陈锴

摘  要： 为了满足大规模网络安全监控需要，设计基于多源异构传感器的网络安全态势感知系统，系统由信息采集层、多源数据融合层和态势感知层构成。其中信息采集层通过日志传感器对网络中主机和设备日志信息实施收集、预处理分析，SNMP传感器以SNMP协议流程为依据，对可控设备MIB库中网络交换设备和终端设备等数据进行采集、分析。多源数据融合层利用基于逐步回归分析的多源检测数据融合方法，融合信息采集层中的多源异构传感器所采集数据。态势感知层依据融合数据通过安全态势评估和安全态势预测，感知网络安全态势。实验结果表明，该系统的网络安全态势感知符合程度好，对网絡攻击性能的检测率高，可高程度约简原始报警，大大降低管理员负担。

关键词： 网络安全; 态势感知; 系统设计; 多源异构传感器; 信息获取; 多源数据融合

中图分类号： TN915.08?34; TP391.9              文献标识码： A                     文章编号： 1004?373X（2020）20?0074?05

Design of network security situation awareness system based on multi?source heterogeneous sensors

CHEN Kai

（Zhejiang University of Finance & Economics， Hangzhou 310018， China）

Abstract： A network security situation awareness system based on multi?source heterogeneous sensors is designed to meet the needs of large?scale network security monitoring. The system is composed of the information collection layer， multi?source data fusion layer and situation awareness layer. The information collection layer is used to implement collection and preprocessing analysis of the log information of the host and equipment in the network by means of the log sensor， and the SNMP sensor based on SNMP protocol flow is utilized to collect and analyze the data of the network exchange equipment and terminal equipment in the MIB （management information base） of the controllable equipments. The multi?source data fusion layer is used to fuse the data collected by multi?source heterogeneous sensors in the information collection layer by means of the multi?source detection data fusion method based on stepwise regression analysis. The situation awareness layer is used to perceive the network security situation by security situation assessment and security situation prediction according to the fused data. The experiment results show that the network security situation awareness of the system conforms well to the true situation， its detection rate of network attack performance is high， and the system can reduce the original alert to a high degree， which greatly reduces the burden on administrators.

Keywords： network security; situation awareness; system design; multi?source heterogeneous sensor; information acquisition; multi?source data fusion

0  引  言

网络在当今社会发挥着很大作用，不仅在社会生活中发挥着极大的作用，在政治、经济、军事以及其他领域的应用也十分广泛[1]。随着网络应用向各个领域大规模、高度分布式速度发展，网络安全也存在着越来越多的隐患，对网络的入侵攻击以及破坏性逐渐增强[2]。

传感器可以感知被测量的信息以及感知信息的输出，通过固有规则将其变换成电信号或一些其他模式输出，以此实现信息的输出传递、处理以及存储等，所以传感器属于检测装置[3]。……