Application of Bayesian Network and Support Vector Machine in Evaluation and Prediction of Network Security Situation

Figure 1.

Figure 2.

Figure 3.

Figure 4.

Figure 5.

Figure 6.

Figure 7.

Figure 8.

Evaluation Indicators

Sample classification		attack	normal
Real	attack	TP	FN
	normal	FP	TN

Time comparison between DNN and BN on test set

Algorithm	Training time(s)	Test time(s)
DNN	912.365	18.984
BN	654.325	4.957

Time comparison on test sets

Algorithm	Training time(s)	Test time(s)
DNN	3215.332	63.982
BN	1249.547	6.487

BN Sparse Parameters

Parameter	Value	Experimental optimum value
ρ	0.01, 0.02, 0.03, 0.04, 0.05, 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8	Two categories0.6, Five categories0.4
λ	0.01, 0.001, 0.000001, 0.05, 0.0005, 0.000005	Two categories0.000005, Five categories0.001
β	1, 2, 3, 4, 5, 6	Two categories3, Five categories3
epoch	100, 200, 300, 400, 500, 600, 700, 800, 900, 1000, 2000	Two categories1000, Five categories600

Time comparison between DNN and BN on training set

Algorithm	Training time(s)	Test time(s)
DNN	7236.421	98.258
BN	5632.459	23.618

Comparison of operational efficiency under different algorithms

Method	Classification time(s)	Evaluation time(s)	Total time(s)
BN	28.5753	3.2636	31.8339
DNN	117.2427	4.9744	122.2171
SVM	50.5316	4.6532	55.1848
DT	64.6728	4.3367	69.0095

BN Hidden Layer Structure

Number of hidden layers	Two-class network structure	Five-classification network structure
1	[60]	[80]
2	[80,50]	[90,50]
3	[80,50,30]	[90,60,40]
4	[90,70,50,25]	[100,80,50,30]
5	[100,70,45,30,10]	[100,80,60,45,25]

DNN Parameters

Parameter category	Value
Network structure	[122,80,50,2],[122,90,60,40,5]
Activation function	Relu,Sigmoid,Softmax
Optimization function	Adam
Mini-Batch Size	128
Regularization	L2=0.002, Dropout=0.5
Learning rate	0.01
epoch	200,600

Comparison of Indicators

Hidden layer neuron	AC(%)	DR(%)	FAR(%)
[110,90,80]	93.56	93.69	0.256
[90,80,60]	92.13	92.37	0.159
[100,70,40]	95.36	95.21	0.134
[90,65,40]	92.39	92.56	0.201
[90,90,90]	85.36	85.69	0.31

Time comparison on training sets

Algorithm	Training time(s)	Test time(s)
DNN	49567.01	354.983
BN	26451.2	58.145

Comparison of classification results under two categories

Number of hidden layers	DR(%)	Normal	Attack	FAR(%)
1	98.34	98.5	97.15	1.64
2	99.45	99.5	99.11	0.55
3	99.33	99.33	98.76	0.67
4	99.01	99.3	98.71	0.99
5	98.21	99.09	98.01	1.79

BN Parameters

Parameter category	Value
Network structure	[122,100,70,40,122]
ρ	0.6, 0.4
λ	0.000005, 0.001
β	3
Optimization function	Adam
epoch	600, 1000
Learning rate	0.001
Batch Size	500
Activation function	Sigmoid

Benchmarking results of BN indicators under hidden layer

Hidden layer structure	AC(%)	DR(%)	FAR(%)	ttrain(s)
[110,90,80,60,40,20]	99.31	99.28	0.0962	53.69
[105,90,80,60,40]	99.15	98.99	0.108	49.03
[100,80,60,40,20]	98.98	98.86	0.121	44.32
[100,70,50,30]	98.66	98.33	0.135	39.03
[110,70,40,30]	98.55	98.1	0.131	36.26
[90,60,40]	95.74	98.59	0.159	25.19
[80,60,30]	93.68	93.01	0.163	18.98
[90,40]	87.89	87.39	0.305	16.18
[70,30]	88.69	87.69	0.298	13.25
[70]	83.36	82.26	0.361	6.25
[60]	86.59	86.32	0.359	5.45

Comparison of classification results under five categories

Number of hidden layers	DR(%)	Normal	Probe	Dos	U2R	R2L	FAR(%)
1	97.56	98.36	97.15	97.89	24.66	84.58	2.44
2	98.23	98.64	98.01	98.12	25.39	85.66	1.77
3	99.44	99.5	99.09	99.58	36.99	90.12	0.56
4	99.36	99.36	98.22	99.65	24.55	87.69	0.64
5	98.89	98.89	99.01	98.75	23.68	86.99	1.11

Situation Assessment Values and Grade Division of 10 Groups of Data

Sample number	Actual value	Evaluation value	Situation grade	Operational status
1	0.19	0.18	Safety	Basically normal
2	0.33	0.35	Low risk	Mild influence
3	0.39	0.4	Low risk	Mild influence
4	0.66	0.63	High risk	Major damage
5	0.05	0.06	Safety	Basically normal
6	0.52	0.52	Moderate risk	Medium threat
7	0.19	0.19	Low risk	Mild influence
8	0.36	0.37	Low risk	Mild influence
9	0.59	0.55	Moderate risk	Medium threat
10	0.18	0.15	Safety	Basically normal