types, calculate again " by force ", " in ", " weak " three major types is for the influence coefficient of network safety situation value, thereby obtain the final influence coefficient matrix of diverse network security threat for the network safety situation value.Process is as follows:
(1) compares judgment matrix A in twos according to the hierarchical structure structure.In the process that compares in twos, the policymaker need determine at certain class criterion B
k, two indicator layer Elements C
iAnd C
jWhich is more important, need quantize its importance degree, uses the scale of 1-9 here.Concrete scale implication sees Table 1:
Table 1 judgment matrix scale and implication thereof
(2) for n indicator layer Elements C
1C
n, by comparing mutually in twos, the judgment matrix A that is finally compared in twos;
(3) relative weighting of element under the single criterion of calculating utilizes A ω=λ
Maxω calculates the characteristic vector ω of matrix, with its unitization and as Elements C
1C
nAt criterion B
kUnder the ordering weight;
(4) the parameter system weight matrix that always sorts;
(5) consistency check of matrix.If CI is the general coincident indicator of judgment matrix, CI=(λ
Max-n)/(n-1), wherein n is the judgment matrix dimension; RI is the average homogeneity index, and concrete value sees Table 2; CR is the Consistency Ratio at random of judgment matrix, and CR=CI/RI is if CR≤0.1 a gained result satisfies consistency.
Table 2 average homogeneity index is won the confidence
Step 2: the historical intrusion detection result of Network Security Device is input to the network safety situation index system T of stratification successively according to time supervision point i order, obtains the network safety situation value V of each time supervision point i
i
Described step 2 specifically comprises the following steps:
Step 2.1: the Network Security Device intrusion detection r as a result that carries each time supervision point i of statistics
i, r
iIt is 1 * n matrix
Wherein
X for time supervision point i
mPlant the number of times that network security threats takes place;
Step 2.2: with r
iDo multiplication, ω=[ω with the weight matrix ω of network safety situation index system T
1, ω
2, L, ω
n]
TBe n * 1 matrix, thereby obtain the network safety situation value V of time supervision point i
i
Step 3: use the network safety situation value V of sliding window method with each time supervision point i
iBe configured to time series S={V
1, V
2, L, V
i, and time series S is configured to the readable training sample set S of integrated study Boosting algorithm
TrainSpecific as follows:
1: use the network safety situation value V of sliding window method with each discrete time monitoring point i
iBe configured to time series S={V
1, V
2, Λ, V
i, be 4 as setting the sliding window size, sliding step is 1, then S
1={ V
1, V
2, V
3, V
4, S
2={ V
2, V
3, V
4, V
5, S
3={ V
3, V
4, V
5, V
6, by that analogy, as Fig. 3;
2: time series S is configured to the readable training sample set S of integrated study Boosting algorithm
Train, promptly guarantee training sample set S
TrainSatisfy the weak desired data format of learning machine in the integrated study Boosting algorithm;
Step 4: utilize integrated study Boosting algorithm to training sample set S
TrainTrain and obtain weak learning machine sequences h={ h
1, h
2, L, h
k, k is an integrated study Boosting algorithm maximum iteration time, utilizes the method to the weighted sum of weak learning machine sequences h to obtain strong learning machine H again
j, j ∈ [1 ,+∞];
Integrated study Boosting algorithm is the outstanding representative of integrated study algorithm, its theoretical thought is to utilize certain unsettled weak learning machine to generate a weak learning machine combination, wherein each weak learning machine all exists as basic grader, the classification results of basic grader before the training process of each basic grader all depends on, the error of basic grader is used to adjust the sample probability distribution of current basic grader before being about to, and strong learning machine forms by the weighted array of single basic grader.Integrated study Boosting algorithm can obviously improve the accuracy rate of unstable learning machine, and is obvious for the lifting of single learning machine performance.Because the each training of integrated study Boosting algorithm can obtain a basic grader, and each basic grader all is to improve on the result of calculation of last once basic grader, therefore from the training angle, the training process of integrated study Boosting algorithm is exactly a process of continuing to optimize, and promptly grader never is stabilized to stable process.Find that after deliberation integrated study Boosting algorithm only need be adjusted parameter of maximum frequency of training k, and integrated study Boosting algorithm can not cause the study phenomenon to occur.Fig. 4 is the process of the weak learning machine of integrated study Boosting algorithm training, and described step 4 specifically comprises the following steps:
Step 4.1: set integrated study Boosting algorithm maximum iteration time k, and set the weak learning algorithm that integrated study Boosting algorithm is called;
Step 4.2: standardization training sample set S
TrainIf time series S
1Be S
1={ V
1, V
2, V
3, V
4, V then
1, V
2, V
3, V
4For the input vector of the weak learning algorithm of integrated study Boosting algorithm, according to S
1The network safety situation value V of prediction
5Be its corresponding output vector;
Step 4.3: the primary data sample collection D that sets integrated study Boosting algorithm;
D={S
1, V
5S
2, V
6L S
q, V
Q+4, ω
1(l) be the initial weight of each sample among the primary data sample collection D,
L ∈ [1 ..., q], q is the total number of sample;
Step 4.4: with ω
f(l) the sample set D that from primary data sample collection D, extracts for probability
f, and, obtain weak learning machine h by weak learning algorithm training
f, f ∈ [1 ..., k];
ω
f(l) the condition of choosing is:
If satisfy this condition, then ω
f(l) be its result of calculation; If do not satisfy this condition, then ω
f(l)=0, wherein,
Be network safety situation value V
I+4Predicted value;
Step 4.5: calculate weak learning machine h
fTraining error ε
f
In the formula:
ε
fBe training error, f ∈ [1 ..., k];
ω
f(l) for extracting probability.
Step 4.6: calculate weak learning machine h
fWeight
f
In the formula:
α
fBe weak learning machine h
fWeight.
Step 4.7: the weight of upgrading training sample;
In the formula:
ω
F+1(l) be the weight of the training sample after upgrading;
ω
f(l) be the weight of training sample;
h
f(x
l) be that weak learning machine is according to input variable x
lThe calculated value that obtains;
V
lIt is actual situation value;
M
fBe normalization coefficient, must guarantee
Step 4.8: when satisfying one of following two conditions, execution in step 4.9; Otherwise return step 4.4;
Condition 1: integrated study Boosting algorithm reaches maximum iteration time k;
Condition 2: sample set D
fNo longer change;
Step 4.9: export strong learning machine H
j
In the formula:
H
jBe strong learning machine;
Sign is a sign function;
α
lBe weak learning machine h
lWeight.
What pay special attention to is that the selected core vector regression CVR (Core Vector Regression) of integrated study Boosting algorithm finishes the training to sample data in step 4.1.CVR utilizes the MEB algorithm to find the solution former n dimension Euclidean space R
nMiddle target problem Φ, its process is as follows:
(1) utilize kernel function to finish from n dimension Euclidean space R
nTo the conversion in Hilbert space, promptly in the Hilbert space, construct the dual problem Φ ' of target problem Φ.
(2) the sample set S according to dual problem Φ ' sets initial MEB.
(3) carry out the MEB algorithm, until the nucleon collection S that obtains sample set S
c, be converted into the MEB problem with dual problem Φ ' this moment.If c, r are respectively the center of gravity and the radius of ball, and use B (c, r) one of expression heavily is c, radius is the ball of r.Establish error threshold δ>0 again, ball B (c, (1+ δ) r) is considered as (1+ δ) approximate ball of MEB (S).Nucleon collection S then
cMay be defined as: if proper subclass S
cComprised sample point among all S with the MEB of the factor (1+ δ) expansion, that is:
Wherein B (c, R)=MEB (S
c), proper subclass S then
cThe nucleon collection that is called S.
(4) under the constraints of center, find the solution the MEB problem, promptly finish finding the solution of target problem Φ.
Step 5: utilize strong learning machine H
jFinish the network safety situation value prediction of following time supervision point, and set strong learning machine H
jLife cycle, if strong learning machine H
jReach its life cycle, then repeating step 3;
Concrete implementation such as Fig. 5 of step 5 are specially:
1: set strong learning machine H
jLife cycle T
Live
2: check strong learning machine H
jLife cycle whether finish, if finished then according to step 3 until generating the strong learning machine H of a new generation
J+1
Through after the training study of above-mentioned 5 steps, form network safety situation value prediction model, thereby realize the situation value of following time supervision point is accurately predicted based on integrated study Boosting algorithm.
The present invention compares traditional single learning machine method aspect prediction network safety situation value, the better prediction precision is arranged, and has improved the practicality of network safety situation prediction.
The above; only for the preferable embodiment of the present invention, but protection scope of the present invention is not limited thereto, and anyly is familiar with those skilled in the art in the technical scope that the present invention discloses; the variation that can expect easily or replacement all should be encompassed within protection scope of the present invention.Therefore, protection scope of the present invention should be as the criterion with the protection range of claim.
Claims (8)
1. network safety situation Forecasting Methodology is characterized in that said method comprising the steps of:
Step 1: use grey clustering analysis method to analyze every kind of network security threats x
1, x
2, L, x
nThe extent of injury, and then construct the network safety situation index system T of stratification;
Step 2: with the historical intrusion detection result of Network Security Device order, be input to successively among the network safety situation index system T of stratification, obtain the network safety situation value V of each time supervision point i according to time supervision point i
i
Step 3: use the sliding window method with network safety situation value V
iBe configured to time series S, and time series S is configured to the readable training sample set S of integrated study Boosting algorithm
Train
Step 4: utilize integrated study Boosting algorithm to training sample set S
TrainCarry out the iteration training, obtain weak learning machine sequences h, utilize method to obtain strong learning machine H again the weighted sum of weak learning machine sequences h
j
Step 5: utilize strong learning machine H
jFinish the network safety situation value prediction of following time supervision point, and set strong learning machine H
jLife cycle, if strong learning machine H
jReach its life cycle, then return step 3.
2. according to the described a kind of network safety situation Forecasting Methodology of claim 1, it is characterized in that described step 1 may further comprise the steps:
Step 1.1: the white function matrix of structure global index;
Step 1.2: determine the grey cluster coefficient according to white function;
Step 1.3: calculate every kind of network security threats x
1, x
2, L, x
nThe grey cluster coefficient, and determine its grey cluster ownership;
Step 1.4: the grey cluster result is configured to hierarchical network security postures index system T;
Step 1.5: determine the index t among the index system T
1, t
2, L t
nFinal weights omega with respect to the network safety situation value.
3. according to the described a kind of network safety situation Forecasting Methodology of claim 1, it is characterized in that described step 2 may further comprise the steps:
Step 2.1: the Network Security Device intrusion detection of adding up each time supervision point i is r as a result
i
Step 2.2: with r
iDo multiplication with the weight matrix ω of network safety situation index system T, obtain the network safety situation value V of time supervision point i
i
4. according to the described a kind of network safety situation Forecasting Methodology of claim 1, it is characterized in that described step 4 may further comprise the steps:
Step 4.1: set integrated study Boosting algorithm maximum iteration time k, and set the weak learning algorithm that integrated study Boosting algorithm is called;
Step 4.2: standardization training sample set S
Train
Step 4.3: the primary data sample collection D that sets integrated study Boosting algorithm;
Step 4.4: with ω
f(l) be probability sample drawn collection D from primary data sample collection D
f, and, obtain weak learning machine h by weak learning algorithm training
f
Step 4.5: calculate weak learning machine h
fTraining error ε
f
Step 4.6: calculate weak learning machine h
fWeight
f
Step 4.7: the weight of upgrading training sample;
Step 4.8: when satisfying one of following two conditions, then execution in step 4.9; Otherwise return step 4.4;
Condition 1: integrated study Boosting algorithm reaches maximum iteration time k;
Condition 2: sample set D
fNo longer change;
Step 4.9: export strong learning machine H
j
5. according to the described a kind of network safety situation Forecasting Methodology of claim 5, it is characterized in that weak learning algorithm is core vector regression CVR in the described step 4.1.
6. according to the described a kind of network safety situation Forecasting Methodology of claim 5, it is characterized in that training error ε in the described step 4.5
fComputing formula be:
In the formula:
ε
fBe training error, f ∈ [1 ..., k];
ω
f(l) for extracting probability.
7. according to the described a kind of network safety situation Forecasting Methodology of claim 5, it is characterized in that weight in the described step 4.6
fComputing formula be:
In the formula:
α
fBe weak learning machine h
fWeight.
8. according to the described a kind of network safety situation Forecasting Methodology of claim 5, it is characterized in that strong learning machine H in the described step 4.9
jComputing formula be:
In the formula:
H
jBe strong learning machine;
Sign is a sign function;
α
lBe weak learning machine h
lWeight.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN 201110105272 CN102185735B (en) | 2011-04-26 | 2011-04-26 | Network security situation prediction method |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN 201110105272 CN102185735B (en) | 2011-04-26 | 2011-04-26 | Network security situation prediction method |
Publications (2)
Publication Number | Publication Date |
---|---|
CN102185735A true CN102185735A (en) | 2011-09-14 |
CN102185735B CN102185735B (en) | 2013-06-12 |
Family
ID=44571806
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN 201110105272 Expired - Fee Related CN102185735B (en) | 2011-04-26 | 2011-04-26 | Network security situation prediction method |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN102185735B (en) |
Cited By (16)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102611714A (en) * | 2012-04-10 | 2012-07-25 | 重庆交通大学 | Link discovery technique based network intrusion prediction method |
CN102694800A (en) * | 2012-05-18 | 2012-09-26 | 华北电力大学 | Gaussian process regression method for predicting network security situation |
CN104486141A (en) * | 2014-11-26 | 2015-04-01 | 国家电网公司 | Misdeclaration self-adapting network safety situation predication method |
CN104573013A (en) * | 2015-01-09 | 2015-04-29 | 上海大学 | Category weight combined integrated learning classifying method |
CN104794534A (en) * | 2015-04-16 | 2015-07-22 | 国网山东省电力公司临沂供电公司 | Power grid security situation predicting method based on improved deep learning model |
CN105704119A (en) * | 2015-12-31 | 2016-06-22 | 北京神州绿盟信息安全科技股份有限公司 | Method and device for determining network security posture distribution |
CN106411591A (en) * | 2016-09-30 | 2017-02-15 | 山东省计算中心(国家超级计算济南中心) | Hurst index based network security situation prediction method |
CN107290305A (en) * | 2017-07-19 | 2017-10-24 | 中国科学院合肥物质科学研究院 | A kind of near infrared spectrum quantitative modeling method based on integrated study |
CN108573021A (en) * | 2018-02-24 | 2018-09-25 | 浙江金华伽利略数据科技有限公司 | A kind of comprehensive value appraisal procedure of dynamic data |
CN108881250A (en) * | 2018-06-28 | 2018-11-23 | 广东电网有限责任公司 | Powerline network security postures prediction technique, device, equipment and storage medium |
CN109120637A (en) * | 2018-09-12 | 2019-01-01 | 宁德师范学院 | A kind of network security supervising platform and method |
CN111669375A (en) * | 2020-05-26 | 2020-09-15 | 武汉大学 | Online safety situation assessment method and system for power industrial control terminal |
CN112016097A (en) * | 2020-08-28 | 2020-12-01 | 重庆文理学院 | Method for predicting time of network security vulnerability being utilized |
CN114492059A (en) * | 2022-02-07 | 2022-05-13 | 清华大学 | Multi-agent confrontation scene situation assessment method and device based on field energy |
CN114511131A (en) * | 2021-12-27 | 2022-05-17 | 河北师范大学 | Network security situation prediction method and system based on machine learning algorithm |
CN116757874A (en) * | 2023-08-17 | 2023-09-15 | 中能聚创(杭州)能源科技有限公司 | User energy situation deduction method based on group intelligent analysis |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101350745A (en) * | 2008-08-15 | 2009-01-21 | 北京启明星辰信息技术股份有限公司 | Intrude detection method and device |
CN101753333A (en) * | 2008-11-28 | 2010-06-23 | 中华电信股份有限公司 | Management system for integrated information security service and the protection method thereof |
CN101783752A (en) * | 2010-02-10 | 2010-07-21 | 哈尔滨工业大学 | Network security quantitative estimation method based on network topology characteristic |
-
2011
- 2011-04-26 CN CN 201110105272 patent/CN102185735B/en not_active Expired - Fee Related
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101350745A (en) * | 2008-08-15 | 2009-01-21 | 北京启明星辰信息技术股份有限公司 | Intrude detection method and device |
CN101753333A (en) * | 2008-11-28 | 2010-06-23 | 中华电信股份有限公司 | Management system for integrated information security service and the protection method thereof |
CN101783752A (en) * | 2010-02-10 | 2010-07-21 | 哈尔滨工业大学 | Network security quantitative estimation method based on network topology characteristic |
Cited By (25)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102611714B (en) * | 2012-04-10 | 2015-12-02 | 重庆交通大学 | Based on the network intrusions Forecasting Methodology of contact discovery technique |
CN102611714A (en) * | 2012-04-10 | 2012-07-25 | 重庆交通大学 | Link discovery technique based network intrusion prediction method |
CN102694800A (en) * | 2012-05-18 | 2012-09-26 | 华北电力大学 | Gaussian process regression method for predicting network security situation |
CN104486141A (en) * | 2014-11-26 | 2015-04-01 | 国家电网公司 | Misdeclaration self-adapting network safety situation predication method |
CN104486141B (en) * | 2014-11-26 | 2018-10-23 | 国家电网公司 | A kind of network security situation prediction method that wrong report is adaptive |
CN104573013A (en) * | 2015-01-09 | 2015-04-29 | 上海大学 | Category weight combined integrated learning classifying method |
CN104794534B (en) * | 2015-04-16 | 2017-12-15 | 国网山东省电力公司临沂供电公司 | A kind of power grid security Tendency Prediction method based on improvement deep learning model |
CN104794534A (en) * | 2015-04-16 | 2015-07-22 | 国网山东省电力公司临沂供电公司 | Power grid security situation predicting method based on improved deep learning model |
CN105704119A (en) * | 2015-12-31 | 2016-06-22 | 北京神州绿盟信息安全科技股份有限公司 | Method and device for determining network security posture distribution |
CN105704119B (en) * | 2015-12-31 | 2018-10-09 | 北京神州绿盟信息安全科技股份有限公司 | A kind of method and device of determining network safety situation distribution |
CN106411591A (en) * | 2016-09-30 | 2017-02-15 | 山东省计算中心(国家超级计算济南中心) | Hurst index based network security situation prediction method |
CN106411591B (en) * | 2016-09-30 | 2019-06-21 | 山东省计算中心(国家超级计算济南中心) | A kind of network security situation prediction method based on Hurst index |
CN107290305B (en) * | 2017-07-19 | 2019-11-01 | 中国科学院合肥物质科学研究院 | A kind of near infrared spectrum quantitative modeling method based on integrated study |
CN107290305A (en) * | 2017-07-19 | 2017-10-24 | 中国科学院合肥物质科学研究院 | A kind of near infrared spectrum quantitative modeling method based on integrated study |
CN108573021A (en) * | 2018-02-24 | 2018-09-25 | 浙江金华伽利略数据科技有限公司 | A kind of comprehensive value appraisal procedure of dynamic data |
CN108881250A (en) * | 2018-06-28 | 2018-11-23 | 广东电网有限责任公司 | Powerline network security postures prediction technique, device, equipment and storage medium |
CN109120637B (en) * | 2018-09-12 | 2021-02-12 | 宁德师范学院 | Network security supervision platform and method |
CN109120637A (en) * | 2018-09-12 | 2019-01-01 | 宁德师范学院 | A kind of network security supervising platform and method |
CN111669375A (en) * | 2020-05-26 | 2020-09-15 | 武汉大学 | Online safety situation assessment method and system for power industrial control terminal |
CN111669375B (en) * | 2020-05-26 | 2021-03-16 | 武汉大学 | Online safety situation assessment method and system for power industrial control terminal |
CN112016097A (en) * | 2020-08-28 | 2020-12-01 | 重庆文理学院 | Method for predicting time of network security vulnerability being utilized |
CN112016097B (en) * | 2020-08-28 | 2024-02-27 | 深圳泓越信息科技有限公司 | Method for predicting network security vulnerability time to be utilized |
CN114511131A (en) * | 2021-12-27 | 2022-05-17 | 河北师范大学 | Network security situation prediction method and system based on machine learning algorithm |
CN114492059A (en) * | 2022-02-07 | 2022-05-13 | 清华大学 | Multi-agent confrontation scene situation assessment method and device based on field energy |
CN116757874A (en) * | 2023-08-17 | 2023-09-15 | 中能聚创(杭州)能源科技有限公司 | User energy situation deduction method based on group intelligent analysis |
Also Published As
Publication number | Publication date |
---|---|
CN102185735B (en) | 2013-06-12 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN102185735B (en) | Network security situation prediction method | |
CN105391083B (en) | Wind power interval short term prediction method based on variation mode decomposition and Method Using Relevance Vector Machine | |
CN106453293B (en) | A kind of network security situation prediction method based on improved BPNN | |
Yu et al. | Short term wind power prediction for regional wind farms based on spatial-temporal characteristic distribution | |
Le Son et al. | Remaining useful life estimation based on stochastic deterioration models: A comparative study | |
CN102694800A (en) | Gaussian process regression method for predicting network security situation | |
CN112506990B (en) | Hydrological data anomaly detection method based on spatiotemporal information | |
CN110334875A (en) | Meter and the wind power combined probability prediction technique of evaluation index conflict | |
CN107886161A (en) | A kind of global sensitivity analysis method for improving Complex Information System efficiency | |
CN112001565A (en) | Earthquake disaster loss prediction and evaluation method and system based on Softmax regression model | |
CN103440493A (en) | Hyperspectral image blur classification method and device based on related vector machine | |
Cui et al. | Learning global pairwise interactions with Bayesian neural networks | |
CN112836604A (en) | Rolling bearing fault diagnosis and classification method, system and equipment based on VMD-SSAE and storage medium thereof | |
CN112733997A (en) | Hydrological time series prediction optimization method based on WOA-LSTM-MC | |
CN109492748A (en) | A kind of Mid-long term load forecasting method for establishing model of the electric system based on convolutional neural networks | |
CN112232561A (en) | Power load probability prediction method based on constrained parallel LSTM quantile regression | |
CN104809522A (en) | Integrated energy predicting method | |
CN108898273B (en) | User side load characteristic clustering evaluation method based on morphological analysis | |
CN104751254A (en) | Line loss rate prediction method based on non-isometric weighted grey model and fuzzy clustering sorting | |
CN116169670A (en) | Short-term non-resident load prediction method and system based on improved neural network | |
CN104217296A (en) | Listed company performance comprehensive evaluation method | |
Yao et al. | A multipoint prediction model for nonlinear displacement of concrete dam | |
CN114186639A (en) | Electrical accident classification method based on dual-weighted naive Bayes | |
Dashti et al. | Estimation of unconfined aquifer transmissivity using a comparative study of machine learning models | |
Guo et al. | Mobile user credit prediction based on lightgbm |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
C06 | Publication | ||
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
C14 | Grant of patent or utility model | ||
GR01 | Patent grant | ||
C17 | Cessation of patent right | ||
CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20130612 Termination date: 20140426 |