Prediction of network security situation awareness based on an improved model combined with neural network

People always pay attention to the security of the network. This paper mainly analyzed the problem of network security situation prediction (NSSP). The radial basis function neural network was improved by the particle swarm optimization algorithm, and a modified particle swarm optimization‐radial basis function algorithm was obtained, which was used as the prediction model. Then, the data from National Internet Emergency Center were used as the experimental data, and the modified particle swarm optimization‐radial basis function algorithm was compared with radial basis function and particle swarm optimization‐radial basis function algorithms. The results showed that the modified particle swarm optimization‐radial basis function algorithm could achieve convergence in about 50 times of iterations, showing a high calculation efficiency and a short operation time, and the mean absolute percentage error value, mean square error value, and root‐mean‐square error value were small (2.13%, 0.0005, and 0.0224), showing that the algorithm had good prediction performance. The results verify the reliability of the modified particle swarm optimization‐radial basis function algorithm in NSSP, which is conducive to further improve network security.


INTRODUCTION
With the development of internet technology, the network has been applied in more and more fields, such as online shopping, electronic payment, smart home, and entertainment, 1 which has brought great changes to people's production and lifestyle. However, at the same time, network security has also been greatly challenged. 2 Network attacks are becoming more complex and diverse. Although the current network security technologies, such as firewall, 3 intrusion detection, 4 and virtual private network (VPN), 5 play a role in network security, they all have defects and are not suitable for the current more and more complex network environment; therefore, network security situation awareness (NSSA) appears. 6 NSSA evaluates the current network state by processing the network security data, and on this basis, it can carry out network security situation prediction (NSSP). 7 Zhang et al. 8 optimized the wavelet neural network (WNN) with the isolation niche genetic algorithm (INGA), carried out a simulation experiment, and found that the method had a higher prediction accuracy. Based on the recurrent neural network (RNN), Wei et al 9 extracted features from the original time series data and trained and verified them on the RNN model. The results showed that the method produced more accurate prediction results, although the training time was long. Aiming at the problem of long training time of the support vector machine (SVM) algorithm, Hu et al 10 optimized the SVM algorithm with the cuckoo search (CS), carried out distributed training on MapReduce, and found that the method could effectively reduce the training time. Zhou et al 11 solved the NSSP problem with the hidden belief rule base (HBRB), improved the prediction accuracy of the model based on the evidence reasoning rules, and verified the effectiveness of the new method by the case study. Machine learning is a science of artificial intelligence. It uses computers as tools to learn and simulate human behaviors in order to obtain new knowledge or skills. It has a wide range of applications in many fields. Hamid et al 12 predicted the solubility of hydrogen sulfide in the presence of various ionic liquids with machine learning methods and established a feedforward multilayer perceptron artificial neural network (MLP-ANN), an adaptive neuro-fuzzy inference system (ANFIS), and a radial basis function artificial neural network (RBF-ANN) for experiments. The results showed that the MLP-ANN model showed the best performance. Moosavi et al 13 developed the RF and Q prediction models involving optimized multilayer perceptron (MLP) and radial basis function (RBF) neural networks and predicted the reservoir characteristics in the oil recovery process. Through experiments, they verified the excellent predictive performance of the model. Ahmadi et al 14 proposed a model based on a feedforward ANN to predict asphaltene precipitation caused by natural depletion, which was optimized by a hybrid genetic algorithm and particle swarm optimization. The experiment found that the method had good precision and accuracy. In current works about artificial intelligence, NSSP has been studied frequently, but the overall reliability is not high, and the prediction error was large, for example, the fuzzy evaluation method proposed by Yu et al 15 and the neural network method proposed by Jiang et al. 16 Based on neural network, this study analyzed the NSSP problem, designed an improved radial basis function (RBF) algorithm with the particle swarm optimization (PSO) algorithm, and verified the effectiveness of the algorithm in solving NSSP through experimental analysis, which makes a contribution to the better realization of network security.

NETWORK SECURITY SITUATION AWARENESS PREDICTION
The idea of situation awareness first appeared in the military and was used for judging the military environment and situation, and then it was applied in fields such as transportation and medicine and extended to the field of network security. NSSA means collecting as many network security elements as possible through a series of technologies and establishing corresponding evaluation and prediction models to help network managers deal with risks in time. NSSP means predicting the future network state and prevent network attacks based on historical situation assessment data. The premise of prediction is that there are some rules between adjacent data points. The research shows that there is self-similarity in network traffic data. The prediction object of NSSP is network security situation (NSS) value, which is a series arranged in time order, and there are some rules between adjacent data points; therefore, NSSP is predictable, which is feasible.
At present, the methods used in NSSP are as follows: (a) autoregressive moving average model 17 : based on stationary time series, it forecasts the future state, but has some requirements for the length of time series; (b) gray theory 18 : based on gray correlation, it searches for the internal law of the system, but it has poor prediction performance for data with large fluctuation; (c) time series 19 : it is based on the correlation between adjacent data, but many elements need to be considered in the process of modeling; (d) neural network 20 : it takes security events as input and outputs the situation value to realize NSSP, but it is easy to fall into local convergence to affect the prediction effect.

IMPROVED MODEL OF NEURAL NETWORK
RBF neural network is a three-layer feedforward neural network. 21 The input layer transmits the input samples to the hidden layer, and the number of nodes is the dimension of the samples, which is written as X = (x 1 , x 2 , · · · , x i ) (i = 1, 2, · · · , m). The hidden layer trains the samples and adjusts the parameters at the same time. There are h nodes. The weight between the hidden layer and the input layer is w ij , and the threshold is j . The commonly used activation function is the Gaussian function, and its calculation formula is: where j refers to the base function, c j is the data center of the jth node, and j refers to the width parameter of the jth node. The output layer responds to the input. The weight between the output layer and the hidden layer is v ij , and the threshold is k . The output of the jth node is written as: The specific training process of the RBF neural network-based NSSP model is as follows.
is defined to accumulate the vector sum of NSS samples belonging to different classes. B(L) is defined to register the number of NSS samples belonging to every class. L refers to the number of classes of NSS samples.
(2) Every sample is regarded as the possible data center, and the density indicator is calculated, and the calculation formula is: where d 1 is the radius of the neighborhood that takes x i as the center.
(3) For every sample point x j , the distance r between x j and the data center c j of the jth node is calculated. If r ≤ d 2 (d 2 is a threshold), then it is classified into the corresponding class. Moreover, let (4) The unclassified sample is used as a new input sample X. The above steps are repeated until B(L) < M (M is a set threshold). Finally, L classes of NSS are obtained.
(5) For each class, its center of gravity is calculated, , until the neural network converges. For the RBF neural network, data center c j , width parameter j , weight v ij , and the number of nodes (h) in the hidden layer all have a significant impact on the performance of the neural network. Therefore, the above parameters are optimized by a modified particle swarm optimization (MPSO) algorithm in this study.
The PSO algorithm is an intelligent algorithm that simulates the foraging behavior of birds. 22 The possible solution of the algorithm is the position of particles, and individuals update positions through adjusting the individual extremum p best and the global extremum g best to find out the optimal solution. It is assumed that there are M particles in a D-dimensional space. In the tth time of iteration, the position and speed of the ith particle can be written as: The update formulas of the position and speed of the ith particle can be written as: where w is the inertia weight, c 1 and c 2 are acceleration factors, r 1 and r 1 are random numbers in (0, 1), p t best,i is the individual optimal solution in the tth time of iteration, and g t best is the globally optimal solution. As the PSO algorithm is easy to fall into the local extremum and the convergence speed is slow, it is improved in aspects of inertia weight w and acceleration factors c 1 and c 2 . Firstly, the inertia weight w is dynamically adjusted, and the calculation formula is: where w max = 0.9, w min = 0.3, t refers to the number of iterations, and t max refers to the maximum times of iterations. Let w decrease with the increase of t, avoiding the PSO algorithm falling into the local optimum. Then, the accelerating factors c 1 and c 2 are adjusted according to the following equations: and Let c 1 decrease with the increase of t and c 2 increase with the increase of t, improving the convergence speed of the PSO algorithm.
The parameters of the RBF neural network algorithm were optimized by the MPSO algorithm. The steps of obtaining the NSSP model based on the MPSO-RBF neural network algorithm are as follows.
1. An NSS data sample set is established, preprocessed, and normalized. The data were adjusted to the numbers in [0, 1].
The normalization formula is: where x max and x min are maximum and minimum values.
(2) The data set is divided into training samples and test samples.
(3) The structure of the RBF neural network algorithm is determined.
(4) The parameters of the RBF neural network algorithm are encoded and mapped to particles in the particle swarm. (5) The particle swarm is initialized, and the fitness value of particles is calculated. (6) Individual extremum p best and global extremum g best of particles are updated.
The position and speed of particles are updated. (8) Whether the accuracy meets the requirements or whether it reaches the maximum number of iterations is determined. If it does, the algorithm ends, and the optimal parameters of the RBF neural network algorithm are output to establish an NSSP model.

CASE ANALYSIS
In the RBF network, the number of input nodes was five, the number of output nodes was one, and the number of nodes in the hidden layer was determined by the cut-and-trial method; the final network structure was 5-8-1. The population size of MPSO was 40, and the maximum number of iterations was 2000. The proposed method was compared with the RBF method and PSO-RBF method, and the results were statistically analyzed in SPSS17.0 (significance level = 0.05). Data in security weekly reports from National Internet Emergency Center (CNCERT/CC) from 2018 to 2020 were used as the experimental data. The basic situation of network security was evaluated with five indicators, and the situation was divided into five levels: excellent, good, medium, poor, and dangerous. To facilitate calculation, the five levels were represented by numbers 5 to 1. In the designed NSSP model, the input variables were five indicators for evaluating network security situation, and the output variables were the grades of the network security situation, that is, NSS values. The data from 2018 to 2019 were used as training samples, numbered 1 to 104. The data in 2020 were taken as testing samples, numbered 105 to 156, as shown in Table 1.

F I G U R E 2 Comparison of prediction results
optimal error. After optimization by the PSO algorithm, the initial error of the RBF neural network algorithm reduced, and the convergence speed significantly accelerated, reaching convergence after 200-300 times. The MPSO-RBF neural network algorithm designed in this study not only had a small initial error but also converged after 50 times and had a more stable error, which verified that the MPSO-RBF neural network algorithm had an advantage in convergence performance. The operation time of different algorithms was compared, and the results are shown in Table 2. It was seen from Table 2 that the operation time of the RBF neural network algorithm was the shortest, followed by the PSO-RBF neural network algorithm and the MPSO-RBF neural network algorithm. After optimization, the operation time of the PSO-RBF neural network algorithm was 36.78 seconds, which was 13.17% shorter than that of the RBF neural network (P < .05), and the operation time of the MPSO-RBF neural network was only 21.22%, which was 49.91% shorter than that of the RBF neural network and 42.31% shorter than that of the PSO-RBF neural network algorithm (P > .05). The above results verified the advantage of the MPSO-RBF neural network algorithm in operation time.
The prediction accuracy of different algorithms was compared. Taking samples numbered 105-115 as an example, the prediction results of different algorithms were compared, as shown in Figure 2. It was seen from Figure 2 that the difference between the prediction result of the RBF neural network algorithm and the actual value was the biggest, and the change was not stable. After optimization by the PSO algorithm, the prediction result of the PSO-RBF neural network algorithm was improved, but there was still a gap with the actual value. The prediction value of the MPSO-RBF neural network algorithm nearly coincided with the actual value. The prediction error of different algorithms was calculated, and the results are shown in Table 3.

TA B L E 3 Comparison of prediction error
It was seen from Table 3 that the error of the RBF neural network algorithm was the largest, followed by the PSO-RBF neural network algorithm and the MPSO-RBF neural network function; the errors of the RBF neural network algorithm were all larger than 0.1, and the average error was 0.2001; the errors of the PSO-RBF neural network function were about 0.1, and the average error was 0.0705, which was 64.77% smaller than that of the RBF neural network algorithm (P < .05); the errors of the MPSO-RBF neural network algorithm were smaller than 0.1, and the average error was only 0.019, which was 73.05% smaller than that of the PSO-RBF neural network algorithm (P < .05). The above results demonstrated that the prediction result of the MPSO-RBF neural network algorithm was closer to the actual value, and the MPSO-RBF neural network algorithm had a good prediction performance.
The prediction performance of different algorithms was compared, and the results are shown in Table 4. It was seen from Table 4 that the MAPE value of the RBF neural network algorithm was the largest, reaching 5.12%, the MAPE value of the PSO-RBF neural network algorithm was 0.76% smaller than that of the RBF neural network algorithm (P < .05), and the MAPE value of the MPSO-RBF neural network algorithm was 2.23% smaller than that of the PSO-RBF neural network algorithm (P < .05); the MSE value of the RBF neural network algorithm was the largest, followed by the PSO-RBF neural network algorithm and the MPSO-RBF neural network algorithm, and the comparison of the RMSE value was the same. It was found from Table 4 that the parameter optimization by the PSO algorithm effectively improved the prediction performance of the RBF neural network algorithm and the MPSO algorithm improved the prediction performance of the RBF neural network, which showed significant advantages in the solving NSSP.

DISCUSSION
The neural network realizes intelligent calculation to solve complex problems through imitating the structure and characteristics of neural networks of creatures with the help of mathematical and physical methods. It takes neurons as the basic unit, has feedforward and feedback structures, and has strong self-learning ability and good fault tolerance and stability, which has been widely used in image processing, 23 fault diagnosis, 24 financial analysis, 25 and automatic control. 26 The classical neural network models include the back-propagation (BP) neural network, 27 the Hopfield neural network, 28 the RBF neural network, and so forth. RBF neural network has a simple structure and good nonlinear approximation ability, which has been widely used in solving practical problems. This study improved the RBF neural network algorithm with the PSO algorithm and obtained the MPSO-RBF neural network algorithm to solve the NSSP problem. From the perspective of the convergence performance, the MPSO-RBF neural network algorithm achieved convergence after about 50 times of iterations, and its convergence speed greatly improved compared with RBF and PSO-RBF neural network algorithms, which effectively improved the efficiency. Then, from the perspective of the prediction performance, it was found from Tables 2 and 3 that the MAPE, MSE, and RMSE values of the MPSO-RBF neural network algorithm were small, and the prediction performance of the MPSO-RBF neural network algorithm was significantly better than that of the other two algorithms. It was concluded that the MPSO-RBF neural network algorithm was more suitable for solving the NSSP problem. In the current research on situation prediction, neural network methods have been widely used, but the low training efficiency and accuracy of neural networks always exist. In the actual use process, it is difficult to meet the requirements of application, especially in the face of the more and more dynamic and changeable network environment. More and more methods have been applied in the improvement of RBF neural networks, but there are still some shortcomings. Therefore, this paper made further modifications to PSO to obtain a better performance optimization effect. The experimental results showed that the improved method could significantly improve the operation time and prediction accuracy of the RBF neural network, which has higher availability in practice. The PSO algorithm has an excellent performance in parameter optimization. The comparison results demonstrated that the PSO-RBF neural network model was superior to the RBF neural network model whose parameters were not optimized, which verified the importance of parameter optimization for the accuracy of neural network models; The improved PSO algorithm had an improved ability in parameter optimization, which made the improved model show a higher accuracy in solving the problem of NSSP.
In practical application, the improved model can be arranged in the network to sense and predict the NSS. The experimental results showed that the improved model had a good prediction performance. Therefore, it has good usability in practical application and can grasp the changes of NSS better to facilitate the network management personnel to make the corresponding response and maintain network security.
Although some achievements have been made in the research of NSSP in this study, there are some limitations, for example, the proposed method was not verified in the actual network environment, how to obtain the data of network security state from the network environment in multiple ways is also an important problem, and the prediction algorithm needs further improvement. The above problems will be solved in future works.

CONCLUSION
Based on the RBF neural network, this study analyzed its usability in the NSSP problem, designed an MPSO-RBF model, and carried out experiments with the weekly safety report published by CNCERT/CC as the data set. The results showed that the MPSO-RBF neural network algorithm designed in this study had faster convergence and smaller prediction error compared with RBF and PSO-RBF neural network algorithms, with an MAPE value of 2.13%, an MSE