Abstract:

Network Security Situation Awareness （NSSA） can estimate the status of network comprehensively and find potential risks， and the key of it is accurate and comprehensive analysis of user behaviors. Building a behavioral portrait can reflect the important features of users， helping managers grasp the security status of network and respond accordingly. However， the mainstream behavioral portrait construction methods have shortcomings such as insufficient extraction of key information in portraits and ignoring the correlation among features. Therefore， an NSSA mechanism based on behavioral portrait construction was designed. In this mechanism， data mining was used to obtain statistical feature labels， Bi-directional Long Short-Term Memory （BiLSTM） neural network was used to generate behavior feature labels of user behaviors， and the statistical feature labels and behavioral feature labels of user behaviors were combined to construct behavioral portrait. After constructing behavioral portrait， the similarity between the user behavior sequence label features and the known behavioral portrait labels was calculated by a cross entropy loss function to determine the user’s threat level based on the threat level of the behavioral portrait. Experimental results on UNSW-NB15 dataset show that the proposed method achieves the precision of 89.78%， which is improved by 2.01 to 10.73 percentage points compared with those of the machine learning methods such as K-Medoids and the Principal Component Analysis （PCA） -Convolutional Neural Network （CNN）. It can be seen that the proposed portrait construction method is more sensitive to the correlation among behaviors， can model behavior feature labels for different portraits specifically， improves classification accuracy of threat levels， and realizes NSSA.

Key words: behavioral portrait, Bi-directional Long Short-Term Memory (BiLSTM), neural network, Network Security Situation Awareness (NSSA), behavioral modeling, AutoEncoder (AE)

摘要：

网络安全态势感知（NSSA）可全面评估网络状态并发现潜在风险，其关键是对网络用户的行为准确、全面地进行分析。构建行为画像能反映出用户的关键特征，有助于管理人员掌握网络的安全状况并有针对性地予以响应。然而，主流的行为画像构建方法对画像的关键信息提取能力不足且忽略了特征之间的关联性。因此，设计了一种基于构建行为画像的NSSA机制。该机制通过数据挖掘获取统计特征标签，利用双向长短期记忆（BiLSTM）神经网络对用户行为的建模能力形成行为特征标签，并综合用户行为的统计特征标签和行为特征标签共同构建行为画像。画像构建完成后，通过交叉熵损失函数计算用户行为序列标签特征与已知行为画像标签之间的相似度，进而根据行为画像的威胁等级确定用户的威胁等级。在UNSW-NB15数据集上进行的实验结果表明，所提方法对行为分类的精确率达到89.78%，与K-Medoids和主成分分析（PCA）-卷积神经网络（CNN）等机器学习方法相比提升了2.01~10.73个百分点。可见，所提画像构建方法对行为间关联更敏感，能特异性地建模不同画像的行为特征标签，提升威胁等级的分类精度，并实现网络安全态势感知。

关键词: 行为画像, 双向长短期记忆, 神经网络, 网络安全态势感知, 行为建模, 自动编码器