CN112766343B

CN112766343B - Network security situation assessment method based on improved WOA-SVM

Info

Publication number: CN112766343B
Application number: CN202110034429.2A
Authority: CN
Inventors: 张然; 刘敏; 胡颖; 刘洋; 潘芷涵; 蔡增玉; 张启坤; 甘勇
Original assignee: Zhengzhou University of Light Industry
Current assignee: Zhengzhou University of Light Industry
Priority date: 2021-01-12
Filing date: 2021-01-12
Publication date: 2022-03-11
Anticipated expiration: 2041-01-12
Also published as: CN112766343A

Abstract

The invention provides a network security situation assessment method based on an improved WOA-SVM, which comprises the following steps: forming a sample set by using the existing network security data; initializing a WOA algorithm and an SA algorithm; selecting spiral predation or random search prey, updating the current whale position in the WOA algorithm by using a self-adaptive weight method, and updating the current optimal position and global optimal position of the whale; judging whether to accept a new whale position according to the sudden jump probability of the SA algorithm; judging whether the termination condition of iteration is met; and assigning the obtained value of the global optimal position to the SVM, carrying out SVM network training by using the regression fitting analysis optimal parameter, and converting the evaluation value into a network security level. The invention utilizes the global optimization characteristic of WOA to search the optimal parameter of SVM, utilizes the adaptive weight to adjust the whale position updating coefficient, and adopts SA algorithm to increase the random searching factor, thereby avoiding trapping into local extreme value and improving the global optimization capability.

Description

Network security situation assessment method based on improved WOA-SVM

Technical Field

The invention relates to the technical field of network security situation assessment, in particular to a network security situation assessment method based on an improved WOA-SVM.

Background

With the high-speed development and application of technologies such as internet, big data, cloud computing and artificial intelligence in China, the security of network space also faces more and more risks and threats, and the more prominent problems are DDoS attack, APT attack, the continuous rising of the number of high-risk vulnerabilities, the frequent occurrence of data leakage events, the continuous emergence of grey application programs and the potential safety hazards brought by high and new technologies. The security problem faced by the current network system is mainly expressed in that: the related network security data quantity is gradually increased and increasingly becomes data; network security events are continuously cut apart so as to be difficult to sense, obtained security information is scattered and disordered, and a manager needs to spend a large amount of time and energy to analyze potential security threats, so that the time and the labor are consumed, and the result is more and more successful; many existing network security systems have limitations on data collection, and some network security systems are limited to collect, analyze and process security data of one or more aspects in a network, and are difficult to comprehensively describe and reflect the security conditions of the network. In the face of these new challenges and threats, existing traditional network security defense means, policies and methods (such as intrusion detection systems, firewalls, anti-viruses, access control, etc.) have not kept up with the actual security requirements of today's network systems.

The security situation awareness was first applied in the aviation and military fields, and was gradually popularized to the network security field later. Network security posture assessment is an important means to understand the current network security situation. In 1988, Endsley summarized it into three layers, namely "extraction of Situation elements, Situation understanding and Situation prediction", on the basis of the concept of Situation Awareness (Situation aware), wherein the core of "Situation understanding" is "Situation assessment". In 1999, Bass applies the mature theory and technology of air traffic supervision ATC Situation Awareness to network security Situation Awareness, and provides the concept of electronic space Situation Awareness (Cyberspace Awareness) for the first time, which lays a foundation for the research of network security Situation technology. Network security situation awareness means that environmental factors are known and understood in a certain space-time range, and future security development trends are predicted. The concept of network security posture assessment was later presented on the basis of the model of Endsley. The network security situation evaluation can integrate and analyze situation elements and data information extracted from a network, perform modeling evaluation on the current network security situation, obtain situation values according to an evaluation model, dynamically reflect the current operation state of a network system and the severity of the threat in the whole, predict and early warn the development trend of the network system, and provide decision support for network security management. The network security situation assessment is used as a new technology of next generation network security and an important component of a novel network security defense system, and has important research significance and application value.

The network security situation assessment is that after original security data and events on a network are collected and preprocessed, based on an established network security situation index system, on the basis of certain priori knowledge, a series of mathematical models and algorithms are used for processing, and then a quantitative or qualitative network security situation assessment result is obtained in the form of a security situation value so as to reflect the current network security situation. At present, network attacks increasingly present the characteristics of diversification, complication and randomness, and the network security situation is also a complex and constantly changing nonlinear process, so that the evaluation of the network security situation by adopting the artificial intelligence technologies such as machine learning and deep learning is a necessary development trend. How to construct a network security situation assessment model with high accuracy and scientific and objective is a key point of network security situation assessment research. Many artificial intelligence-based evaluation methods have been proposed, but they can be roughly classified into three types, namely mathematical model-based, knowledge-based reasoning and pattern-based recognition, according to the underlying theory.

Based on a mathematical model: the evaluation is mainly carried out by constructing an evaluation function, and the most important is the construction of the function. The most common method is an analytic hierarchy process, such as documents [ Cumminghui, sealed civilians, Liubiao and the like ] an improved hierarchical network security situation assessment model simulation [ J ] computer simulation, 2019, 36(11):284 289+369 ] proposes a network security situation assessment model which adopts an alarm verification algorithm and a fuzzy inference algorithm to improve the hierarchical analytic process, the assessment model can effectively eliminate the influence of false alarm information and intuitively reflect the security situation of the network, but the data source of the method is single; the literature [ [5] WANG H, CHEN Z, FENG X, et al.research on Network Security establishment Assessment and quantitative Method Based on analytical Hierarchy Process [ J ]. Wireless Personal Communications,2018,102(2),1401 and 1420 ] proposes an Assessment Method combining an AHP Analytic Hierarchy Process and a hierarchical model of Situation Assessment, thereby simplifying Situation Assessment problems, and the model can reflect the overall Security state of the Network and better provide decision service for high layers. However, the method based on the mathematical model has no objective unified standard so far, and is easily influenced by subjective human factors, thereby causing inaccuracy of the evaluation result.

Based on knowledge reasoning: the method mainly establishes a model according to certain criteria and empirical knowledge, and applies a logical reasoning theory to evaluate, wherein the most representative is an evidence theory and a graph model. An evidence theory-based method, such as a document [ Yang Hongyu, Wang rock, Luwei force ] an unsupervised generative inference-based network security threat situation assessment method [ J ] Qing Hua university academic newspaper (Natural science edition), 2020, 60(06): 474-; a Network Security Situation assessment Model Based on the D-S Evidence Theory is researched in the literature [ ZHAO Z, ZHAN TT, WANG H, et al.Quantitative Evaluation Model of Network Security establishment Based on D-S Evaluation Theory [ C ]. 20196 th International Conference on dependent Systems and Theory Applications, DSA,2019: 1884-. A method based on a graph model, such as a document [ Lexin, paragraph , a network security situation assessment method [ J/OL ] based on an improved hidden Markov model, computer science 2020(05):1-5[2020-06-22] ] proposes a situation assessment method for improving a hidden Markov model by adopting a crowd search algorithm, which can more accurately assess the network security condition, but unrelated and false-positive data exist in situation elements and further research on an observation sequence is needed; a network Security Situation Assessment Method which takes a Markov Game Model as a core and combines four-level data fusion is provided in the document [ LI X, LU Y, NIE W. However, when a large amount of data conflicts are encountered, the method based on knowledge reasoning has large calculation amount and complexity, independence among all evaluation indexes is difficult to guarantee, and sometimes expert experience is also relied on, which may result in low evaluation accuracy.

Based on pattern recognition: the method is mainly based on machine learning theory for evaluation, and is a method researched by the invention, and the main specific methods include rough set, neural network, Support Vector Machine (SVM) and the like. For example, a Situation Assessment model for Optimizing a CS-BP Neural Network by using a D-S Evidence Theory is provided in documents of [10] QIANG J, WANG F, DANG XL, Network Security Based on D-S evaluation Theory optimization CS-BP Neural Network establishment Assessment [ C ],2018IEEE International Conference on Cyber Security and Cloud Computing (CSCloud), Shanghai,2018: 153-; an SVM parameter network Security condition evaluation Model Based on GSA optimization is proposed in the literature [ CHEN YX, YIN XC, SUN A. network Security establishment Assessment Model Based on GSA-SVM [ C ]. Proceedings of2018International Conference on Computer,2018,2:161 and 167 ], and the optimal parameters are searched in an SVM by GSA so as to minimize the error between the generated data and the actual network Security condition evaluation data. However, when the method based on pattern recognition meets large-scale complex data, the learning efficiency becomes low, the optimal parameters are difficult to determine, and the adaptive capacity becomes poor.

At present, a network security situation assessment method is not standardized, and the problems that the accuracy needs to be improved and the like exist. Aiming at the problems of low accuracy and slow convergence in the evaluation method, the invention provides a network security situation evaluation method for optimizing a Support Vector Machine (SVM) by introducing a Whale Optimization Algorithm (WOA) into a self-adaptive weight combined with a simulated annealing algorithm (SA), and the network security situation evaluation method is compared with other network security situation evaluation methods for optimizing the SVM by an intelligent algorithm.

Disclosure of Invention

Aiming at the technical problems that the existing network security situation assessment method is low in accuracy and slow in convergence, and local extremum is easy to fall into when WOA solves the problems of large data volume and complexity, and the convergence speed is slow, the invention provides a network security situation assessment method based on an improved WOA-SVM.

In order to achieve the purpose, the technical scheme of the invention is realized as follows: a network security situation assessment method based on an improved WOA-SVM comprises the following steps:

the method comprises the following steps: forming a sample set by taking the existing network safety data as sample data, carrying out normalization pretreatment on the sample data in the sample set, and dividing the sample data into a training set and a test set;

step two: initializing the population scale of a WOA algorithm, the upper and lower limits and the initial position of a whale position, and initializing the annealing temperature, the cooling rate and the jump probability of an SA algorithm; initializing the iteration time t as 1 and the maximum iteration time maxgen;

step three: iterative optimization: selecting spiral predation or random hunting according to the random probability p, updating the current whale position in the WOA algorithm by using a self-adaptive weight method, comparing the current whale position with the original whale position, and updating the current optimal whale position and the global optimal position;

step four: judging whether to accept a new whale position according to the sudden jump probability of the SA algorithm, updating the optimal whale position and the global optimal position, and storing;

step five: judging whether the iteration termination condition is met, if so, entering the step six, otherwise, returning to the step two;

step six: and assigning the obtained value of the global optimal position to an optimal punishment parameter and a kernel function parameter of the SVM, analyzing the optimal parameter by utilizing regression fitting, performing SVM network training by combining a training set, inputting sample data in a test set into the trained SVM to obtain an evaluation value, and converting the evaluation value into a network security level.

The sample data takes the number of hosts infected with viruses, the total number of tampered websites, the total number of implanted gate websites, the number of counterfeit pages of domestic websites and the number of newly-added information security vulnerabilities as evaluation indexes, and converts five security levels of high risk, danger, medium risk, light risk and security into digital levels, wherein the digital levels are evaluation values obtained by an SVM:

level of security	High risk	Danger of	Middle danger	Light danger	Secure
						Evaluation value	[0,1)	[1,2)	[2,3)	[3～4)	[4～5]

The sample data is normalized and preprocessed as follows:

wherein x, y ∈ Rⁿ，x_minFor minimum data, x, in a sample set_maxFor the maximum data in the sample set, sample data is normalized to [ -1,1 [ ]]And (4) the following steps.

The method for updating the whale position in the WOA algorithm by using the self-adaptive weight method in the third step comprises the following steps:

M(t+1)＝k(t)*M^*(t)-A·D，

M(t+1)＝k(t)*D′·e^blcos(2πl)+M^*(t)，

M(t+1)＝k(t)*M_rand-A|CM_rand(t)-M(t)|，

wherein the adaptive weight coefficient

M^*(t) is the position vector of the optimal solution at the t-th iteration; m (t) is the position vector of whale at the t iteration, and M (t +1) is the position vector of whale at the t +1 iteration; d is the iteration distance between the optimal solution position and the current solution during the t-th iteration; a and C are coefficient vectors, D' ═ M^*(t) -M (t) l represents the position distance between the ith whale individual and the current optimal solution; b is a constant for defining the shape of the logarithmic spiral, l ∈ [ -1,1]A random number within; m_randIs a randomly selected position vector from the current population.

The coefficient vectors a and C are respectively:

A＝2a·r₁-a，C＝2r₂；

wherein a is a constant that linearly decreases from 2 to 0 in an iterative process, and

r₁and r₂Is [0, 1]]Random vector of (2).

The method for selecting spiral predation or random hunting according to the random probability p in the third step is as follows:

when the iteration time t is less than or equal to maxgen, updating the parameters a-1 + t ((-1)/maxgen) and r₁＝rand()、r₂Rand (), A, C, constant b 1, l (a)₂-1) × rand +1, random probability p ═ rand (), and adaptive weight coefficients

Iterative optimization: when the random probability p is less than 0.5, if the coefficient vector | A | is more than or equal to 1, randomly selecting the whale colony individual position M from the current colony_randCalculating whale positions of searched prey: m (t +1) ═ k (t) × M_rand-A|CM_rand(t) -m (t) |; if | A | < 1, updating the spatial position of the current whale population individuals by a contraction enclosure mechanism: m (t +1) ═ k (t) × M^*(t) -A.D; when the random probability p is more than or equal to 0.5, the spatial position of the current whale colony individual is updated in a spiral mode: m (t +1) ═ k (t) · D' · e^blcos(2πl)+M^*(t); updating the whale optimal position, the global optimal position and the fitness values of the updated whale position and the current global optimal position;

and taking the average Mean Square Error (MSE) as an optimized objective function value, namely an adaptability value.

The kick probability P_iComprises the following steps:

and df ═ fitness (i) -fitnesszbest;

wherein, fitness (i) is the current whale fitness value, and fitnesszbest is the global optimal whale fitness value; df is the difference between the current whale fitness value and the globally optimal whale fitness value; t is_tIs the current temperature;

selecting a searcher in the neighborhood of the global optimal fitness value in the fourth step, calculating a difference value df, and replacing the original position with a new whale position if the difference value df is less than 0; if the difference df is greater than or equal to 0, the probability exp (-df/T)_t) Judging whether the position of the inferior solution is accepted or not; then the optimal whale position gbe is updatedst and a global optimum position zbest.

The current temperature T_tThe initialization is as follows:

current temperature T_tThe rate of change of (c) is: t is_t+1＝μT_t；

Wherein, the fitnesszbest is the overall optimal whale fitness value, alpha and mu are control parameters, t is the iteration times, t is more than or equal to 0, mu is more than or equal to 0 and less than or equal to 1, and alpha belongs to [0.2,0.5 ].

The termination condition is whether the maximum iteration time maxgen is met or the error precision requirement is met: mean square error MSE < 0.01.

Compared with the prior art, the invention has the following beneficial effects:

1) a network security situation assessment method for optimizing a Support Vector Machine (SVM) (WOA-SVM) based on a Whale Optimization Algorithm (WOA) based on adaptive weighting and Simulated annealing Algorithm (SA) is provided, and the security situation value is generated by training of an improved SVM model to assess the security situation of the current network.

2) The adaptive weight is introduced into the WOA in combination with a simulated annealing algorithm (SA) to overcome the problems of local optimization and slow convergence of the WOA, so that the global optimizing capability of the WOA is improved.

3) And finding the optimal punishment parameter c and the kernel function parameter g of the SVM by using the improved WOA, so that the accuracy of the SVM-based evaluation model is improved.

4) Compared with the method for improving the WOA-SVM by the WOA-SVM and other algorithms, the result shows that the method for improving the network security situation of the WOA-SVM by combining the self-adaptive weight with the simulated annealing algorithm has the advantages of smaller error, higher accuracy and better convergence, and can be used for more effectively evaluating the security situation of the current network.

According to the method, the SVM is embedded into the fitness function calculation of the improved WOA, the optimal parameter of the SVM is found by using the global optimization characteristic of the WOA, the whale position updating coefficient is adjusted by using the self-adaptive weight, the random search factor is increased by using the simulated annealing algorithm, and the phenomenon that the SVM falls into a local extreme value is avoided, so that the global optimization capability is improved. The experimental result shows that the method can more accurately evaluate the security situation of the network and has better convergence compared with other improved SVM evaluation algorithms.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

FIG. 1 is a schematic flow chart of the present invention.

FIG. 2 is a graph illustrating the data normalization of the present invention.

Fig. 3 is a comparison of the evaluation results of the present invention and several different algorithms.

Fig. 4 is a graph showing the variation of the optimal fitness value of the present invention and each optimization algorithm.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without any inventive step, are within the scope of the present invention.

As shown in fig. 1, a method for evaluating a network security situation based on an improved WOA-SVM, that is, a method for evaluating a network security situation based on an adaptive weight combined with a simulated annealing algorithm to improve a WOA-SVM, includes the following steps:

the method comprises the following steps: and forming a sample set by taking the existing network safety data as sample data, carrying out normalization pretreatment on the sample data in the sample set, and dividing the sample data into a training set and a test set.

The method takes network safety data published in the third stage 2016 to the seventeenth stage 2020 from network safety information and dynamic Weeking published by the national Internet emergency center as experimental data, and selects 270 data sets as a training set and 10 data sets as a test set. The experimental data mainly take the number of hosts infected with viruses, the total number of tampered websites, the total number of implanted gate websites, the number of counterfeit pages of domestic websites and the number of newly-added information security holes as evaluation indexes. The five aspects can relatively comprehensively reflect the modern network security condition and can be used as an index for evaluating the basic situation of the network security every week. For convenience of experiment, the invention converts five safety levels of high risk, danger, medium risk, light risk and safety into digital levels as shown in table 1.

TABLE 1 network Security situation value conversion Table

Level of security	High risk	Danger of	Middle danger	Light danger	Secure
						Situation value	[0,1)	[1,2)	[2,3)	[3～4)	[4～5]

The adoption of data normalization processing helps to improve the accuracy of situation assessment, so the invention performs normalization preprocessing on sample data according to the formula (17):

wherein x, y ∈ Rⁿ，x_minFor minimum value data, x, in the sample set, i.e. training set and test set_maxFor maximum data in a sample set, the above formula can normalize the data to [ -1,1 [ ]]The results after pretreatment are shown in FIG. 2.

Step two: initializing the population scale of a WOA algorithm, the upper and lower limits and the initial position of a whale position, and initializing the annealing temperature, the cooling rate and the jump probability of an SA algorithm; the initialization iteration time t is 1, and the maximum iteration time maxgen.

In the invention, the population size of the WOA algorithm is initialized to be 100, the upper limit and the lower limit of the position of whale are xub ═ 100,100 and xlb ═ 0.01 and 0.01 respectively, and the initial position is xRange ═ repmat ((xub-xlb), [ sizepop,1 ]); xLower ═ repmat (xlb, [ sizepop,1 ]); pop (sizepop, dim) xRange + xLower. The annealing Temperature for initializing the SA algorithm is Temperature 0-8; the cooling rate is T ═ fitnesszbest/log (0.2); the kick probability is Tfit ═ zeros (sizepop, 1). The maxgen is initialized to 100 and the error precision is the mean square error MSE < 0.01.

Step three: selecting spiral predation or random searching prey according to the value of the random probability factor p, updating the whale position in the WOA algorithm by using a self-adaptive weight method, updating the optimal position and the global optimal position of the whale, and calculating the fitness value of the updated optimal position of the whale and the current global optimal position.

The whale optimization algorithm WOA is a novel meta-heuristic intelligent optimization algorithm proposed by two scholars of Mirjalii and Lewis in 2016, and an optimal solution is mainly found by simulating a spiral bubble net search strategy of whales with heads. The algorithm has the advantages of few adjustment parameters, simplicity in operation, easiness in understanding and the like, but the problems of local extremum falling, low convergence speed and the like are easily caused when the problems of relatively large data volume and relatively complex data volume are solved. Whale optimization algorithm of global search strategy [ J ] small-sized microcomputer system, 2020,41(09):1820 @ 1825 ] using adaptive weight and optimal neighborhood perturbation to guide updating position, the invention is to improve whale optimization algorithm using adaptive weight in combination with simulated annealing algorithm, and the WOA algorithm mainly comprises the following optimizing steps: surround prey, spiral predation, search prey, specifically be:

(1) surrounding prey

When the whale at the head is in the best position, other whales approach to the position, and the position update of the whale in the iterative optimization process is represented by the following formulas (1) and (2):

D＝|CM^*(t)-M(t)| (1)

M(t+1)＝M^*(t)-A·D (2)

wherein M is^*(t) is the position vector of the optimal solution in the t-th iteration, and when a more optimal solution appears in the iteration process, M^*(t) will be updated accordingly; m (t) is the position vector of the solution (or whale) at the t iteration, M (t +1) is the position vector of the solution at the t +1 iteration; d is the iteration distance between the optimal solution position and the current solution during the t-th iteration; coefficient vectors a and C are determined by equations (3) and (4):

A＝2a·r₁-a (3)

C＝2r₂ (4)

where a is a constant that drops linearly from 2 to 0 in an iterative process, which can be expressed as

maxgen is the maximum number of iterations;r₁and r₂Is [0, 1]]Random vector of (2).

(2) Spiral predator

As whale (seeker) gets closer to the prey (optimal solution), the variable a will decrease with it, while the coefficient vector a will also decrease linearly with a according to equation (3). When the coefficient vector a ∈ [ -1, 1], the next position of a new whale (seeker) can be any position between the current whale position and the optimal whale (optimal solution) position, and the whale (seeker) will launch an attack on the prey (optimal solution) in a spiral-like manner, updating the positions according to equation (5), and gradually approaching the prey position.

M(t+1)＝D′·e^blcos(2πl)+M^*(t) (5)

Wherein, D' ═ M^*(t) -M (t) represents the location distance between the ith searcher and the current optimal solution; b is a constant defining the shape of the logarithmic spiral, l e-1, 1]The random number in (c).

The whale head moves in a spiral manner, and the search range is continuously reduced, so that assuming that the selection is switched between a shrink wrap mechanism and a spiral model with a probability of 50%, the whale position is updated according to the formulas (6) and (7):

M(t+1)＝M^*(t)-A·D (6)

M(t+1)＝D′·e^blcos(2πl)+M^*(t) (7)

wherein, D' ═ M^*(t) -M (t) l represents the location distance between the ith searcher and the current best solution.

(3) Searching prey

The whale standing still searches for prey randomly, so that the global searching capability of the algorithm can be improved, and the random searching prey whale position updating formula is shown as (8):

M(t+1)＝M_rand-A|CM_rand(t)-M(t)| (8)

wherein M is_randIs a randomly selected position vector from the current population (representing a random whale).

When facing relatively complex problems or relatively large data environments, the WOA algorithm has the limitations of being prone to local optimization and slow in convergence speed. The invention utilizes the self-adaptive weight to adjust the whale position updating coefficient, and adopts the simulated annealing algorithm (SA) to increase random search factors to obtain an improved whale optimization algorithm, thereby avoiding trapping a local extreme value and improving the global optimization capability.

The inertial weight coefficients may not only have an impact on the local search capability of the algorithm, but also on the global search capability of the algorithm, for example: the relatively large weight coefficient is beneficial to jumping out of a local optimal trap of the algorithm, so that the global search capability of the algorithm is improved, and the relatively small weight coefficient is beneficial to accurately searching a local search space, so that the local search capability of the algorithm and the convergence of the algorithm can be improved. The whale position is updated by utilizing the characteristic of the self-adaptive weight method, and the calculation formula is shown as (9):

where t is the number of iterations, and the maximum number of iterations maxgen is 100. k (t) represents an adaptive weight coefficient.

Substituting the adaptive weight coefficient k (t) into the formulas (6), (7) and (8), the position updating formulas of the improved WOA algorithm are shown as (9), (10) and (11).

M(t+1)＝k(t)*M^*(t)-A·D (10)

M(t+1)＝k(t)*D′·e^blcos(2πl)+M^*(t) (11)

M(t+1)＝k(t)*M_rand-A|CM_rand(t)-M(t)| (12)

The Simulated annealing algorithm (SA) is a global optimization algorithm extended from a local search algorithm, so that the introduction of the SA into the WOA can enhance the global optimization capability during the search thereof, thereby effectively preventing the WOA from trapping in the locally optimal trap.

In the WOA iterative optimization process, WOA is used to find individual best and global best, but if the best bit of the populationIf the optimal fitness value is in a local extreme value, the obtained optimal fitness value tends to a local minimum value, so that the global search performance of the algorithm is reduced. Therefore, in order to avoid falling into local extreme values, the principle of SA is introduced, namely the sudden jump probability is adopted, and the probability P is adopted_iAccepting the pernicious solution to help the WOA jump out of local optimality. Probability P_iDetermined by equations (13) and (14):

df＝fitness(i)-fitnesszbest (14)

in the above formula, fitness (i) is the current whale fitness value, and fitnesszbest is the global optimal whale fitness value. df is the difference of fitness between the two, and the judgment is carried out according to the positive and negative of the difference, if df is a negative number, the new whale position is superior to the original population optimal position, so that the new position replaces the original population optimal position, namely the current whale position is the global optimal whale position; if df is positive, it indicates that the new whale position is inferior to the original population optimal position, so a temperature T corresponding to the current temperature is generated_tCorresponding probability exp (-df/T)_t) And judging whether to accept the new solution. Wherein the current temperature T_tSuch as equations (15) and (16):

T_t+1＝μT_t (16)

wherein, the fitnesszbest is the global optimal whale fitness value, alpha belongs to [0.2,0.5], l is a cooling coefficient, and t is the iteration number. Alpha and mu are control parameters, t is more than or equal to 0, and mu is more than or equal to 0 and less than or equal to 1.

Calculating a fitness value: calculating the extreme value positions of the individuals and the groups and the corresponding optimal fitness value, and randomly generating the position of a whale and the corresponding fitness value: pop (sizepop, dim) xRange + xLower; fit (i) ═ fobj (pop (i): input _ train, output _ train, input _ test, output _ test), where fobj () is the fitness function; and then substituting the obtained new position into a fitness function fobj () according to the positions obtained by the improved whale optimization algorithm and the simulated annealing algorithm to obtain a fitness value, and then comparing the fitness value with the original fitness value to update the optimal fitness value and the corresponding position of the individual and the population.

The invention takes the average Mean Square Error (MSE) of an evaluation value and a real value obtained by an improved WOA-SVM evaluation model as a fitness function: the fitness function fobj () is as follows:

Function fitness＝fobj(cv,input_train,output_train,input_test,output_test)

% cv is the transverse vector of length 2, i.e. the values of parameters c and v in the SVM

cmd＝['-s3-t2','-c',num2ster(cv(1)),'-g',num2ster(cv(2))]

model ═ svmtrain (output _ train ', input _ train', cmd); % SVM model training [ -, fitness [ - ]]Swmpredict (output _ test ', input _ test', model); the% SVM model evaluation and its accuracy, fitness ═ fitness (2); % is the mean square error MSE as the value of the objective function for the optimization and

wherein x is_tAnd

respectively representing a true value and a situation assessment value, and n represents the number of data samples in the test set.

When the iteration time t is less than or equal to maxgen, the parameters a and r are updated₁、r₂A, C, b, l, p and the value of the adaptive weight coefficient k (t). Wherein r is₁＝rand(),r₂＝rand()b＝1,l＝(a₂-1)*rand+1，a₂＝-1+t*(-1)/maxgen,p＝rand(),

Iterative optimization: when the random probability p is less than 0.5, if | A | ≧ 1, randomly selecting from the current populationWhale population individual position M_randThe whale position of the searched prey is calculated according to the formula (12). If | A | < 1, the spatial position of the current whale group individual is updated according to the formula (10) by a shrink wrap mechanism. And when the random probability p is more than or equal to 0.5, spirally updating the spatial position of the current whale colony individual according to a formula (11), and finally updating the optimal whale position and the global optimal position as well as the fitness value of the updated optimal whale position and the current global optimal position. The random probability p is generated randomly, p ═ rand ().

Step four: and judging whether to accept a new whale position according to the sudden jump probability of the SA algorithm, updating the optimal whale position and the global optimal position, and storing.

Introduction of the SA algorithm: selecting a searcher in the neighborhood of the global optimal fitness value, calculating a difference value df according to a formula (14), and if the difference value df is less than 0, replacing the original position with a new whale position; if the difference df is greater than or equal to 0, the probability exp (-df/T)_t) And judging whether the position of the inferior solution is accepted or not, and then updating and storing the whale optimal position gbest and the global optimal position zbest. The optimal whale position gbest and the global optimal position zbest are the positions of the optimal individual and the optimal population found by combining the adaptive weight improved whale optimization algorithm with the simulated annealing algorithm, and the position obtained in the step three is the position obtained by the adaptive weight improved whale optimization algorithm, which cannot be called as the true optimal position but is only the current optimal position.

And (5) cooling, namely controlling the temperature according to a formula (16).

Step five: and judging whether the iteration termination condition is met, if so, entering the step six, and otherwise, returning to the step two.

And judging whether a loop termination condition is met, namely whether the maximum iteration number is met or the error precision requirement is met, if so, obtaining the optimal individual zbest, assigning the optimal individual zbest to the optimal punishment parameter bestc and the kernel function parameter bestg of the SVM, otherwise, skipping to the step 3, and repeatedly executing the iterative optimization searching process again.

The values of the optimal penalty parameter bestc and the kernel function parameter bestg are represented by bestc ═ zbest (1); bestg ═ zbest (2).

Step six: and assigning the obtained value of the global optimal position to an optimal punishment parameter and a kernel function parameter of the SVM, analyzing the optimal parameter by utilizing regression fitting, combining a training set to carry out SVM network training, inputting sample data in a test set into the trained SVM to obtain an evaluation value, and converting the evaluation value into a network security level.

The optimal population position M obtained by the improved WOA algorithm^*(t) respectively assigning the optimal penalty parameter bestc and the kernel function parameter bestg to the SVM. And substituting the obtained parameters into an SVM model, and carrying out SVM network training by using the optimal parameters of regression fitting analysis to obtain an evaluation value and converting the evaluation value into a corresponding network security level. The regression fitting analysis is the characteristic of the SVM model, is not a separately written regression fitting analysis function, and is realized by embedding the SVM into the fitness function calculation of the improved WOA, then searching the optimal parameters c and g of the SVM by using the global optimization characteristic of the WOA, and using the training model of the SVM in the design of the fitness function, thereby using the characteristic of the regression fitting analysis of the SVM.

The SVM is a new machine learning method proposed in 1995 by Corinna cortex and Vapnik, and is a generalized linear classifier for binary classification of data in a supervised learning manner. Compared with the traditional neural network, the SVM has the advantages of universality, robustness, effectiveness, computational simplicity, theoretical support and the like. However, when the SVM is used for pattern recognition or regression prediction, there is no unified standard for selecting the optimal penalty parameter c and the kernel function parameter g, and currently, a more common optimal parameter selection method includes: by experience, experimental comparison, large-scale search, and the like. In order to improve the accuracy of situation assessment, the invention adopts an improved whale optimization algorithm to search for the optimal parameter combination when selecting the optimal parameters c and g.

Regression fitting analysis is the specific attribute of the SVM model, training samples are input into a support vector machine with a preset regression function for training, and important parameters in the regression function are determined through continuous fitting to obtain an evaluation model. The training set is used for training the support vector machine, the optimal parameters of the SVM are searched, and finally an evaluation model of the support vector machine with good evaluation effect is obtained; the test set is used for substituting the obtained evaluation model for testing and verifying the effectiveness of the evaluation method.

FIG. 3 shows a comparison graph of experimental results of network security situation evaluation based on four algorithms of whale optimization algorithm WOA, adaptive weight improved WOA, simulated annealing algorithm (SA) improved WOA and adaptive weight combined simulated annealing algorithm optimized WOA. As can be seen from FIG. 3, the situation assessment polyline obtained by optimizing the SVM based on the WOA algorithm is the most fluctuating of the four algorithms and is also the most unstable. The situation evaluation value broken lines obtained by the self-adaptive weight improved WOA optimized SVM and the SA improved WOA optimized SVM are similar, and the situation evaluation value broken lines are not similar to the situation evaluation value broken lines, namely the fluctuation situation or the difference value of the situation evaluation value broken lines is similar to the difference value of the true value, so that the algorithm is stable on the whole and is closer to the true value broken lines compared with the algorithm of the non-improved WOA optimized SVM. The situation evaluation value broken line obtained by combining the self-adaptive weight with the SA improved WOA optimized SVM algorithm is more stable on the whole than the situation evaluation value broken lines obtained by the three algorithms, is more consistent with the true value broken line, and has smaller error.

Table 2 shows the situation values of the various algorithms for improving the WOA-SVM for network security situation evaluation and the absolute error between the situation values and the actual situation values. As can be seen from Table 2, compared with situation evaluation values obtained by other optimization algorithms on sample data points in ten test sets and absolute errors between the situation evaluation values and true values, the error of the improved WOA-SVM algorithm based on the combination of the adaptive weight and the simulated annealing algorithm is smaller and is closer to the true values, so that the accuracy of network security situation evaluation based on the improved WOA-SVM algorithm based on the combination of the adaptive weight and the simulated annealing algorithm is higher.

TABLE 2 comparison of estimated absolute errors for several different algorithms

And measuring the difference between the actual value and the situation evaluation value by using three performance indexes of Mean Square Error (MSE), Mean Absolute Percentage Error (MAPE) and Mean Absolute Error (MAE).

MSE index:

MAPE index:

MAE index:

in the above formula, x_tAnd

respectively representing the true value and the situation assessment value, and n represents the number of test data.

Table 3 shows the calculation results of the mean square error, the average absolute percentage error, and the average absolute error between the situation value and the true value obtained by evaluating the network security situation of the WOA-SVM before and after the improvement. From table 3, it can be macroscopically seen that three index values of MSE, MAPE and MAE between the situation value and the true value obtained by the network security situation evaluation algorithm of the WOA-SVM improved based on the adaptive weight combination simulated annealing algorithm are the minimum compared with the index values obtained by the whale algorithm improved by other algorithms, and this also proves that the network security situation evaluation algorithm of the WOA-SVM improved based on the combination optimization algorithm has higher accuracy and effectiveness from the macro angle.

TABLE 3 precision judging and comparing Table

Convergence is a key issue as to whether the algorithm can be implemented. Fig. 4 shows the variation of the optimal individual fitness value in the iterative optimization process of each optimization algorithm. As can be seen from fig. 4, the individual fitness value searched for at the beginning of the WOA-SVM algorithm is relatively large and starts to fall into the local optimum at the 9 th iteration, and the fitness value converges to 0.991601. The optimal fitness value of the adaptive weight-improved WOA-SVM algorithm at the beginning of iteration is relatively large, and the fact that the optimal fitness value falls into local optimization is that the fitness value converges to 0.990664 at the 3 rd iteration. The SA-modified WOA-SVM algorithm initially has a relatively small individual fitness value relative to the fitness value of the adaptive weight-modified WOA-SVM algorithm, but also falls into local optima starting at iteration 3, and at iteration 8, a slight fluctuation is generated, and finally the fitness value of the algorithm converges to 0.990770, which is not much different from the convergence value of the adaptive weight-modified WOA-SVM algorithm. The adaptive weight combining SA improved WOA-SVM algorithm of the invention is the smallest relative to the initial individual optimal fitness value of the three optimization algorithms, changes are generated in the 15 th time, the 19 th time, the 58 th time and the 65 th time, and finally the optimal fitness value of the algorithm is converged to 0.990142.

As the invention takes the mean square error MSE of the safety situation estimated value and the true value as the fitness function, the smaller the individual fitness value is, the higher the description accuracy is. Although the WOA-SVM algorithm converges to the local optimal fitness value at the 9 th iteration, the adaptive weight-improved WOA-SVM algorithm and the SA-improved WOA-SVM algorithm converge to the local optimal fitness value at the 3 rd iteration, it is apparent that the fitness values thereof are not the smallest. In conclusion, the adaptive weight is combined with the simulated annealing algorithm (SA) to improve the WOA-SVM algorithm, so that the individual fitness value smaller than that of other algorithms can be achieved more quickly, and the method has higher accuracy and superiority.

The time complexity of the algorithm is an important index for judging the quality of the algorithm. The whale optimization algorithm designed in the invention has the population size of sizepop, the maximum iteration number of maxgen and the dimension of the problem of dim, so the time complexity of WOA is O (sizepop. maxgen. dim). The use of adaptive weight-optimized WOA-SVM, SA-optimized WOA-SVM and the inventive adaptive weight-combined SA-optimized WOA-SVM are all done within the WOA iteration loop without additional increase of loop times, so their time complexity is O (sizepop maxgen) all. Therefore, the time complexity of the WOA-SVM algorithm before and after the improvement is the same and belongs to the same level. The spatial complexity of an algorithm is a measure of how much memory is temporarily occupied by an algorithm when executed. In the present invention, the scale sizepop and problem dimension dim of the whale optimization algorithm determine its spatial complexity, and since the scale and dimension of all optimization algorithms do not change, all optimization algorithms have the same spatial complexity O (sizepop × dim).

In order to improve the accuracy of network security situation assessment, the invention provides a network security situation assessment method for improving a whale optimization algorithm optimization support vector machine by combining self-adaptive weight with a simulated annealing algorithm, and solves the problems that a punishment parameter c and a kernel function parameter g of an SVM are difficult to select, WOA is easy to fall into a local extreme value and is slow in convergence and the like. According to the method, the self-adaptive weight and the simulated annealing algorithm are introduced into the WOA, the local optimizing capability of the WOA is enhanced by using the self-adaptive weight algorithm, the global optimizing and converging capability of the WOA is improved by using the simulated annealing algorithm, so that the selection of SVM parameters is more accurate, the evaluation result is more fit for the actual situation, and the current network security condition can be more accurately reflected. The comparison experiment result shows that the evaluation result of the improved WOA-SVM algorithm based on the combination of the adaptive weight and the simulated annealing algorithm is more accurate, and the improved WOA-SVM algorithm has better stability and convergence.

The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like that fall within the spirit and principle of the present invention are intended to be included therein.

Claims

1. A network security situation assessment method based on an improved WOA-SVM is characterized by comprising the following steps:

step six: assigning the obtained value of the global optimal position to an optimal punishment parameter and a kernel function parameter of the SVM, analyzing the optimal parameter by utilizing regression fitting, carrying out SVM network training by combining a training set, inputting sample data in a test set into the trained SVM to obtain an evaluation value, and then converting the evaluation value into a network security level;

M(t+1)＝k(t)*M^*(t)-A·D，

M(t+1)＝k(t)*D′·e^blcos(2πl)+M^*(t)，

M(t+1)＝k(t)*M_rand-A|CM_rand(t)-M(t)|，

wherein the adaptive weight coefficient

M^*(t) is the position vector of the optimal solution at the t-th iteration; m (t) is the position vector of whale at the t iteration, and M (t +1) is the position vector of whale at the t +1 iteration; d is the iteration distance between the optimal solution position and the current solution during the t-th iteration; a and C are coefficient vectors, D' ═ M^*(t) -M (t) l represents the ith individual of whaleThe position distance between the current optimal solution and the current optimal solution; b is a constant for defining the shape of the logarithmic spiral, l ∈ [ -1,1]A random number within; m_randIs a randomly selected position vector from the current population;

when the iteration time t is less than or equal to maxgen, updating the parameters

r₁＝rand()、r₂Rand (), A, C, constant b 1, l (a)₂-1) × rand +1, random probability p ═ rand (), and adaptive weight coefficients

maxgen is the maximum number of iterations;

2. The improved WOA-SVM based network security situation assessment method according to claim 1, wherein the sample data takes the number of virus-infected hosts, the total number of tampered websites, the total number of implanted backdoor websites, the number of counterfeit pages of domestic websites and the number of newly-added information security holes as evaluation indexes, and converts five security levels of high risk, medium risk, light risk and security into digital levels, wherein the digital levels are the assessment values obtained by the SVM:

The sample data is normalized and preprocessed as follows:

3. The improved WOA-SVM based network security posture assessment method of claim 1, wherein the coefficient vectors A and C are respectively:

A＝2a·r₁-a，C＝2r₂；

r₁and r₂Is [0, 1]]Random vector of (2).

4. The improved WOA-SVM based network security situation assessment method according to claim 1, wherein the snap-through probability P is_iComprises the following steps:

and df ═ fitness (i) -fitnesszbest;

selecting a searcher in the neighborhood of the global optimal fitness value in the fourth step, calculating a difference value df, and replacing the original position with a new whale position if the difference value df is less than 0; if the difference df is greater than or equal to 0, the probability exp (-df/T)_t) Judging whether the position of the inferior solution is accepted or not; the whale optimal position gbest and the global optimal position zbest are then updated.

5. The improved WOA-SVM based network security posture assessment method of claim 4, wherein the current temperature T_tThe initialization is as follows:

current temperature T_tThe rate of change of (c) is: t is_t+1＝μT_t；

6. The improved WOA-SVM based network security posture assessment method according to claim 1 or 5, wherein the termination condition is whether a maximum number of iterations maxgen is met or an error accuracy requirement is met: mean square error MSE < 0.01.