Keywords

1 Introduction

Cyberspace has become the fifth national security domain outside the sea, land, air, and sky. Cyberspace security has become an important part of national security. However, with the rapid development of the scale of cyberspace, the problem of network security is becoming increasingly serious. Globally, there have been many serious cybersecurity incidents in recent years. such as the extortion outbreak in May 2017, “WannaCry”, by encrypting data information in the system, make originally the data is not available, the opportunity to extort money a lot, “WannaCry” virus spread across nearly 150 countries and regions, including education, transportation, medical, energy networks, many industries are major attack by the virus. In April 2020, EDP, a Portuguese multinational energy company, was attacked by ransomware. After being attacked, the attacker claimed to have obtained 10TB of EDP’s sensitive data files and finally extorted a ransom of 1,580 bitcoins (equivalent to about 9.9 million euros).

For common vicious network security incidents, most network administrators are hindsight, that is, the event caused a certain impact was noticed, therefore, how to do active monitoring and active defense before the threat comes, try to avoid or reduce the occurrence of network security incidents, network security managers are very urgent needs [1]. In this paper, the origin and definition of network security situational awareness are summarized, and the technical methods of functional modules are introduced, analyzed, and compared. The research trend of network security situational awareness in the next few years and the challenges that researchers may face are proposed.

2 Definition and Development of Network Security Situational Awareness

In 1988, Endsley [2] proposed the concept of situational awareness for the first time at the International Human Factor Annual Conference, that is, “to recognize and understand environmental factors within a certain time and space, and to predict the future development trend”.

Endsley’s definition of situational awareness [3] has been widely accepted and applied to a variety of functional areas. He understands situational awareness as a state of knowledge and distinguishes it from the process used to achieve such a state by dividing it into three levels: situational element extraction, situational understanding, and situational prediction, as shown in Fig. 1.

Fig. 1.
figure 1

Endsley situational awareness model.

Full size image

First is the situation factor extraction, the main work of this level is to obtain the necessary data; the second level, situational understanding, is to analyze the data obtained from the first level. Finally, the situation prediction is made [4]. The data analysis results obtained at the second level are used to predict the situation in the short term in the future. This is also the earliest situational awareness model, which is the foundation of the network security situational awareness model.

A more classic situational awareness model is the data fusion model given by THE U.S. military JDL (Joint Directors of Laboratories), also known as the JDL model [5]. In this model, situational awareness is divided into five stages. In this model, situational awareness is divided into five stages. Followed by data preprocessing, event extraction, situation assessment, impact assessment, resource management, process control, and optimization. The main task is to monitor and evaluate the entire data fusion process in real-time, and integrate information at various levels to optimize related resources [6].

In 1999, the United States air force communications and information center Tim Bass, put forward the network space situational awareness (cyberspace situational awareness, CSA) concept [7], for the first time the concept of situational awareness is academia fusion in the field of network space safety, can effectively improve the cognition of managers to protect the network aims to shorten the time of the network security management decisions and provide the corresponding decision.

The situational awareness in the network applications mainly revolves around safety, Tim Bass in 2000 intrusion detection framework based on multisensory (see Fig. 2) [8]. The model is the prototype of network security situational awareness, reasoning framework consists of intrusion detection, intruder identity recognition, intrusion behavior, situation assessment, and threat assessment, etc.

Fig. 2.
figure 2

Intrusion detection data fusion model.

Full size image

In 2006, Wang Hui Qiang [9] discussed the concept of cybersecurity situational awareness, thinking that it refers to “in a large-scale network environment, acquiring, understanding, displaying, and predicting future development trends of security elements that can cause changes in the network situation”, this definition is a Chinese translation defined by Endsley.

In 2007, Lai Ji Bao, Wang Hui Qiang et al. [10] proposed a network security situational awareness model based on Netflow. Using Netflow technology can well realize network security situation awareness, discover potential threats and vulnerabilities promptly, and present them to decision-makers in a visual manner, to achieve the purpose of comprehensive monitoring of the entire network. At the same time, because the system is dealing with massive amounts of data and information, performance optimization issues need to be further studied.

In 2009, Wei Yong et al. [11] proposed a network security situational awareness model based on information fusion. Introduce the improved DS evidence theory to fuse information from multiple data sources, and then use vulnerability information and service information to calculate the network security situation through situation element fusion and node situation fusion, and perform time-series analysis to achieve a quantitative analysis of the network security situation and trend forecasting.

In 2011, Jia Yan et al. [12] proposed a security situational awareness model for large-scale networks because of the characteristics of massive, multi-mode, and multi-granularity data in large-scale networks.

In 2014, Franke U [13] regarded network situational awareness as a subset of situational awareness, that is to say, network situational awareness is a part of situational awareness, which refers to the “network” environment. But that definition is a bit too vague and doesn’t specify whether it’s situational awareness for security.

In 2017, Gong Jian [14] put forward the network security situational awareness is the cognitive process of the network system security status, including from the system to measure the raw data fusion processing step by step and the background of the implementation of the system state and activity of semantic extraction, identify the existence of all kinds of network activity and the intention of abnormal activity, thus obtained according to the characterization of the network security situation and the trend of network system impacts normal behavior.

In 2019, Jia Yan and others [15] proposed the definition of network security situation awareness as the detection, extraction, understanding, evaluation, and future prediction of security elements that affect the network situation in a large-scale network environment.

With the improvement of application security requirements and technical difficulties, in recent years, academic research on network security situational awareness has become more and more common and in-depth. However, at present, a unified and comprehensive definition of network security situational awareness has not yet been formed, and most of them are correct. A detailed explanation of Endsley’s definition of situational awareness. In this article, network security situation awareness is defined as the extraction of the characteristic elements that affect the network security situation in a complex network environment, and the necessary fusion and classification of the extracted characteristic elements, and then the use of technical methods for evaluation and analysis, and finally a series of complex processes for predicting the network security situation in the future based on the evaluation results.

3 Key Technologies of Network Security Situational Awareness

Although there are still some problems in the division of several stages of network security situational awareness by different researchers and the understanding of the relationship between different stages, most researchers divide network security situational awareness into three functional modules of situation element extraction, situation assessment, and situation prediction. This chapter introduces the key technologies of network security situational awareness in turn according to the classification of functional modules.

3.1 Key Technologies of Network Security Situation Feature Elements Extraction

Network security posture characteristic element extraction in the underlying network security situational awareness, is the foundation of network security situational awareness and security features elements mainly include static configuration of network information and dynamic information and include the information of network topology, the former vulnerability information, and status information, etc., the latter refers to the various protective measures of log collection and analysis techniques for the threat of information, etc.

When the researchers collected information, the foreign researchers mostly from a single factor analysis, specific elements of the corresponding specific data information to assess the security situation of specific, such as Jajodia [16] and Wang [17] and others study is only gathering network vulnerability information, evaluation by collecting the information of the network vulnerability, Ning [18, 19] only gathering network alarm information, analyze the status of the alarm information to evaluate the network threat; Barford [20] et al. used the data and information about the attack collected by Honeynet to evaluate the attack situation of the network. The common point of these studies is that they all collect, analyze and study a specific network element, and only obtain single situation information, which cannot obtain comprehensive information and then analyze the overall situation, and cannot adapt to the complex and changeable network environment.

Domestic researchers, on the other hand, from multi-source data information acquisition, starting from multiple layers, multiple Angle comprehensive assessment of network security situation, such as Wang Juan [21] is put forward based on the index system of network security situational awareness, extraction of multi-source information security data, according to the requirements of hierarchy, information source and the difference between structures, the layered index model, the extracted 25 candidate index, the index information assessment of network security situation; Wang et al. [22] proposed a botnet detection technology based on information fusion to effectively integrate the complex network security information of different sensors in time and space dimensions to improve the perception ability of botnet attacks. There is a lot of research is geared to the needs of the extraction of multi-source heterogeneous information network security work [23,24,25,26], Chang Yiheng and others proposed a security situation element extraction meth-od based on probabilistic neural network, which solved the problem of low efficiency and low accuracy of situation element extraction in a complex network environment. Multisource and redundant data interference for safety information [27]. Duan Yongcheng proposed a network security situation factor extraction method based on information gain random forest, which greatly improves the accuracy of situation factor extraction [28]. These studies use different technologies to collect and collate multi-source security data.

In conclusion, the foreign researchers mostly focus on the single factor extraction and analysis of the domestic researchers tend to the extraction of multi-source elements, because the characteristic of the network security situational awareness is a fusion of a variety of network information to consider the overall situation of network security, therefore, the elements of a multi-source extraction are inevitable, but the multi-source data and information not only reduces the extraction efficiency, desultorily data also brings to the information fusion and redundant processing difficulty, at present the optimization of the extraction method has a lot of space.

3.2 Key Technologies for Network Security Situation Assessment

Network security situation assessment is the core part of network security situation perception. Based on the fusion of all kinds of security equipment data and according to the needs of network security assessment, an assessment value of the current network security situation is obtained through formal reasoning calculation with the help of some mathematical model. In short, network security situation assessment is a mapping from situation factor to situation result value [29]. The network security situation assessment methods can be divided into three categories: mathematical model-based, knowledge-based reasoning, and pattern recognition.

Situation assessment method based on the mathematical model is the most common and most common method of analytic hierarchy process, the domestic has the value of the discloser is Chen Xiu Zhen and others [30] in 2006 put forward the hierarchical network system security threat situation of the quantitative evaluation model, this model can be divided into network system from top to bottom, host, service, and attack/holes 4 levels, as shown in Fig. 3, taking the evaluation of overall “after” top-down, local first strategy, and the model is based on IDS mass alarm information and network performance indicators, and the importance of the service, the host itself and the organizational structure of the network system combining.

Fig. 3.
figure 3

Hierarchical network system security threat situation quantitative assessment model.

Full size image

The model exists some deficiencies: only IDS alert information in its assessment method a safe source of information in the actual network system deployment, such as firewall, system log safety factors are indispensable, if not the information included in the calculation, it loses the network security situation assessment technology can comprehensively reflect the advantage of the network security situation. Therefore, in 2009, 2010, and 2012 respectively, Lai Ji Bao [31], Zhang Yong [32], and Meng Jin [33] all improved the above hierarchical model, making the effect of more sources of hierarchical evaluation more accurate. In 2015, Jia et al. [34] proposed a layered framework for network security situation assessment. The framework can reflect the security status of information systems, but the disadvantage is that the framework is suitable for offline analysis, but it is not well suited for real-time analysis.

The main characteristic of the knowledge-based inference method is to rely on expert knowledge and experience in the process of constructing an evaluation model and then analyze network security situations through logical reasoning. More common are fuzzy logic reasoning, Bayesian reasoning, evidence theory, and so on.

Xie et al. [35] used a Bayesian network to model the uncertain factors in the network, calculate the probability of a successful attack, and evaluate the severity of the attack in real-time. Aguilar et al. [36] is a combination of fuzzy logic and neural network technology, base on the cognitive map presents the FCM (fuzzy cognitive map, the fuzzy cognitive map), the concept of using it to get important assets in a network dependence of damage assessment, fuzzy reasoning too difficult, however, and the figure of storage cost is big, not suitable for large, complex network environment. Boyer et al. [37] designed a situation assessment framework based on DS evidence theory to quantify network security situation. Li et al. [38] introduced a Bayesian network-based evidence network to carry out network security situation assessment, and the main idea is to carry out a similar reasoning assessment under the framework of evidence theory and with the full probability formula of Bayesian network as a reference. Yang Hao et al. [39] obtained the network vulnerability situation value by integrating vulnerability data and alarm data through DS evidence theory. The network security situation assessment method based on knowledge reasoning has a certain artificial intelligence, but the difficulty of obtaining inference rules and prior knowledge is the bottleneck of this method. Although the advantage of the evidence theory is that the required prior data is easy to obtain and can integrate different expert knowledge and data source information, it is also undesirable to have too high computational complexity when evidence conflicts.

The pattern recognition method establishes a situation template through machine learning and divides situations through pattern matching and mapping. More advanced than knowledge reasoning, it does not rely too much on expert knowledge and experience. The main methods include the grey correlation method, rough set theory, and cluster analysis method. Many researchers [40,41,42,43,44,45] have adopted grey correlation analysis, rough set theory, and cluster analysis to carry out network security situation assessment and achieved good results. The evaluation method of pattern recognition has the advantages of high efficiency, large processing capacity, and not relying too much on expert knowledge. The disadvantage is that the stage of pattern extraction is difficult to face more complex features, thus affecting the evaluation efficiency.

3.3 Key Technologies for Network Security Situation Prediction

The ultimate purpose of an evaluation is to predict and use historical data information to provide a management basis for future network security, which is the transformation from passive to active network security management. Network security situation prediction is the highest level of the whole situation perception and plays an important role in the defense of network security [46]. At present, research on network security situation prediction methods can be roughly divided into three categories: machine learning, Markov model [47], and gray theory.

Thanks to the improvement of hardware computing speed, machine learning methods based on neural networks and deep learning have developed rapidly in recent years. In the field of network security situational awareness, the automatic perception and self-learning mechanism of machines can be established to fit the thinking ability and analysis, and judgment ability of experts, to predict complex network security events more flexibly [48]. Lin et al. proposed a network security situation prediction based on BP neural network, and Tang [49] proposed a network security situation prediction method based on dynamic covariance BP neural network. The disadvantage of the BP neural network is its slow convergence speed, ease to fall into the local optimal solution, and ease to oscillate in the learning process. In addition to BP neural network, Zhang et al. [50] established a parametric optimized wavelet neural network security situation prediction model by using an improved niche genetic algorithm to improve the prediction accuracy of the network security situation. Feng et al. [51] proposed a network security situation prediction method based on cyclic neural networks. Ren Wei et al. [52, 53] proposed a situation prediction method based on RBF neural network by taking advantage of the characteristics of network security situation values with nonlinear time series and the advantages of neural network in dealing with chaotic and nonlinear data. Compared with the neural network, support vector machine (SVM) has a faster convergence speed, Hu, et al. [54] proposed a model of network security situation prediction based on graphs and SVM, and put forward by Lu and others [55] network security situation prediction based on support vector machine (SVM), is to use different methods to determine the optimal parameters of support vector machine (SVM), improve the prediction precision and shorten the training time.

Wang et al. [56] proposed a network security situation prediction method based on a fuzzy Markov chain and established a unified information base based on multi-source log data mining technology. Wen Zhi Cheng [57] proposed a prediction method based on the hidden Markov model. Liang et al. [58] proposed an algorithm based on weighted HMM to predict the security of mobile networks.

Lai Ji Bao [59] proposed network security situation prediction based on simple weighting and gray theory and established a prediction model based on gray theory. Zhang et al. [60] also carried out network security situation prediction by moving the grey correlation model and grey prediction algorithm. Deng Yong Jie et al. [61] proposed to combine neural networks with gray theory to predict network security situation, which also obtained good results.

Each forecasting technique has its advantages and limitations. Machine learning has excellent self-learning and adaptive capabilities, which can provide high convergence speed and strong fault tolerance. However, sufficient training data is needed to obtain parameters, and it is difficult to build neurons with self-learning and adaptive capabilities. For the Markov model, although it can perform various time-series predictions, it still needs a set of training data. In addition, it is almost impossible to recognize all possible states and their transitions, especially in complex networks. Grey theory can provide a small sample of data in the short-term prediction, thus providing better prediction without any training.

4 Summary and Prospect

According to the above analysis and summary, network security situational awareness started late, and many technologies are still immature and need to be further optimized and strengthened. The following is a discussion of the development trend of network security situational awareness:

First, big data analysis and processing technology. The extraction and preprocessing of network security situation elements are the most basic part of network security situation perception. The reality is that the network environment is becoming more and more complex, and the data types and formats are growing exponentially. The massive security information cannot be directly used as the analysis object of network security situation perception. Therefore, the application of big data analysis and processing technology in the extraction of network security situation elements will be the most important research in the future.

Second, the deep integration of artificial intelligence technology and network security situational awareness. The fourth part of the article introduces in detail the key technology of network security situational awareness of each function module, it is not hard to see, artificial intelligence, machine learning, researchers have become important methods in the aspect of network security situational awareness, but there are obvious flaws, artificial intelligence technology is in the rapid development phase, a new generation of artificial intelligence technology with the depth of the situational awareness can bring new vitality for the field, to solve the problems of the situation awareness at all levels to provide new methods and inspiration.

Thirdly, the visualization research of network security situational awareness. The ultimate goal of scientific research is applied. The application of cybersecurity situational awareness cannot only have some data. It needs a more direct way to express the deeper meaning of these data. Therefore, visualization is an indispensable part. However, in the process of reading related documents, it is found that there are little researches on visualization, so the visualization of network security situational awareness is also an important direction for future research.

Fourth, new problems arising from the expansion of the application scope. With the rapid development of big data and 5G, industrial control network is deeply integrated with the Internet. The new network pattern will inevitably bring new network security problems, and the application of network security situational awareness in complex network scenes will also be the focus of future research.

To summarize, network security situational awareness of research in the phase of development, there are a lot of not forming the theory of issues that need to be perfect, there are many key technologies that need to optimize modified, a new pattern of the network brings new security issues, new application scenario requires new methods of technology, network security situational awareness will exert its advantages to provide security for network security, national security escort.