论文部分内容阅读
The paper introduces the Endsley’s situation model into network security to describe the network security situation,and improves Endsley’S data processing to suit network alerts.The proposet model contains the information of incident frequency.incident time and incident space.The HoneyNet dataset is selected to evaluate the proposed model in the evaluation.The paper pmposes three definitions to depict and predigest the whole situation extraction in detail.and a fusion component to reduce the influence of alert redundancy on the total security situation.The less complex extraction makes the situation analysismore efficient,and the fine-grained model makes the analysis have a better expansibility.Finally,the situational variation curves are simulated,and the evaluation results prove the situation model applicable and efficient.