A cyberspace security situation awareness model based on complex network

Abstract

Cyberspace security situation awareness (SSA) is important to guarantee the safety of the foundation of a country. Current studies focus mainly on how to acquire SSA data via a fusion information method, while a full understanding of existing SSA data has not been obtained. In this paper, complex network theory is introduced to model SSA data, and SSA state information is connected to the properties of the constructed network. Through analyzing the property quantities of the network, we can more effectively mine the characteristics of current data. A case study is conducted to demonstrate our method on a real traffic trace collected by an authority lab, and the test results verified that the property quantities of complex network can expose SSA messages about current state and future tendencies.