Jianfeng Zhang

Using Network Security Index System to Evaluate Network Security

Fast Internet growth and increase in number of network attack make network security essential in recent years. This paper proposes a novel approach to evaluate the network security situation using Network Security Index System (NSIS). The NSIS is composed of Foundational Index, Vulnerable Index, Risk Index and Comprehensive Index. Each index focuses on some specific aspect of network security, and the detailed methods of how to calculate the index are given. Experimental results show that the NSIS can assess the network security situation objectively and comprehensively.

A Sampling Method for Mining User's Preference

Recent years, society relies heavily on the network infrastructure and information system. Protecting these assets from frequently network attacks needs to deploy some distributed security systems. However the amount of data produced by many distributed security tools can be overwhelming. So its very difficult and limited to get the most risky alert through manual process based on the huge network alerts with many attributes. The common method used to rank the alerts is scoring function, the higher the score, the more risky of the alert. Our motivation is that many times, user can not precisely specify the weights for the scoring function as their preference in order to get the preferable Ranking. In this paper, we propose a sampling method to mining users preference. Based on this preference, the most risky alerts can be easily ranked for emergency response. An extensive performance study using both synthetic and real datasets is reported to verify its effectiveness and efficiency.

Interactive Approach to Eliciting Users' Preference Using Comparisons

The complexity of todays networks and distributed systems makes the process of network monitoring difficult. The amount of data produced by many distributed security tools can be overwhelming. So its very difficult and limited to get the most risky alert through manual process based on the huge network alerts with many attributes, such as asset, priority, reliability, risk, type et al. The common method used to rank the alerts is scoring function, the higher the score, the more risky of the alert. Our motivation is that many times user can not precisely specify the weights for the scoring function as their preference in order to produce the preferred order of results. In this paper, we propose a new interactive preference searching method to elicit users preference. An extensive performance study using both synthetic and real datasets is reported to verify its effectiveness and efficiency.

A Real Time Situation Awareness Model for Large-Scale Networks

NSAS (Network Situation Awareness System) can identify and predict potential attacks. It plays an important role in improving the emergency response capacity and proactive defense capability of the networks. Existing NSASs have many faults, such as lacking for multi-source data fusing, higher computational complexity, which are difficult to be applied to large-scale networks and real-time situational awareness. This paper introduces a real time NSAS model for large-scale network. The index system of this model is proposed first, and then the details of key technologies, including correlation analysis, index quantification and event predication, are given, finally, fuzzy analytic hierarchy process and configurable aggregation algorithm is adopted to evaluate the situation. The experimental results demonstrate the effectiveness and reasonability of the proposed model.