CN102694800A - Gaussian process regression method for predicting network security situation - Google Patents

Abstract

The invention discloses a Gaussian process regression method for network security situation prediction in the technical field of network information security. The present invention uses the AHP to construct a hierarchical network security situation evaluation index system, uses this system to analyze the degree of harm of various network security threats to the network security situation, and then calculates the network security situation value of each time monitoring point and constructs a time sequence, construct it into a training sample set, use Gaussian process regression to iteratively train the training sample set to obtain a prediction model that meets the error requirements, and use particle swarm optimization algorithm to dynamically search for the optimal training parameters of Gaussian process regression during the training process to reduce the prediction Finally, the prediction model is used to complete the prediction of the network security situation value of the monitoring point in the future. The beneficial effects of the invention are: in reducing network security situation prediction errors, it has better adaptability and lower prediction errors.

Description

Gaussian Process Regression Method for Network Security Situation Prediction

technical field

The invention belongs to the technical field of network information security, in particular to a Gaussian process regression method for network security situation prediction.

Background technique

The popularity of the Internet and technological innovation have profoundly changed human life, but also brought serious network security problems. At present, various network security problems emerge in endlessly, and various network attacks gradually show development trends such as distribution, scale, complexity, and indirection. However, the current network security equipment does not have a relatively complete security alarm mechanism. Precise warning of security trends has very important theoretical and practical significance. At present, the mainstream method is to realize network security early warning by predicting the network security situation value of the target network in the future time node. The prediction method of network security situation value mainly uses artificial intelligence algorithm to abstract the target problem into a regression problem, and solves the network security situation value of future time nodes by constructing a regression model. This process mainly includes three parts, which are constructing network security situation evaluation Index system, calculation of network security situation value, establishment of network security situation prediction model.

Constructing the network security situation evaluation index system needs to calculate the influence factors of various network attacks on the network security situation value, that is, the weight. The construction method of the evaluation index system will directly determine whether the network security situation value can accurately reflect the actual situation of the current network.

The calculation of the network security situation value needs to multiply the number of various network attacks at a certain time node by the weight of various network attacks, and then sum them up to obtain the network security situation value at this time node.

The current network security situation prediction methods are mainly based on methods such as artificial neural networks, support vector machines, and Bayesian networks.

Contents of the invention

The invention discloses a Gaussian process regression method for network security situation prediction aiming at the above defects. The present invention introduces the Analytic Hierarchy Process (AHP), thereby obtaining an evaluation index system that can accurately reflect the current network security situation. The present invention uses the Gaussian process regression algorithm to complete the prediction of the network security situation value, which effectively improves the prediction accuracy.

The Gaussian process regression method of network security situation prediction includes the following steps:

1) Use the AHP to construct a hierarchical network security situation evaluation index system T, and calculate the total ranking weight matrix ω of the network security situation evaluation index system T;

2) Input the historical intrusion detection results of network security equipment into the network security situation evaluation index system T in sequence according to the time sequence, and obtain the network security situation value V ₁ at the first moment to the network security situation value V _m at the m moment ;

3) Use the sliding window method to construct V ₁ ~V _m into a time series S, s={V ₁ ...V _m };

Then the time series S is randomly divided according to a fixed ratio to obtain the readable training sample set S _train and test sample set S _test in the Gaussian process regression method; ensure that the training sample set S _train and test sample set S _test meet the Gaussian process regression method the required data format;

4) Use the Gaussian process regression method to iteratively train the training sample set S _train to obtain a temporary prediction model h, and then use the particle swarm optimization algorithm to correct the error of the temporary prediction model h to obtain a prediction model H that meets the error expectation;

5) Use the prediction model H to complete the prediction of the network security situation value in the future.

The structure of the network security situation evaluation index system T is as follows: the network security situation evaluation index system T is divided into three layers, the upper layer is the target layer, and its content is the network security situation value; Medium and weak hazards, strong hazards, medium hazards, and weak hazards are divided according to the hazards of network security threats; the lower layer is the index layer, and its content is the first type of network security threat x ₁ to the nth type Cyber security threats x _n .

The calculation process of the total sorting weight matrix ω is as follows: first, assign the weights of the first type of network security threat x ₁ to the nth type of network security threat x _n , and then, according to the analytic hierarchy process, respectively calculate the i-th network security The influence coefficient of threat x _i on strong, medium and weak hazards, i ranges from 1 to n; then calculate the final influence coefficients of strong hazards, medium hazards and weak hazards on the network security situation value, and finally The total ranking weight matrix ω of the network security situation evaluation index system T is obtained.

Said step 2) includes the following steps:

至分别指：在第j时刻，第1种网络安全威胁x₁至第n种网络安全威胁x_n发生的次数；21) Count the intrusion detection results r _j of network security equipment at the jth moment, j ranges from 1 to m; r _j is a 1×n matrix, in,

to Respectively: at the moment j, the number of occurrences of the first type of network security threat x ₁ to the nth type of network security threat x _n ;

22) Multiply r _j with the total ranking weight matrix ω of the network security situation evaluation index system T to obtain the network security situation value V _j at the jth moment.

The fixed ratio is 3:2.

The step 4) specifically includes the following steps:

41) In the particle swarm optimization algorithm, set the following parameters: the maximum number of iterations is 100, the population size is 10, the initial inertia weight ω ₁ =0.8, the termination inertia weight ω _T =0.1, the first learning factor and the second learning factor are both is 2, and the particle velocity interval is [0, 0.5];

42) Set the kernel function type of the Gaussian process regression method;

43) Normalize the training sample set S _train and the test sample set S _test ;

44) The particle swarm optimization algorithm passes the initial training parameters to the Gaussian process regression method, and the Gaussian process regression method obtains the temporary prediction model h through training the training sample set S _train ; the initial training parameters refer to the random training parameters initially generated by the particle swarm algorithm;

45) Calculate the training error ε of the temporary prediction model h through the test sample set S _test ;

46) If the training error ε of the temporary prediction model h meets the preset expectation value θ, it is the final prediction model H. Otherwise, the Gaussian process regression method generates new training parameters iteratively according to the particle swarm optimization algorithm, through the training sample set S _train Training, thus updating the temporary prediction model h;

47) When one of the following two conditions is met, execute step 48); otherwise, return to step 45); the first condition is: the number of iterations of the Gaussian process regression method reaches the maximum iteration number of 100; the second condition is: The temporary prediction model h meets the preset expectation;

48) Output the final prediction model H.

The preset expected value θ is 85%.

Among the new training parameters generated by the Gaussian process regression method iteratively according to the particle swarm algorithm, the iterative process of the particle swarm algorithm is as follows:

及初始速度b取1至10；并计算初始种群中每个粒子的适应度函数F(b)，若初始种群所有粒子的适应度函数F(b)的最小值min(F(b))≤θ，则取min(F(b))对应的粒子作为待求问题的最优解，否则按以下三个公式更新粒子速度和位置，即进行种群迭代；Particle swarm optimization (PSO) first initializes, randomly constructs an initial population consisting of 10 particles, and assigns an initial position to the bth particle in the initial population

and initial velocity b ranges from 1 to 10; and calculate the fitness function F(b) of each particle in the initial population, if the minimum value min(F(b)) of the fitness function F(b) of all particles in the initial population min(F(b))≤θ, then Take the particle corresponding to min(F(b)) as the optimal solution to the problem to be found, otherwise update the particle velocity and position according to the following three formulas, that is, perform population iteration;

${\mathrm{<span\; class="notranslate">\; V</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; \&omega;</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}{\mathrm{<span\; class="notranslate">\; V</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; \&CenterDot;</span>{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; \&CenterDot;</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; p</span>}}_{\mathrm{<span\; class="notranslate">\; the\; best</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; \&CenterDot;</span>{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; \&CenterDot;</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; the\; best</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}}<span\; class="notranslate">\; )</span>$

${\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; V</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}$

${\mathrm{<span\; class="notranslate">\; \&omega;</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; \&omega;</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; -</span>\frac{{\mathrm{<span\; class="notranslate">\; \&omega;</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; \&omega;</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}}}{\mathrm{<span\; class="notranslate">\; k</span>}}$

和

分别指：迭代次数为k-1次和k次时第b个粒子的位置；和

分别指：迭代次数为k-1次和k次时第b个粒子的速度；ω₀和ω₁为初始惯性权重，ω₂至ω_b为第2惯性权重值第b惯性权重；ω₀=ω₁=0.8。Among them; P _best refers to the individual optimal position that all particles pass through; g _bestb refers to the optimal position passed by the population; k is the number of iterations, r ₁ and r ₂ are random numbers between [0,1]; C ₁ and C ₂ are respectively the first learning factor and the second learning factor;

and

Respectively: the position of the bth particle when the number of iterations is k-1 and k times; and

Respectively: the velocity of the b-th particle when the number of iterations is k-1 and k times; ω ₀ and ω ₁ are the initial inertia weights, ω ₂ to ω _b are the second inertia weight value and the b-th inertia weight; ω ₀ = ω ₁ =0.8.

The beneficial effects of the present invention are: adopting the present invention to predict the network security situation not only overcomes the defects of the original situation prediction technology, but also improves the prediction accuracy.

Description of drawings

Fig. 1 is a flow chart of network security situation prediction method;

Figure 2 is a flow chart of the generation process of the network security situation evaluation index system based on the analytic hierarchy process;

Fig. 3 is a schematic diagram of the sliding window method;

Fig. 4 is the training flowchart of Gaussian process regression algorithm;

Detailed ways

The preferred embodiments will be described in detail below in conjunction with the accompanying drawings. It should be emphasized that the following description is only exemplary and not intended to limit the scope of the invention and its application.

The establishment of network security situation evaluation index system and the calculation of situation value are the premise of network security situation prediction. For this reason, the present invention introduces analysis based on AHP to analyze various original network security threats, and then obtains a hierarchical evaluation index system; The window method is constructed into a training sample set and a test sample set; the training sample set is input into the Gaussian process regression algorithm, and the training sample set is trained by the Gaussian process regression algorithm to obtain a temporary forecast model, and then the test sample set is used to test the temporary forecast model. Error detection to obtain the final prediction model that meets the error requirements; finally, the final prediction model is used to complete the prediction of network security situation value. In this way, from the local to the whole, the Gaussian process regression algorithm can be applied to more general network security situation prediction problems.

As shown in FIG. 1 , it is a flowchart of a network security situation prediction method based on Gaussian process regression provided by the present invention.

The Gaussian process regression method for network security situation prediction includes the following steps:

1) Use the AHP to construct a hierarchical network security situation evaluation index system T, and calculate the total ranking weight matrix ω of the network security situation evaluation index system T; to analyze the first type of network security threat x ₁ to the nth type of network Security threat x _n is the degree of harm to the network security situation; n is the sum of network security threat types;

AHP (Analytic Hierarchy Process) is to quantify qualitative problems that are difficult to quantify through strict mathematical operations, and integrate complex decision-making problems that were originally mixed with quantitative and qualitative into a unified whole, and then perform comprehensive analysis and evaluation. The AHP solution process is as follows: Firstly, the problem to be decided is decomposed into different levels according to the order of the target level, the criterion level and the specific plan, and the hierarchical structure and pairwise judgment matrix are established; then the eigenvector of the judgment matrix is solved to obtain the The priority weight of each element of each element relative to the elements of the previous layer; finally, the final weight of each plan to the target layer is merged step by step using the method of weighted summation, and the one with the largest final weight value is the optimal plan. The AHP solution process can be summarized as "decomposition->judgment->synthesis". AHP is suitable for evaluation and decision-making problems that have a hierarchical structure and are difficult to describe quantitatively.

As shown in Figure 2, the structure of the network security situation evaluation index system T is as follows: the network security situation evaluation index system T is divided into three layers, the upper layer is the target layer, and its content is the network security situation value; the middle layer is the criterion layer, and its The contents are strong harm degree, medium harm degree and weak harm degree, and the strong harm degree, medium harm degree and weak harm degree are divided according to the harm degree of network security threats; the lower layer is the index layer, and its content is the first type of network security threat x ₁ to the nth network security threat x _n .

The calculation process of the total sorting weight matrix ω is as follows: first, assign the weights of the first type of network security threat x ₁ to the nth type of network security threat x _n , and then, according to the analytic hierarchy process, respectively calculate the i-th network security The influence coefficient of threat x _i on strong, medium and weak hazards, i ranges from 1 to n; then calculate the final influence coefficients of strong hazards, medium hazards and weak hazards on the network security situation value, and finally The total ranking weight matrix ω of the network security situation evaluation index system T is obtained.

The specific instructions for step 1) are as follows:

First assign the network attack weight

Experts in related fields give a scale of 1-5 according to the degree of harm of various network attacks, that is, assign weights to network attacks. The degree of harm of measure 5 is the highest, and the degree of harm of measure 1 is the lowest. Finally, the Delphi method is used to obtain various Average weight of cyber threats.

Step 2: Use AHP to determine the final weight distribution of the evaluation system. The detailed process is as follows:

(1) Calculate pairwise comparison matrix A. For element i and element j under the same criterion, calculate which one is more important to the criterion. The two elements need to be quantified, and the scales in Table 1-5 below are used.

Table 1 Judgment matrix scale and its meaning

(2) Calculate the relative weight of each element under a certain criterion, calculate the eigenvector X of matrix A through AX=λ _max X, and the eigenvalue with the largest λ _max index value, and unitize ωX as each element in weighting under the criterion;

(3) Obtain the total ranking weight matrix of the calculation index system through matrix multiplication;

(4) Matrix consistency check. Let the consistency index of the matrix be CI, CI=(λ _max -n)/(n-1), where n is the dimension of the judgment matrix; RI is the average consistency index, see Table 2 for specific values; CR is the judgment matrix The random consistency ratio of , CR=CI/RI, when CR≤0.1, the matrix meets the consistency.

Table 2 Average Consistency Index Values

2) Input the historical intrusion detection results of network security equipment into the network security situation evaluation index system T in order of time, and obtain the network security situation value _V at the first moment to the network security situation value V at the m moment _m ; the 1st moment to the mth moment are arranged in chronological order;

Said step 2) includes the following steps:

至

分别指：在第j时刻，第1种网络安全威胁x₁至第n种网络安全威胁x_n发生的次数；21) Count the intrusion detection results r _j of network security equipment at the jth moment, j ranges from 1 to m; r _j is a 1×n matrix, in,

to

Respectively: at the moment j, the number of occurrences of the first type of network security threat x ₁ to the nth type of network security threat x _n ;

22) Multiply r _j with the total ranking weight matrix ω of the network security situation evaluation index system T, where ω is an n×1 matrix, so as to obtain the network security situation value V _j at the jth moment.

3) Use the sliding window method to construct V ₁ ~V _m into a time series S, s={V ₁ ...V _m }; if the sliding window size is set to 4, and the sliding step is 1, then S ₁ ={V ₁ ,V ₂ ,V ₃ ,V ₄ }; S ₂ ={V ₂ ,V ₃ ,V ₄ ,V ₅ }, S ₃ ={V ₃ ,V ₄ ,V ₅ ,V ₆ }, and so on, such as As shown in Fig. 3, as in _S1 , through the network security situation value V ₁ at the first moment, the network security situation value V ₂ at the second moment, the network security situation value V ₃ at the third moment, and the network security situation value at the fourth moment The security situation value V ₄ is used to predict the network security situation value V ₅ at the fifth moment, and then, by analogy, the time series S is obtained.

Then the time series S is randomly divided according to a fixed ratio to obtain the readable training sample set S _train and test sample set S _test in the Gaussian Process Regression (GPR) method; the training sample set S _train and the test sample set are guaranteed The S _test meets the data format required by the Gaussian process regression method; the fixed ratio is 3:2.

4) Use the Gaussian process regression method to iteratively train the training sample set S _train to obtain a temporary prediction model h, and then use Particle Swarm Optimization (PSO) to correct the error of the temporary prediction model h to obtain a prediction model that meets the error expectation H;

The step 4) specifically includes the following steps:

41) In the particle swarm optimization algorithm, set the following parameters: the maximum number of iterations is 100, the population size is 10, the initial inertia weight ω ₁ =0.8, the termination inertia weight ω _T =0.1, the first learning factor and the second learning factor are both is 2, and the particle velocity interval is [0, 0.5];

42) Set the kernel function type of the Gaussian process regression method;

43) Normalize the training sample set S _train and the test sample set S _test ;

44) The particle swarm optimization algorithm passes the initial training parameters to the Gaussian process regression method, and the Gaussian process regression method obtains the temporary prediction model h through training the training sample set S _train ; the initial training parameters refer to the random training parameters initially generated by the particle swarm algorithm; When the kernel function is a Gaussian kernel function, the initial training parameters are "kernel width parameter" and "penalty factor".

45) Calculate the training error ε of the temporary prediction model h through the test sample set S _test ;

46) If the training error ε of the temporary prediction model h meets the preset expectation value θ, it is the final prediction model H. Otherwise, the Gaussian process regression method generates new training parameters iteratively according to the particle swarm optimization algorithm, through the training sample set S _train Training, thus updating the temporary prediction model h;

47) When one of the following two conditions is met, execute step 48); otherwise, return to step 45); the first condition is: the number of iterations of the Gaussian process regression method reaches the maximum iteration number of 100; the second condition is: The temporary prediction model h meets the preset expectation;

48) Output the final prediction model H.

The Gaussian process regression method is the most commonly used stochastic process model in engineering technology problems. In the field of machine learning, the Gaussian process regression method is a machine learning method developed on the basis of Gaussian random process and Bayesian learning theory. It has good adaptability to complex problems such as linearity. Under the condition of not sacrificing performance, compared with artificial neural network, Gaussian process has the characteristics of easy implementation; it has flexible non-parametric inference ability, that is, the algorithm parameters of Gaussian process can be adaptively obtained in the process of model construction; at the same time Gaussian process is a kernel learning machine with probabilistic significance, which can make probabilistic explanations for the predicted output, and the modeler can evaluate the uncertainty of the model predicted output through the confidence interval. Therefore, Gaussian process has become a research hotspot in the field of machine learning, and has been successfully applied in many fields. Figure 4 shows the training process of the Gaussian process regression method.

Pay special attention to the use of particle swarm optimization algorithm mentioned in step 4 to search for the optimal training parameters of Gaussian process regression, so as to reduce the training error of Gaussian process regression. The process is as follows:

及初始速度

b取1至10；并计算初始种群中每个粒子的适应度函数F(b)，若初始种群所有粒子的适应度函数F(b)的最小值min(F(b))≤θ，则取min(F(b))对应的粒子作为待求问题的最优解，否则按以下三个公式更新粒子速度和位置，即进行种群迭代；Particle Swarm Optimization (PSO) first initializes, randomly constructs an initial population consisting of 10 particles, and assigns an initial position to the bth particle in the initial population

and initial velocity

b ranges from 1 to 10; and calculate the fitness function F(b) of each particle in the initial population, if the minimum value of the fitness function F(b) of all particles in the initial population min(F(b))≤θ, then Take the particle corresponding to min(F(b)) as the optimal solution to the problem to be found, otherwise update the particle velocity and position according to the following three formulas, that is, perform population iteration;

${\mathrm{<span\; class="notranslate">\; V</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; \&omega;</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}{\mathrm{<span\; class="notranslate">\; V</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; \&CenterDot;</span>{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; \&CenterDot;</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; p</span>}}_{\mathrm{<span\; class="notranslate">\; the\; best</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; \&CenterDot;</span>{\mathrm{<span\; class="notranslate">\; r</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; \&Center\; Dot;</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; the\; best</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}}<span\; class="notranslate">\; )</span>$

${\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; V</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}$

${\mathrm{<span\; class="notranslate">\; \&omega;</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; \&omega;</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; -</span>\frac{{\mathrm{<span\; class="notranslate">\; \&omega;</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; \&omega;</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}}}{\mathrm{<span\; class="notranslate">\; k</span>}}$

和

分别指：迭代次数为k-1次和k次时第b个粒子的位置；

和

分别指：迭代次数为k-1次和k次时第b个粒子的速度；ω₀和ω₁为初始惯性权重，ω₂至ω_b为第2惯性权重值第b惯性权重；ω₀＝ω₁＝0.8。Among them; P _best refers to the individual optimal position that all particles pass through; g _bestb refers to the optimal position passed by the population; k is the number of iterations, r ₁ and r ₂ are random numbers between [0, 1]; C ₁ and C ₂ are respectively the first learning factor and the second learning factor;

and

Respectively: the position of the bth particle when the number of iterations is k-1 and k times;

and

Respectively: the velocity of the bth particle when the number of iterations is k-1 and k times; ω ₀ and ω ₁ are the initial inertia weights, ω ₂ to ω _b are the second inertia weight value and the b-th inertia weight; ω ₀ = ω ₁ =0.8.

ω _b determines the optimal convergence ability of the particle swarm optimization algorithm. When ω _b is large, the global convergence ability is strong, and when ω _b is small, the local convergence ability is strong. Therefore, the update formula of ω _b can ensure that the particle swarm optimization algorithm has a global Strong convergence ability, strong local convergence ability in the later stage. When min(F(i))≤θ appears in a certain iteration or the number of iterations reaches T, the algorithm terminates.

5) Use the prediction model H to complete the prediction of the network security situation value in the future.

After the training and learning of the above five steps, a network security situation value prediction model based on Gaussian process regression is formed, so as to realize accurate prediction of the situation value of future time monitoring points.

Compared with traditional methods, the present invention has better prediction accuracy in predicting network security situation value, and improves the practicability of network security situation prediction.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (8)

1. The Gaussian process regression method for predicting the network security situation is characterized by comprising the following steps of:

1) constructing a hierarchical network security situation evaluation index system T by using an analytic hierarchy process, and calculating to obtain a total sequencing weight matrix omega of the network security situation evaluation index system T;

2) sequentially inputting historical intrusion detection results of the network security equipment into a network security situation evaluation index system T according to the time sequence to obtain a network security situation value V at the 1 st moment₁Network security state by mth momentPotential value V_m；

3) Using sliding window method to convert V₁~V_mIs configured to time-series S, S ═ V₁…V_m}; then, the time sequence S is randomly divided according to a fixed proportion to obtain a readable training sample set S in a Gaussian process regression method_trainAnd a test sample set S_test(ii) a Guarantee training sample set S_trainAnd a test sample set S_testThe data format required by the Gaussian process regression method is met;

4) training sample set S by using Gaussian process regression method_trainPerforming iterative training to obtain a temporary prediction model H, and performing error correction on the temporary prediction model H by using a particle swarm algorithm to obtain a prediction model H meeting error expectation;

5) and (4) completing the prediction of the network security situation value at the future moment by using the prediction model H.

2. The Gaussian process regression method for network security situation prediction according to claim 1, wherein the structure of the network security situation evaluation index system T is as follows: the network security situation evaluation index system T is divided into three layers, wherein the upper layer is a target layer, and the content of the target layer is a network security situation value; the middle layer is a criterion layer, the contents of which are strong hazard degree, medium hazard degree and weak hazard degree, and the strong hazard degree, the medium hazard degree and the weak hazard degree are divided according to the hazard degree of the network security threat; the lower layer is an index layer with the content of the 1 st network security threat x₁To nth network security threat x_n。

3. The method of claim 1, wherein the total ranking weight matrix ω is calculated as follows: first, threat x to type 1 network security₁To nth network security threat x_nThen, according to the analytic hierarchy process, respectively calculating the network security threat x in the ith_iFor the influence coefficients of strong hazard degree, medium hazard degree and weak hazard degree, i is 1 ton; and calculating final influence coefficients of the strong hazard degree, the medium hazard degree and the weak hazard degree on the network security situation value respectively, and finally obtaining a total sequencing weight matrix omega of the network security situation evaluation index system T.

4. The Gaussian process regression method for network security situation prediction according to claim 1, wherein the step 2) comprises the following steps:

21) counting the intrusion detection result r of the network security equipment at the j moment_jJ is 1 to m; r is_jIs a matrix of 1 x n, and the matrix is,

wherein,

to

Respectively indicate that: at time j, 1 st cyber-security threat x₁To nth network security threat x_nThe number of occurrences;

22) will r is_jMultiplying the total sorting weight matrix omega of the network security situation evaluation index system T to obtain the network security situation value V at the j moment_j。

5. The method of Gaussian process regression for network security situation prediction according to claim 1, wherein the fixed ratio is 3: 2.

6. The method for gaussian process regression for network security situation prediction according to claim 1, wherein the step 4) specifically comprises the following steps:

41) in the particle swarm algorithm, the following parameters are set: maximum iteration number of 100, population size of 10, initial inertial weight omega₁=0.8, terminating the inertial weight ω_T=0.1, 1 st learning factorAnd 2 nd learning factor are both 2, the particle velocity interval is [0, 0.5 ]]；

42) Setting a kernel function type of a Gaussian process regression method;

43) normalized training sample set S_trainAnd a test sample set S_test；

44) The particle swarm algorithm transfers the initial training parameters to a Gaussian process regression method which is implemented by carrying out regression on a training sample set S_trainObtaining a temporary prediction model h by training; the initial training parameters refer to random training parameters initially generated by a particle swarm algorithm;

45) by testing the sample set S_testCalculating a training error epsilon of the temporary prediction model h;

46) if the training error epsilon of the temporary prediction model H meets the preset expected value theta, the temporary prediction model H is the final prediction model H, otherwise, the Gaussian process regression method iteratively generates new training parameters according to the particle swarm algorithm by aiming at the training sample set S_trainThereby updating the temporary prediction model h;

47) when one of the following two conditions is satisfied, executing step 48), otherwise, returning to execute step 45); the first condition is: the iteration times of the Gaussian process regression method reach the maximum iteration times of 100; the second condition is: the temporary prediction model h meets a preset expected value;

48) and outputting the final prediction model H.

7. The method of claim 6, wherein the predetermined expected value θ is 85%.

8. The Gaussian process regression method for network security situation prediction according to claim 6, wherein in the new training parameters iteratively generated by the Gaussian process regression method according to the particle swarm optimization, the process of iteration performed by the particle swarm optimization is as follows:

the Particle Swarm Optimization (PSO) is initialized first, and an initial population consisting of 1O particles is randomly constructedAnd assigning an initial position to the b-th particle in the initial populationAnd initial velocity

b, taking 1 to 10; calculating a fitness function F (b) of each particle in the initial population, if the minimum value min (F (b)) of the fitness functions F (b) of all the particles in the initial population is less than or equal to theta, taking the particle corresponding to min (F (b)) as the optimal solution of the problem to be solved, otherwise, updating the speed and the position of the particle according to the following three formulas, namely performing population iteration;

<math> <mrow> <msubsup> <mi>V</mi> <mi>b</mi> <mrow> <mi>k</mi> <mo>+</mo> <mn>1</mn> </mrow> </msubsup> <mo>=</mo> <msub> <mi>&omega;</mi> <mi>b</mi> </msub> <msubsup> <mi>V</mi> <mi>b</mi> <mi>k</mi> </msubsup> <mo>+</mo> <msub> <mi>C</mi> <mn>1</mn> </msub> <mo>&CenterDot;</mo> <msub> <mi>r</mi> <mn>1</mn> </msub> <mo>&CenterDot;</mo> <mrow> <mo>(</mo> <msub> <mi>p</mi> <mi>best</mi> </msub> <mo>-</mo> <msubsup> <mi>X</mi> <mi>b</mi> <mi>k</mi> </msubsup> <mo>)</mo> </mrow> <mo>+</mo> <msub> <mi>C</mi> <mn>2</mn> </msub> <mo>&CenterDot;</mo> <msub> <mi>r</mi> <mn>2</mn> </msub> <mo>&CenterDot;</mo> <mrow> <mo>(</mo> <msub> <mi>g</mi> <mi>best</mi> </msub> <mo>-</mo> <msubsup> <mi>X</mi> <mi>b</mi> <mi>k</mi> </msubsup> <mo>)</mo> </mrow> </mrow> </math>

$X_b^{k+1}=X_b^k+V_b^{k+1}$

<math> <mrow> <msub> <mi>&omega;</mi> <mi>b</mi> </msub> <mo>=</mo> <msub> <mi>&omega;</mi> <mn>1</mn> </msub> <mo>-</mo> <mfrac> <mrow> <msub> <mi>&omega;</mi> <mn>1</mn> </msub> <mo>-</mo> <msub> <mi>&omega;</mi> <mrow> <mi>b</mi> <mo>-</mo> <mn>1</mn> </mrow> </msub> </mrow> <mi>k</mi> </mfrac> </mrow> </math>

wherein; p_bestRefers to the individual optimal positions through which all particles pass; g_bestbThe optimal position through which the population passes; k is the number of iterations, r₁And r₂Is [ O, 1 ]]A random number in between; c₁And C₂1 st learning factor and 2 nd learning factor respectively;

and

respectively indicate that: the iteration times are k-1 times and the position of the b-th particle when k times;and

respectively indicate that: the speed of the b-th particle when the iteration times are k-1 times and k times; omega₀And ω₁Is the initial inertial weight, ω₂To omega_bThe (b) th inertia weight is the 2 nd inertia weight value; omega₀＝ω₁＝0.8。

Images