CN104766137A - Network security posture prediction method based on evidence theory - Google Patents

Abstract

The invention relates to a network security posture prediction method based on the evidence theory and belongs to the technical field of network security assessment. The method includes the steps that according to a network security posture result and an actual network security posture which are predicted through submodel algorithms in a network security posture combined prediction model, a sample set is established; evaluation indexes and index weights of all the submodel algorithms in the sample set are determined; the acquired index weights in all the submodel algorithms are fused through the evidence theory, so that a combined weight of all the submodel algorithms is acquired; the acquired combined weight is introduced into the combined prediction model for combined prediction, and comprehensive prediction conducted by the combined prediction model on the network security posture is achieved. By the adoption of the method, prediction submodels capable of accurately describing typical postures of different characteristic curves are combined, the index weights of all the submodel algorithms in the combined prediction model are fused, the combined weight is acquired, all the submodels are comprehensively predicted, and therefore production accuracy is improved.

Description

A kind of network security situation prediction method based on evidence theory

Technical field

The present invention relates to a kind of network security situation prediction method based on evidence theory, belong to network security assessment technical field

Background technology

The Situation Assessment result obtained by Situation Assessment process is to evaluation that is current and web-based history situation.Because the acquisition of situation data source information and situation information fusion treatment process all needed through the regular hour, therefore, the Situation Assessment result obtained always has certain hysteresis quality, and the while that Situation Assessment being resultant, Network Situation there occurs change already.In a sense, the result of Situation Assessment is more show as one " to compensate " measure afterwards, cannot reach the management expection of " obviate ".

Situation Awareness is the overall assessment to system state, is a kind of trend of a kind of state, is intended to " see now, know future ".Therefore, the future developing trend predicting situation is one of essential requirement of Situation Awareness.The continuous service of Situation Assessment process have accumulated a large amount of Situation Assessment results, for finding the development law of network state, carrying out Tendency Prediction and providing necessary Informational support.Pass through Tendency Prediction, the validity of safety practice can be deduced, and anticipation is in advance carried out to the development trend of network safe state, with strategic decision-making that is auxiliary or guidance management personnel, take counter-measure in advance, timely and effectively quick response is made to network state complicated and changeable, " preventing trouble before it happens ".Therefore, Tendency Prediction effectively can improve the deficiency that Situation Assessment " compensates " mechanism afterwards.

Current Tendency Prediction method, mostly based on single situation forecast model, generally only can accomplish that the situation curve to having certain speciality carries out high-precision forecast, and range of application has certain limitation.

Wang Hui by force people such as grade proposes the Tendency Prediction method based on genetic algorithm back propagation neural network model, by genetic algorithm dynamically-adjusting parameter value, find out optimum neural network parameter combination, real output value and desired output are reached unanimity, improves the precision of Tendency Prediction.

The people such as Zhuo Ying propose the method utilizing generalized regression nerve networks to carry out Network Situation prediction, and first, historical data is classified, and set up General Neural Network model, carry out Tendency Prediction for every class data; Along with the change of situation data, upgrade the input and output vector of historical data, realize the performance prediction to situation change.

The people such as Gu propose the Tendency Prediction method based on support vector machines, and first the method is optimized SVM parameter by genetic algorithm algorithm, then by the optimum prediction of SVM to situation.

Meng Jin proposes the Forecasting Methodology based on radial neural network, the structure and parameter of the method determination radial neural network that first the method adopts hierarchy genetic algorithm to combine with least square method, the radial neural network model realization Tendency Prediction then by optimizing.

The people such as Zheng propose the method utilizing the information entropy of relative error to obtain combining weights, structure built-up pattern.The single model possessing different predictive ability combines by the method, and combining weights is arranged according to the information entropy of different model, realizes the multi model combination forecast to situation.

The people such as Zhang propose the combination forecasting based on wavelet transformation, ARIMA model and radial neural network model, first this model utilizes wavelet transformation to be low frequency signal and high-frequency signal by Tendency Prediction targeted transformation, and then distribution uses ARIMA model and radial neural network to predict low frequency signal and high-frequency signal.

The people such as Saima Hassan propose the method utilizing neural network to build forecast model, and first the method utilizes neural network repeatedly to train, and obtains best neural network model, then utilize best neural network model to build combination forecasting.

The Tendency Prediction method based on neural network model that Wang Hui waits by force people to propose, the generalized regression nerve networks that the people such as Zhuo Ying propose carries out the method for Network Situation prediction, the Forecasting Methodology based on support vector machines that the people such as Gu propose, the Forecasting Methodology based on radial neural network of Meng Jin belongs to typical single model prediction method, certain feature all for aim curve designs, therefore, single situation forecast model generally only can accomplish that the situation curve to having certain speciality carries out high-precision forecast, the adaptability and range of application of Tendency Prediction has certain limitation.

The Forecasting Methodology that the people such as the people such as Zheng, Saima Hassan propose is based upon on multiple Individual forecast model, belong to multi model combination forecast method, combining weights is all adjust according to error precision, namely according to single Index Establishment built-up pattern, do not consider in the building process of model, the feature such as stability, fitness.But in some cases, single error precision index can not reflect the good and bad degree of the performance of each submodel in built-up pattern comprehensively.

Summary of the invention

The object of this invention is to provide a kind of network security situation prediction method based on evidence theory, low and the problem of multiple features situation change curve cannot be adapted to solve existing network security postures precision of prediction.

The present invention is for solving the problems of the technologies described above and providing a kind of network security situation prediction method based on evidence theory, and this Forecasting Methodology comprises the following steps:

1) the network safety situation result obtained according to submodel algorithm predicts each in network safety situation combination forecasting and real network security postures build sample set;

2) evaluation index and the index weights of each submodel algorithm is determined according to constructed sample set;

3) evidence theory is utilized to merge the index weights in each submodel algorithm obtained, to obtain the combining weights of each submodel algorithm;

4) combining weights that basis obtains is brought in combination forecasting and is carried out combined prediction, realizes the integrated forecasting of combination forecasting to network safety situation.

The method be also included in combined prediction complete after parameter confidence level, adopt discount on securities method to be optimized adjustment to index weights, to reduce the negative effect of low confidence level target.

Described step 2) in the evaluation index of each submodel algorithm comprise relative error, trend fitting degree and matching degree of stability, described index weights comprises relative error weight, trend fitting weight and matching stability weight.

Described step 3) in the deterministic process of combining weights as follows:

A. using three kinds of weights allocation scheme of the relative error weight of each submodel algorithm in the built-up pattern that obtains, trend fitting weight and matching stability weight each submodel algorithm in built-up pattern;

B. above-mentioned weights allocation scheme is converted into trust and distributes, obtain weight evidence matrix;

C. merged the weight evidence matrix obtained by evidence theory, the weight allocation of acquisition is combining weights.

In described step C, the computing formula of combining weights is:

$m\left(A\right)=\left\{\begin{array}{c}0,A=\mathrm{\φ}\\ {(1-k)}^{-1}{\mathrm{\Σ}}_{\∩A_i=A}{\mathrm{\Π}}_{i=1}^n{m}_i\left(A_i\right),A\≠\mathrm{\φ}\end{array}\right.$

Wherein, m _i(A _i) corresponding to each vector in weight evidence matrix, the result of calculation of m (A) is weight vectors, by its assignment to Fw=(m _c1, m _c2, m _c3).

Described step 4) integrated forecasting result be:

P _c＝m _c1P ₁+m _c2P ₂+…+m _cnp _n

Wherein P _cfor obtaining integrated forecasting result, P ₁, P ₂p _nbe respectively the Tendency Prediction value of each submodel algorithm in built-up pattern, m _c1, m _c2m _cnthe weight of corresponding submodel algorithm respectively.

Step 1) in the structure of sample set be realized by moving window mode.

Described step 2) in the computing formula of relative error weight be:

$E{w}_i=\frac{E_{\mathrm{APEi}}}{\underset{j=1}{\overset{n}{\mathrm{\Σ}}}{E}_{\mathrm{APEj}}}$

Wherein Ew _ibe the relative error weight of the i-th Seed model prediction algorithm, E _aPEibe the relative error of the i-th Seed model prediction algorithm, n is the number of built-up pattern neutron model algorithm.

Described step 2) in the computing formula of trend fitting weight be:

$T{w}_i=\frac{T{F}_i}{\underset{j=1}{\overset{n}{\mathrm{\Σ}}}T{F}_j}$

Wherein Tw _ibe the trend fitting weight of the i-th Seed model prediction algorithm, be the trend fitting degree of the i-th Seed model prediction algorithm, n is the number of built-up pattern neutron model algorithm.

Described step 2) in matching stablize the computing formula of weight

$S{w}_i=\frac{F{S}_i}{\underset{j=1}{\overset{n}{\mathrm{\Σ}}}F{S}_j}$

Wherein Sw _ibeing the matching degree of stability weight of the i-th Seed model prediction algorithm, is FS _ithe matching degree of stability of the i-th Seed model prediction algorithm, n is the number of built-up pattern neutron model algorithm.

The invention has the beneficial effects as follows: the network safety situation result that the present invention obtains according to submodel algorithm predicts each in network safety situation combination forecasting and real network security postures build sample set; Determine evaluation index and the index weights of each submodel algorithm of sample set; Evidence theory is utilized to merge the index weights in each submodel algorithm obtained, to obtain the combining weights of each submodel algorithm; Bring in combination forecasting according to the combining weights obtained and carry out combined prediction, realize the integrated forecasting of combination forecasting to network safety situation.The typical Tendency Prediction submodel that the present invention accurately can portray different characteristic curve combines, utilize the advantage on each comfortable Tendency Prediction of different submodel, learn from other's strong points to offset one's weaknesses, adopt the index weights of evidence theory to submodule algorithm each in built-up pattern to carry out weight fusion simultaneously, obtain combining weights, realize each submodel prediction comprehensive, thus improve the accuracy of prediction.

Accompanying drawing explanation

Fig. 1 is that Tendency Prediction training sample set builds schematic diagram;

The schematic diagram of Fig. 2 curve segmentation matching.

Embodiment

Below in conjunction with accompanying drawing, the specific embodiment of the present invention is further described.

Network safety situation does not show significant regular feature in time, and performance steadily, then shows mechanical periodicity or random variation in yet some other cases in some cases, therefore, is only difficult to enough accurately portray forecasting process with a kind of model.The typical Tendency Prediction model that the present invention accurately can portray different characteristic curve carries out comprehensively, utilizes the advantage on each comfortable Tendency Prediction of different model, learns from other's strong points to offset one's weaknesses, thus acquisition predicts the outcome more accurately.Evidence theory has stronger multiple targets fusion decision-making capability, can realize comprehensive multi-source information, thus obtains more accurate decision-making; Therefore, the present invention proposes a kind of based on evidence theory network security situation prediction method, this Forecasting Methodology comprises.Its concrete implementation process is as follows:

1. build sample set

The network safety situation result obtained according to submodel algorithm predicts each in network safety situation combination forecasting and real network security postures build sample, and concrete sample set builds as follows:

Suppose, the situation sample sequence gathered is a ₁, a ₂..., a _n, being predict based on nearest data all the time in order to keep prediction algorithm, keeping the freshness of sampled data, adopt moving window dynamically to generate sample set, prediction input moving window size is LW _in, it is LW that prediction exports moving window _out, then the 1st article of training sample is prediction input moving window and prediction export moving window and slide to the right successively, and complete sample set and build, the building process of sample set as shown in Figure 1.

2. obtain evaluation index and the weight allocation of each submodule of Tendency Prediction

Evaluation index used by the present invention comprises relative error, trend fitting degree and matching degree of stability, is respectively relative error weight, trend fitting weight and matching stability weight according to the weight allocation that These parameters obtains.Below each evaluation index and weight allocation computation process are described in detail.

1) calculating of relative error and relative error weight

The general use error of Tendency Prediction describes the precision of forecast model, and relative error refers to the relative difference between prediction output valve and real output value, and concrete formula is as follows:

$E_{\mathrm{APE}}=\left|\frac{p_i-a_i}{a_i}\right|\×100\%$

Wherein E _aPEfor the relative error of model prediction, p _irepresent the Tendency Prediction value of the i-th Seed model algorithm, a _irepresent the actual value of network safety situation.E _aPEbe worth larger, show that the precision of prediction of prediction algorithm is lower, in combined prediction algorithm, should be it distribute lower weight; Otherwise, should be it and distribute higher weight.

After calculating the relative error of every Seed model prediction algorithm, relative error is normalized, the relative error weight Ew (Error Weight) of every Seed model prediction algorithm can be obtained.

$T{w}_i=\frac{E{\mathrm{APEi}}_{}}{\underset{j=1}{\overset{n}{\mathrm{\Σ}}}E{\mathrm{APEj}}_{}}$

Be wherein the relative error weight of the i-th Seed model prediction algorithm, be the relative error of the i-th Seed model prediction algorithm, n is the number of submodel in built-up pattern.

2) calculating of trend fitting degree and trend fitting weight

From mathematical form, during available continuous type, varied curve z=f (t) describes the evolutionary process of situation.According to time interval τ, discrete sampling is carried out to situation data, obtains by sampled point (t _k, z _k) the discrete time sequence that formed, as shown in Figure 2.Suppose, F (i, n) represent from _tithe broken line subgraph be made up of sampled point that moment starts.The slope g of every bar line segment _kcan be expressed as:

$g_k=\frac{z_{k+1}-z_k}{t_{k+1}-t_k}$

Wherein, z _krepresent t _kthe situation value in moment, according to above formula, the slope sequence (PredictionSerial, PS) of prediction curve and the slope sequence (Actual Serial, AS) of actual curve.

PS＝{P _i,P _i+1,…,P _i+n-1}

AS＝{A _i,A _i+1,…,A _i+n-1}

Calculate the product of PS and AS transposition, product vector M S={M can be obtained _i, M _i+1..., M _i+n-1.That is:

MS＝PS×AS ^T

Element in vector M S is identical with actual curve variation tendency on the occasion of expression prediction curve, and the element in MS is that negative value represents that prediction curve is contrary with actual curve variation tendency.Element in MS be on the occasion of number m larger, show that prediction curve is similar to actual curve in the variation tendency of most of time; Otherwise m is less, show that prediction curve is contrary with actual curve in the variation tendency of most of time, in MS on the occasion of number reflect the predictive ability of prediction algorithm to actual value in a sense.For this reason, in the present invention the trend of forecasting sequence unanimously amount represent on the occasion of number with in phasor MS, that is:

$\mathrm{TCA}=\left|\right\{\∀M_i|M_i>0\}|$

Wherein, represent the set formed on the occasion of element in product vector M S, for this is on the occasion of the gesture of set, represent the number of wherein element.

The trend fitting degree of prediction curve represents with the ratio in forecasting sequence and actual sequence between trend identical sequence number and the gesture of sequence.

$\mathrm{TF}=\frac{\mathrm{TCA}}{\left|\mathrm{PS}\right|}$

Wherein, TCA represents on the occasion of number in product vector M S, | PS| is called the gesture of sequence PS, represents the number of element in sequence PS.The trend fitting degree of forecasting sequence and actual curve is higher, illustrates that the possibility that the accuracy of forecast of prediction algorithm is high is larger, therefore should give its higher combining weights when combined prediction; Otherwise, be that it distributes lower combining weights when combined prediction.

After the trend fitting degree obtaining each algorithm, trend fitting degree is normalized, can using its normalization result as its trend fitting weight Tw (Trend Fitness Weight).

$T{w}_i=\frac{T{F}_i}{\underset{j=1}{\overset{n}{\mathrm{\Σ}}}T{F}_j}$

Wherein Tw _ibe the trend fitting weight of the i-th Seed model prediction algorithm, be the trend fitting degree of the i-th Seed model prediction algorithm, n is the number of submodel in built-up pattern.

3) calculating of matching degree of stability and matching stability weight

Information entropy indicates the number of contained quantity of information, is the description to systematic uncertainty degree, can be used for the degree of uncertainty of scaling information.For one group in [0,1] and meet normalized data, information entropy can weigh the intensity of data.If n uncertainty event, is designated as x in an infosystem ₁, x ₂..., x _n, the probability of happening of each event is designated as p ₁, p ₂..., p _n, then the computing formula of information entropy is:

$H=-\underset{i=1}{\overset{n}{\mathrm{\Σ}}}{p}_i\mathrm{lo}{g}_a{p}_i$

The relative error of each segmentation in forecasting sequence forms relative error sequence (Absolute Percent ErrorSerial, E _aPEs):

E _APES＝{E _APES ₁,E _APES ₂,…,E _APES _n}

According to the implication of information entropy, E _aPEthe information entropy of S sequence is larger, and the matching of prediction algorithm to situation actual value more tends towards stability, and it is stronger to the capability of fitting of situation real curve.Therefore, stable, the lasting capability of fitting of prediction algorithm to target situation curve can be reflected preferably.

The information entropy of MAPES sequence of matching degree of stability for this reason represents, its computing formula is as follows:

$\mathrm{FS}=-\underset{i=1}{\overset{n}{\mathrm{\Σ}}}{E}_{\mathrm{APE}}{S}_i\mathrm{lo}{g}_a{E}_{\mathrm{APE}}{S}_i$

The matching degree of stability of forecasting sequence and actual curve is higher, illustrates that the lasting accurately predicting ability of prediction algorithm is higher, therefore, should give its higher combining weights when combined prediction; Otherwise, should be it and distribute lower combining weights.

After the matching degree of stability obtaining each algorithm, matching degree of stability is normalized, can using its normalization result as its matching stability weight Sw (Fitness Stability Weight).

$S{w}_i=\frac{F{S}_i}{\underset{j=1}{\overset{n}{\mathrm{\Σ}}}F{S}_j}$

Wherein Sw _ibeing the matching degree of stability weight of the i-th Seed model prediction algorithm, is FS _ithe matching degree of stability of the i-th Seed model prediction algorithm, n is the number of submodel in built-up pattern.

3. adopt evidence theory to carry out weight fusion to index weights obtained above, to obtain the combining weights of each submodel algorithm.

Evidence theory is by merging multi-source evidence, obtains and describes, to reduce the uncertain mode of information proposition consistance.

In the combination forecasting provided in the present embodiment, each submodel algorithm comprises double smoothing, BP neural network model and ARIMA model, and the predicted value that individual model obtains is respectively P ₁, P ₂, P ₃, the weight of three kinds of models is respectively _w1, _w2, _w3, identification framework Θ={ P ₁, P ₂, P ₃, the length of sample sequence is n, is distributed by weights to be converted into trust and distributes:

m(P _i)＝w _i(i＝1,2,3)

The result that three kinds of weights distribute is converted into trust and distributes, relative error evidence matrix E can be obtained _e:

$E_e\left[\begin{array}{ccc}E{w}_{11}& E{w}_{12}& E{w}_{13}\\ E{w}_{21}& E{w}_{22}& E{w}_{23}\\ ..& ..& ..\\ E{w}_{n1}& E{w}_{n2}& E{w}_{n3}\end{array}\right]$

By the combinatorial formula of evidence theory to matrix E _emerge, more accurate relative error weights Ew can be obtained _c1, Ew _c2, Ew _c3.

Different weights sequence Ew can be given for the algorithm in combinational algorithm model according to relative error, trend fitting degree and matching degree of stability _c1, Ew _c2, Ew _c3, Tw ₁, Tw ₂, Tw ₃, Sw ₁, Sw ₂, Sw ₃.Three kinds of weights allocative decisions have rated the precision of prediction of submodel from different angles.Be similar to the process of Ew, three kinds of weights allocation result be converted into trust and distribute, combining weights evidence matrix E can be obtained _c:

$E_c=\left[\begin{array}{ccc}E{w}_{c1}& E{w}_{c2}& E{w}_{c3}\\ T{w}_1& T{w}_2& T{w}_3\\ S{w}_1& S{w}_2& S{w}_3\end{array}\right]$

By evidence theory to evidence matrix E _cmerge, more accurate weight allocation Fw=(m can be obtained _c1, m _c2, m _c3), this allocation result is combining weights.

$m\left(A\right)=\left\{\begin{array}{c}0,A=\mathrm{\φ}\\ {(1-k)}^{-1}{\mathrm{\Σ}}_{\∩A_i=A}{\mathrm{\Π}}_{i=1}^n{m}_i\left(A_i\right),A\≠\mathrm{\φ}\end{array}\right.$

Wherein, [illustrate, have 3 evidence sources here, therefore n=3; m _i(A) corresponding to the Ew in matrix _c1, Ew _c2, Ew _c3, Tw ₁, Tw ₂, Tw ₃, Sw ₁, Sw ₂, Sw ₃, the result of calculation of m (A) is weight vectors, by its assignment to Fw=(m _c1, m _c2, m _c3).

4. will obtain combining weights to bring combination forecasting into and carry out combined prediction, predicting the outcome of obtaining is the present invention and adopts combination forecasting to obtain integrated forecasting result.

P _c＝m _c1P ₁+m _c2P ₂+m _c3P ₃

Wherein P _cfor obtaining integrated forecasting result, P ₁, P ₂and P ₃be respectively the predicted value adopting double smoothing, BP neural network model and ARIMA model, m _c1, m _c2and m _c3the weight of above-mentioned model respectively.

The pseudo-code of said process describes as shown in table 1.

Table 1

The relative error that the present invention adopts, matching consistent degree and matching Stability index have certain ubiquity to the performance of portraying forecast model.But the change due to situation curve is uncertain, therefore, in some cases, the expression of some index to situation curve there will be relatively large deviation, thus causes poor precision of prediction.

For this reason, on above-mentioned Forecasting Methodology basis, the present invention, in order to improve the precision of prediction further, adopts the discount on securities method of Shafer to be optimized adjustment to index weights in new predetermined period.

Suppose, carried out n precise combination prediction (reaching the precision threshold of setting), be consistent if the weight allocation obtained according to certain index and combining weights are assigned m time, then the index intensity of this index can be expressed as:

$\mathrm{IS}=\frac{m}{n}$

The intensity of index illustrates the degree of support to accurately predicting.Index intensity is higher, and the status of this index in built-up pattern is more important, and credibility is higher; Otherwise the status of this index in built-up pattern is more important, and credibility is lower.Index intensity is normalized, to obtain index confidence level IC.

$I{C}_i=\frac{I{S}_i}{\underset{i=1}{\overset{k}{\mathrm{\Σ}}}I{S}_i}$

Index confidence level features the evaluating ability of prediction index to predictor model preferably.The optimization evolution process of Tendency Prediction model should weaken the weight allocation result of low credible indexes, reduces the negative effect of low credible indexes as much as possible.In built-up pattern, index weights carries out combining with the form of evidence, and the discount on securities method that Shafer proposes effectively can reduce low credible evidence and merge the impact in conclusion.Therefore, after each combined prediction completes, calculate Certainty Factor, in new predetermined period, adopt the discount on securities method of Shafer to be optimized adjustment to index weights.The expression formula of discount on securities method is as follows:

$\left\{\begin{array}{c}{m_i}^{\′}\left(A\right)=w_i{m}_i\left(A\right),\\ {m_i}^{\′}\left(\mathrm{\Θ}\right)=-w_i+w_i{m}_i\left(\mathrm{\Θ}\right),\end{array}\right.,\∀A\⋐\mathrm{\Θ}$

Wherein, w ₁..., w _i..., w _nrepresent the weight of evidence i, can replace by index confidence level; m _i(A) represent the degree of belief of burnt unit in evidence, available index weights replaces.

Claims (10)

1. based on a network security situation prediction method for evidence theory, it is characterized in that, this Forecasting Methodology comprises the following steps:

1) the network safety situation result obtained according to submodel algorithm predicts each in network safety situation combination forecasting and real network security postures build sample set;

2) evaluation index and the index weights of each submodel algorithm is determined according to constructed sample set;

3) evidence theory is utilized to merge the index weights in each submodel algorithm obtained, to obtain the combining weights of each submodel algorithm;

4) combining weights that basis obtains is brought in combination forecasting and is carried out combined prediction, realizes the integrated forecasting of combination forecasting to network safety situation.

2. the network security situation prediction method based on evidence theory according to claim 1, it is characterized in that, the method be also included in combined prediction complete after parameter confidence level, adopt discount on securities method to be optimized adjustment to index weights, to reduce the negative effect of low confidence level target.

3. the network security situation prediction method based on evidence theory according to claim 1 and 2, it is characterized in that, described step 2) in the evaluation index of each submodel algorithm comprise relative error, trend fitting degree and matching degree of stability, described index weights comprises relative error weight, trend fitting weight and matching stability weight.

4. the network security situation prediction method based on evidence theory according to claim 3, is characterized in that, described step 3) in the deterministic process of combining weights as follows:

A. using three kinds of weights allocation scheme of the relative error weight of each submodel algorithm in the built-up pattern that obtains, trend fitting weight and matching stability weight each submodel algorithm in built-up pattern;

B. above-mentioned weights allocation scheme is converted into trust and distributes, obtain weight evidence matrix;

C. merged the weight evidence matrix obtained by evidence theory, the weight allocation of acquisition is combining weights.

5. the network security situation prediction method based on evidence theory according to claim 4, is characterized in that, in described step C, the computing formula of combining weights is:

$m\left(A\right)=\left\{\begin{array}{c}0,A=\mathrm{\φ}\\ {(1-k)}^{-1}{\mathrm{\Σ}}_{\∩A_i=A}{\mathrm{\Π}}_{i=1}^n{m}_i\left(A_i\right),A\≠\mathrm{\φ}\end{array}\right.$

Wherein, m _i(A _i) corresponding to each vector in weight evidence matrix, the result of calculation of m (A) is weight vectors, by its assignment to Fw=(m _c1, m _c2, m _c3).

6. the network security situation prediction method based on evidence theory according to claim 5, is characterized in that, described step 4) integrated forecasting result be:

P _c＝m _c1P ₁+m _c2P ₂+…+m _cnp _n

Wherein P _cfor obtaining integrated forecasting result, P ₁, P ₂p _nbe respectively the Tendency Prediction value of each submodel algorithm in built-up pattern, m _c1, m _c2m _cnthe weight of corresponding submodel algorithm respectively.

7. the network security situation prediction method based on evidence theory according to claim 5, is characterized in that, step 1) in the structure of sample set be realized by moving window mode.

8. the network security situation prediction method based on evidence theory according to claim 5, is characterized in that, described step 2) in the computing formula of relative error weight be:

${\mathrm{Ew}}_i=\frac{E_{\mathrm{APEi}}}{\underset{j=1}{\overset{n}{\mathrm{\Σ}}}{E}_{\mathrm{APEj}}}$

Wherein Ew _ibe the relative error weight of the i-th Seed model prediction algorithm, E _aPEibe the relative error of the i-th Seed model prediction algorithm, n is the number of built-up pattern neutron model algorithm.

9. the network security situation prediction method based on evidence theory according to claim 5, is characterized in that, described step 2) in the computing formula of trend fitting weight be:

${\mathrm{Tw}}_i=\frac{{\mathrm{TF}}_i}{\underset{j=1}{\overset{n}{\mathrm{\Σ}}}{\mathrm{TF}}_j}$

Wherein Tw _ibe the trend fitting weight of the i-th Seed model prediction algorithm, be the trend fitting degree of the i-th Seed model prediction algorithm, n is the number of built-up pattern neutron model algorithm.

10. the network security situation prediction method based on evidence theory according to claim 5, is characterized in that, described step 2) in the matching computing formula of stablizing weight be:

${\mathrm{Sw}}_i=\frac{{\mathrm{FS}}_i}{\underset{j=1}{\overset{n}{\mathrm{\Σ}}}{\mathrm{FS}}_j}$

Wherein Sw _ibeing the matching degree of stability weight of the i-th Seed model prediction algorithm, is FS _ithe matching degree of stability of the i-th Seed model prediction algorithm, n is the number of built-up pattern neutron model algorithm.