A Novel Approach to Network Security Situation Assessment Based on Attack Confidence

As an active topic in the research field, network security situation assessment can reflect the security situation from a global perspective. However, existing assessment approaches rely on detection threshold to make decisions, leading to massive false positives and false negatives. This paper proposes a confidence-based network security situation assessment approach that preserves the probability information in attack detection. We use the ensemble learning algorithm and D-S evidence theory to obtain the attack confidence, and calculate the network security situation value through the situation elements fusion. Experiment results demonstrate that this approach is effective and accurate.