Abstract:

Network security situation awareness assessment remains a critical research focus in cybersecurity. Previous methods suffered from limited transferability and excessive reliance on expert experience, leading to rigid processes and subjective evaluations. We analyzed malicious traffic graphs and observed that attackers exhibited higher centrality characteristics, structurally resembling interaction patterns in social networks. Centrality analysis, widely used in social networks to identify key nodes and propagation paths, was adapted to detect attack sources and propagation nodes in malicious traffic graphs. This structural similarity enabled transferring social network analysis methods to cybersecurity domains, improving assessment transferability. To address these limitations, this paper proposed ThreatSA, a novel network security situation assessment method. Unlike static approaches, ThreatSA converted malicious traffic into graph structures and quantified node importance through centrality analysis to identify attackers and propagation nodes. It then employed intimacy analysis to measure node relationship strength, dynamically reflecting host security status. The method required only malicious traffic data and functioned effectively in information-incomplete environments. Experimental evaluations on three public datasets demonstrate ThreatSA’s real-time assessment capability with 99.32%, 99.65%, 99.74% similarity scores. Comparative tests show ThreatSA outperforms two representative methods, proving its effectiveness in network security situation assessment.

Key words: situation assessment, threat source localization, centrality analysis, intimacy calculation