Research on Key Technologies of Security Situation Assessment for the Virtual Layer of Cloud Platform

doi:10.3969/j.issn.1671-1122.2020.07.006

Abstract

Abstract:

With the increasing attacks and destructions against cloud platforms, the security guarantee mechanism of cloud platforms has also changed from traditional passive protection to active defense. Situation assessment is a method that can actively analyze and evaluate the current security risk status of the cloud platform, and is a key part of the whole process of situation awareness. This paper aims at a large number of virtual machines deployed in cloud platforms, on the basis of analysis and extraction of virtual layer security situation assessment elements, an improved adaptive genetic simulated annealing algorithm OAGSAA is proposed, and applied to BP neural network, which can effectively analyze and evaluate the security status of the virtual layer. Simulation experiment results show that the method has higher prediction accuracy and convergence speed, and can avoid falling into the local minimum.

Key words: cloud platform, virtual layer, situation assessment, adaptive genetic simulated annealing algorithm, BP neural network

CLC Number:

TP309

YU Qing, ZHENG Chonghui, DU Ye. Research on Key Technologies of Security Situation Assessment for the Virtual Layer of Cloud Platform[J]. Netinfo Security, 2020, 20(7): 53-59.

Figures/Tables 10

References 17

[1]	ENDSLEY M R. Toward a Theory of Situation Awareness in Dynamic Systems[J]. Human Factors, 1995,37(1):32-64.
[2]	BASS T, GRUBER D. AGlimpse into the Future of ID[J]. The Magazine of USENIX&SAGE, 1999,24(3):40-49.
[3]	CHEN Xiuzhen, ZHENG Qinghua, GUAN Xiaohong, et al. Quantitative Hierarchical Threat Evaluation Model for Network Security[J]. Journal of Software, 2006(4):885-897.
	陈秀真, 郑庆华, 管晓宏, 等. 层次化网络安全威胁态势量化评估方法[J]. 软件学报, 2006(4):885-897.
[4]	YAN Yusheng. Security Assessment Research for Cloud IaaS Service Based on Classified Protection[D]. Beijing: Beijing Jiaotong University, 2016.
	晏裕生. 基于等级保护的云计算IaaS安全评估研究[D]. 北京:北京交通大学, 2016.
[5]	HUANG Ning. Research on Network Security Situational Awareness Technology in Cloud Computing Environment[D]. Xi'an: Xi'an Polytechnic University, 2018.
	黄宁. 云计算环境下网络安全态势感知技术研究[D]. 西安:西安工程大学, 2018.
[6]	LIU Yuling, JIA Xuefei, YAN Yan, et al. Cloud Security Situation Awareness Method Based on Gray Theory[C]// The 15th Research Institute of China Electronics Technology Group Corporation. National Information Security Level Protection Technology Conference, July 2-3, 2015, Beijing, China. Beijing: China Electronics Technology Group Corporation, 2015: 21-24.
	刘玉岭, 贾雪飞, 严妍, 等. 基于灰色理论的云环境安全态势感知方法[C]// 中国电子科技集团公司第十五研究所. 全国信息安全等级保护技术大会,2015 7.2-7.3,北京.北京:中国电子科技集团公司, 2015: 21-24.
[7]	ZHANG Chao. Research and Analysis of Cloud Computing Network Security Situation Assessment[D]. Beijing: Beijing University of Posts and Telecommunications, 2014.
	张超. 云计算网络安全态势评估研究与分析[D]. 北京:北京邮电大学, 2014.
[8]	KEL-SHORBAGY M A, AYOUB A Y, EL-DESOKY I M, et al. A Novel Genetic Algorithm Based K-means Algorithm for Cluster Analysis[M]. Heidelberg: Springer-Verlag, 2018.
[9]	LI K, JIA L, SHI X. An Efficient Hybridized Genetic Algorithm[C]// IEEE. International Conference of Safety Produce Informatization (IICSPI), November 23-25, 2018,Chongqing, China. New York: IEEE, 2018: 118-121.
[10]	METROPOUSN . Equations of State Calculations by Fast Computing Machines[J]. The Journal of Chemical Physics, 1953(21):1087-1091.
[11]	CHEN Jun, HE Li, QUAN Yi, et al. Application of BP Neural Networks Based on Genetic Simulated Annealing Algorithm for Short-term Electricity Price Forecasting[C]// IEEE. International Conference on Advances in Electrical Engineering (ICAEE), January 9-11, 2014, Vellore, India. New York: IEEE, 2014: 1-6.
[12]	YUAN Yongliang, WANG Guohu. Self-adaptive Genetic Algorithm for Bucket Wheel Reclaimer Real-Parameter Optimization[J]. IEEE Access, 2019: 47762-47768.
[13]	Ding Qunyan. Improved BP Neural Network Controller Based on GA Optimization[C]// IEEE. International Conference on Smart Grid and Electrical Automation(ICSGEA), May 27-28, 2017, Changsha, China. New York: IEEE Computer Society, 2017: 251-254.
[14]	Yuan Zhenbing, Guo Shuli, Han Lina. Disease Diagnostic Prediction Model Based on Improved Hybrid CAPSO-BP Algorithm[C]// Technical Committee on Control Theory (TCCT). 2017 36th Chinese Control Conference, July 26-28, 2017, Dalian, China. CCC, 2017: 3960-3965.
[15]	KANG Zhou, QU Zhiyi. Application of BP Neural Network Optimized by Genetic Simulated Annealing Algorithm to Prediction of Air Quality Index in Lanzhou[C]// IEEE. International Conference on Computational Intelligence and Applications, September 8-11, 2017, Beijing, China. IEEE, 2017: 155-160.
[16]	Li Peiyuan. Research on Anomaly Detection Technology for Cloud Computing Environment[D]. Beijing: Beijing Jiaotong University, 2018.
	李沛原. 面向云计算环境的异常检测技术研究[D]. 北京:北京交通大学, 2018.
[17]	ZHAO Chao. Research on Cloud Environment Network Security Monitoring Architecture and Security Assurance[D]. Harbin: Harbin Engineering University, 2017.
	赵超. 云环境下网络安全监控架构及保障方法研究[D]. 哈尔滨:哈尔滨工程大学, 2017.

序号	名称	含义
1	time	时间
2	mac-s	源mac地址
3	mac-d	目的mac地址
4	protocol	协议
5	IP-s	源虚拟机IP地址
6	IP-d	目的虚拟机IP地址
7	port-s	源虚拟机端口
8	port-d	目的虚拟机端口
9	number	数据包数量
10	length	数据包长度
11	TTL	生存时间
12	exe_num	虚拟机进程总数
13	exe_sleep	虚拟机休眠进程数
14	exe_run	虚拟机运行进程数
15	exe_zom	虚拟机僵死进程数
16	exe_stop	虚拟机终止进程数
17	hidden_process	虚拟机隐藏进程数目
18	thread_num	虚拟机线程数目
19	Unlinked_DLLs	未链接的DLL
20	Loaded_DLLs	进程已加载的DLL
21	dll_num	更改的DLL文件数
22	ART	平均响应时间
23	Loss Tolerance	丢包率
24	Protection_software	虚拟机是否开启防护

算法	进化代数	MSE	MAE	准确率
GA-BP	37	0.396	0.422	96.65%
OAGSAA-BP	11	0.213	0.287	97.05%

	威胁程度	对应态势值
Normal	0	0
Ping	1	0.2
DNS	2	0.5
DoS	2	0.5
RPC	2	0.5
Shellcode	3	0.8
http	3	0.8

云平台虚拟层态势值	对应安全等级
0~0.2	安全
0.2~0.5	轻度危险
0.5~0.8	中度危险
0.8~1	高度危险

时间点	所受攻击数目	所受攻击类型
t1	1	DoS
t2	0	无
t3	1	Ping
t4	0	无
t5	2	Ping、Shellcode
t6	1	http
t7	3	Ping、DNS、http
t8	2	Ping、DoS