Application of Bayesian Network and Support Vector Machine in Evaluation and Prediction of Network Security Situation

Response module, analysis engine and data source are three basic components of intrusion detection system. According to the detected data sources, intrusion detection systems can be divided into three categories. The first type of data is usually the event log of the monitored system, which is highly dependent, poor in real-time and portability. Not applicable to Web-based protocols. The last type is often configured as distributed mode. Its detection target is a variety of data sources, and the detected data is rich. The first two methods take the essence and discard the dross, which overcomes the defect of single structure, but the difficulty and overhead of network management are relatively large.

Data mining is a technology of analyzing each data from a large number of data and finding its rules, the conversion rules mainly including the data preparation stage are very different, and there are about three differences. Object data mining is a domain technology with strong operability. Data mining discovers hidden clues through the appearance of events, thus discovering the potential laws and connections between seemingly unrelated things, thus realizing the prediction of the future.

Like situational awareness, the concept of data fusion was first put forward for military application. It began in the early 1970s, and this technology has made real progress and development in 1980s.

Data fusion technology has developed rapidly in recent decades. Researchers at home and abroad are doing research on this technology, and a large number of research results can be seen in various academic conferences and journals. However, the research on this technology in China was mainly around 1980s. Fusion technology is to comprehensively analyze the received data. Data processing according to specific standards. Data fusion technology realizes the fast and effective processing of multi-channel information in modern battlefield. It analyzes and synthesizes multi-source data and provides services for specific task decision-making.

Under the increasingly complex network environment, if we can predict the future security situation and changing trend of the network, we can provide guidance for network managers to choose the correct treatment scheme, which can enhance the initiative of network defense and reduce the risk as much as possible.

Situation prediction is based on collecting, transforming and processing historical and current situation data sequences, By establishing a mathematical model to find the development law and change of situation data, and then similarly reasoning the future development trend, forming scientific judgment, prediction and estimation, thus making qualitative or quantitative description and issuing early warning, so that managers can get accurate planning and decision-making. The specific implementation process is as follows: firstly, we use technical methods to process and transform the obtained historical situation data sequence, then use mathematical models to discover and identify the relationship between security situation data sequences, establish equation relations including time variables and situation variables, and finally get the situation changing with time.

In statistical learning, VC dimension is an index to measure the ability of classification function set, indicating that the function set can correctly classify the maximum N value of any data set containing 2N samples, reflecting the generalization ability of the model. Generalization ability is the key to evaluating the advantages and disadvantages of the algorithm. The stronger the algorithm, the better the performance of the model on unseen data. Its quantitative definition is shown in equations (1) and (2). (1)R(α)≤Remp(α)+ψ(Nh) (2)ψ(Nh)=h(ln(2Nh))−ln(η4)N

Where ψ(Nh) is called the confidence range, h refers to the VC dimension, and N represents the number of samples.

Optimizing super-layers can reduce the structural risk of support vector machines.Given a hyperplane w^Tx + b = 0. If the hyperplane can satisfy formula (3): (3)y={ 1,wTx+b≥1 −1,wTx+b≤−1

Let the interval between hyperplanes w^Tx + b = 1 and w^Tx + b = −1 be Δ. Then the hyperplane is a Δ-interval classification hyperplane. The calculation formula is as follows: (4)h≤min([R2Δ2,n])+1

The key dimensions of the data are extracted and screened according to the radius spherical surface during collection. The results show that the VC dimension decreases with the increase of classification interval, and increasing the interval can enhance the generalization of the model. Figure 1 shows that the interval Δ is expanded to improve the separability of samples, and even samples with unknown labels can be accurately classified.

Figure 1.

Linear plane optimal equation diagram

The analysis in Figure 1 shows that the surface hyperplanes generated by the three classifications are l1, l2 and l, respectively, where l is between l1 and l2, and the expression of hyperplane l is given by equations (5) and (6). (5)l1:wTx+b=1 (6)l2:wTx+b=−1

The classification plane level of the intermediate region is w^Tx + b = 0.

Let x_i and x_j be any point on l₁ and l₂, then the distance Δ between l₁ and l₂ is the projection of interval line segment x_ix_j to rule vector w facing different objects. Equation (7). (7)d=wT(xi−xj)/‖w‖

Equations (5) and (6) are combined to obtain Equation (8). (8)d=2‖w‖

The risk in discrimination decreases with confidence, as shown in equation (9): (9)maxw,b2‖w‖ wTxi+b≥1,yi=1 s.t.wTxi+b≥−1,yi=−1

The objective problem is transformed into a convex form, and equation (10) shows: (10)maxw,b‖w‖22 s.t. yi(wTxi+b)≥1

Citing the dual multiplier A to obtain the Lagrange function, equation (11) shows: (11)L(w,b,α)=12‖w‖2+∑i=1Nαi(1−yi(wTxi+b))

Calculate the partial derivatives of w and b as follows: (12)∂L∂w=w−∑i=1Nαiyixi=0 (13)∂L∂b=∑i=1Nαiyi=0

Calculate the dual problem of the original equation, as shown in equation (14): (14)maxα(∑i=1Nαi−12∑i,j=1Nαiαjyiyjxixj) s.t. ∑i=1Nαiyi=0 αi≥0

Assuming α^* optimal dual solution of the normal vector of the decision equation is w=∑i=1Nαi*yixi , the offset is b*=yj−wTxjj∈{j|0<αj*} , the result of the decision function is f(x)=sgn(wT*x+b*) .

Under the nonlinear modulation of hierarchical change, it is transformed into the dual equation of the objective equation. The purpose is to extend the relationship between samples to the problem of linear classification construction. When linear indivisibility occurs, it is necessary to distribute samples on both sides of the correct interval, so as to reduce the risk.

ξ can be introduced, which indicates the degree to which the training sample can be tolerated by “error” partition. The constraint condition becomes yi(wTxi+b)≥1−ξ , and the sum of the degrees of “error” division is ∑i=1Nξi . The support vector equations that guarantee maximum gaps and small mismatches are as follows: (15)minw,b‖w‖22+C∑i=1Nξis.t. yi(wTxi+b)≥1ξ≥0,i=1,…,N

C is the penalty coefficient. The calculation formula of introducing multipliers into Lagrange equation is: (16)L(w,b,α,β)=12‖w‖2+∑i=1Nαi(1−yi(wTxi+b))+C∑i=1Nξi−∑i=1Nβiξi

Formulas (17) (18) (19) can be obtained by calculating partial derivatives of w, b and ξ_i. (17)∂L∂w=w−∑i=1Nαiyixi=0 (18)∂L∂b=∑i=1Nαiyi=0 (19)∂L∂ξi=C−αi−βi=0

Substituting equations 17-19 into equation 16 gives the solution of the dual equation, as follows: (20)maxα(∑i=1Nαi−12∑i,j=1Nαiαjyiyjxixj) ∑i=1Nαiyi=0 s.t. 0≤αi≤C

Most data are nonlinear, and traditional machine learning often transforms nonlinear data into linear problems by mapping them to high dimensions. However, this method is easy to cause dimension disaster and increase computational complexity. The kernel function is a mapping tool conforming to equation (21). (21)K(x,z)=<ϕ(x),ϕ(z)>

Where ϕ represents a mapping from X to Hilbert space F.

The original objective equation is transformed into a high-dimensional space size map as equation (22): (22)minw,b‖w‖22+C∑i=1Nξi yi(wTϕ(xi)+b)≥1 s.t. ξi≥0,i=1,…,N

In the process of analyzing the target equation, the dimension of analysis ϕ(xi) is further referred to and the data width is changed by operation, the amount of calculation is surging and it is difficult to solve. Therefore, the original equation is modeled and processed first, and then the control even form is transformed, as in Equation (23): (23)F=maxα,β,γ12∑i=1N∑j=1NyiyjαiαjK(xi,xj) +12∑s=1u∑t=1u(βs−γs)(βt−γt)K(xs*,xt*) +∑i=1N∑s=1uαiyi(βs−γs)K(xi*,xs*) −∑i=1Nyiαi+∑s=1uβs−∑s=1uγs ∑i=1Nyiαi+∑s=1uβs+∑s=1uγs=0 0≤αi≤C1,i=1,…,N s.t.0≤βs,γs≤C2,s=1,…,u

Where K(xi,xj)=<ϕ(xi),ϕ(xj)> . Let α^* be Solving the dual decision equation is f(x)=sgn(α*yiK(xi,x+b*)) .

In the constructed environment, a DNN network and BN algorithm are used for experimental analysis. The purpose of the experiment is to study the efficiency of the improved algorithm and analyze the efficiency of BN model, so as to analyze the accuracy and time performance of situation assessment.

a. Softmax score is added to the output layer, and the number of hidden layers and neurons is determined by comparing the scores.

According to Table 2, with the increase of hidden layers, the higher the classification accuracy, but the more time it takes. In the big data environment, the training time will explode, so too many hidden layers are not feasible. When the number of hidden layers is 6, the accuracy and detection rate are the highest, the false alarm rate is the lowest, and the classification effect is better. However, the training time is 53.69 s, which is more than twice as long as that when the number of hidden layers is 3.

If the number of hidden layers is the same, set different numbers of neurons for comparison and classification, as shown in Table 3.

According to Table 3, when the number of neurons is set to [100,70,40] , the accuracy rate and detection rate are 95.36% and 95.21%, respectively, and the false alarm rate is the smallest.

b. Influence of hyper-parameters on performance

Through the previous analysis of BN algorithm, when extracting features, appropriate super-parameters are beneficial to extract low-dimensional features, thus affecting the classification accuracy and model training time.Use the training model to select the best parameters.

According to Table 4, through experiments, the optimal values of hyper-parameters in two-class and five-class cases are determined.

c. Selection of BN Parameters

For the selection of hidden layers, 1-5 layers are selected in turn for experiments, and the structure of hidden layers is shown in Table 5.

When the number of hidden layers is different, the detection rates and false alarm rates of Class 5 and Class 2 are shown in Tables 6 and 7, respectively:

Table 6 shows that the total detection rate is best with 3 hidden layers. With the increase to 4 layers, the DoS detection rate increased, but the U2R and R2L detection rates decreased, and more layers resulted in a decrease in both the overall detection rate and other types of detection rates.

According to Table 7, when the number of hidden layers is 2, the total detection rate is the highest, the detection rate of normal type and attack type is also the highest, and the false alarm rate is the lowest. Therefore, in the case of two classifications, the number of hidden layers is set to 2.

d. Selection of Final Parameters of BN Algorithm

After many experiments, BN and DNN network parameters are set as shown in Table 8 and Table 9.

a. Influence of low-dimensional features on binary classification model

After determining the parameters, we continue to analyze the influence of data on classification. Compare the performance of BN-based algorithm and single DNN under training set and test set respectively, as shown in Figure 2.

Figure 2.

Comparison of two classification performances

As shown in Figure 2, compared with the DNN network, although the BN algorithm achieves a 0.125% accuracy improvement on the training set, the increase is small, which may imply that there is an overfitting phenomenon in the training process. However, on the test set, the performance of the BN algorithm is significantly better than that of the DNN network, and the accuracy rate is greatly improved by 4.09%. This result strongly proves the advantages of the BN algorithm in extracting effective features of the intrusion data set, thus effectively improving the classification accuracy.

The comparison on the test set is shown in Table 11.

According to Table 10 and Table 11, compared with DNN network, the training time and test time of BN algorithm on training set are reduced by 22.17% and 75.96% respectively, and the training time and test time on test set are reduced by 28.28% and 73.89% respectively. Experiments show that SAE algorithm can reduce the training and testing time of DNN network, which is very important to measure the efficiency of network security situation assessment.

b. Influence of low-dimensional features on five-classification model

In order to verify the superiority of BN algorithm, similar to the experimental process of binary classification, the performance of BN algorithm and DNN algorithm are compared.

According to Figure 3, in five classifications, all performance indexes of BN algorithm are better than DNN network on the test set, and the accuracy rate is improved by 4.42%.

Figure 3.

Comparison of five classifications performance between DNN and BN

At the same time, the training and test time of the algorithm in five categories are counted. The time on the training set is shown in Table 12, and the training time and test time on the test set are shown in Table 13.

According to Table 12 and Table 13, compared with DNN network, the training time and test time of BN algorithm on training set are reduced by 46.64% and 83.62% respectively, and the training time and test time on test set are reduced by 61.14% and 89.86% respectively. Generally speaking, the proposed BN algorithm is more efficient than DNN network in five classifications.

c. Comparative analysis with other algorithms

The accuracy pair is shown in Figure 4, the recall pair is shown in Figure 5, the F1-score pair is shown in Figure 6, and the accuracy pair is shown in Figure 7

Figure 4.

Comparison of accuracy rate P

Figure 5.

Comparison of recall rate R

Figure 6.

F1-score comparison

Figure 7.

Accuracy AC comparison

According to figs. 4, 5, 6 and 7, the detection rates of U2R and R2L are relatively low in SVM and DT algorithms. This is because the two types of data in the training set are relatively small, which leads to very little feature information, so the detection rate of this algorithm for these two types of attacks is not very high. Overall, the simulation results show that BN algorithm is superior to other algorithms in accuracy, accuracy, recall and F1 value, and improves the accuracy of a few classifications, so BN algorithm is effective.

According to the above analysis, the same number of test samples are randomly selected in the test set, and combined with the proposed situation quantification method based on attack probability, the network security situation is quantitatively evaluated, and the security situation level is classified. The results are shown in Table 14.

The calculated evaluation value is similar to the ideal output of the actual test sample, and the error is small, and the situation level and running status accurately match the evaluation table, which shows that the algorithm is better than the traditional method.

The situation assessment results obtained by using SVM, DT, DNN and BN are shown in Figure 8

Figure 8.

Situation results under different algorithms

According to Figure 8, compared with the actual situation value, the situation evaluation value obtained by BN, DNN, SVM and DT algorithm has a higher degree of fitting with the actual value curve, followed by DNN network, the situation curve under DT algorithm is higher than the actual situation curve as a whole, and the situation curve under SVM algorithm is lower than the actual situation curve as a whole.

According to Table 15, from the classification time, BN algorithm has the least classification time, DNN network has the longest running time, and SVM running efficiency is better than DT algorithm, in which BN algorithm has improved classification time efficiency by 75.63%, situation assessment time efficiency by 34.39%, total consumption time efficiency by 73.95%, and BN algorithm has improved total time efficiency by 42.31% and 53.87% respectively compared with SVM and DT algorithms.

Simulation results show that using BN algorithm to extract effective features of network data sets to achieve dimension reduction can effectively reduce the time of classification and situation assessment, and the evaluated situation value is close to the actual value, which can be used as the basis for situation assessment. Secondly, the deep neural network DNN and shallow learning algorithms SVM and DT have better evaluation results, but the running time is too long and the efficiency is low.

To sum up, the improved BN situation assessment algorithm is better on NSL-KDD dataset, which can effectively improve time efficiency, has certain feasibility, and still has a lot of room for improvement.