Network Situational Awareness and Quantitative Threat Assessment Based on Multi Sensor Information Fusion

Journal of Advances in Computer Research

شناسنامه علمی شماره، دوره 6، شماره 4، بهمن 2015، صفحه 139-156   

نویسندگان

Amin Sardeh Moghadam^{* 1}؛ Behzad Moshiri¹؛ Ali Payandeh²

¹Control and Intelligent Processing Center of Excellence ECE, University of Tehran, Tehran, Iran

²Department of Information and Communication Technology, Malek Ashtar University of Technology, Tehran, Iran

چکیده

Threat assessment in the computer networks of organizations can reduce damage caused by attacks and unexpected events. Data fusion models such as the JDL model provide efficient and adequate sensors to gather the right information at the right time from the right components. This information then is refined and normalized to provide situational awareness and assess events that may be intended as a threat. This study suggests a new method based on the JDL model where data collected from different sources is normalized into an appropriate format. After normalization, Data is converted into the information. Threat assessment unit analyzes this information based on various algorithms. We use three algorithms to detect anomaly, one to correlate alerts, and one to determine the successfulness of an attack. The model is then evaluated based on a small simulated network threat to ascertain the efficacy of the proposed method. The results show that the method is an appropriate model for situational awareness and threat assessment.

کلیدواژه‌ها

Threat Assessment؛ Data Fusion؛ situation awareness؛ Computer Networks