Network security situation awareness based on heterogeneous multi-sensor data fusion and neural network

Network Security Situation Awareness (NSSA) is a hot research realm in the area of network security, which helps security analysts to solve the challenges they encounter. This paper mainly focuses on a NSSA which is based on heterogeneous multi-sensor data fusion using neural network. We designed a NSSA model and discussed it in detail. We adopted Snort and NetFlow as sensors to gather real network traffic and fused them using a multi-layer feed-forward neural network that can solve a multi-class problem. We presented an effective and simple feature reduction approach to decrease the input vector and improve the real-time characteristic of fusion engine. In addition, we described a situation generation mechanism in order to provide the real security situation of the monitored networks. Our model is proved to be feasible and effective through a series of experiments, using real network traffic.