Abstract
Since the 21st century, the development of network technology has entered a new stage, and mankind has gradually entered the era of big data with information explosion. Computer big data technology has changed people’s lifestyles. People can obtain information and materials without going out to provide convenience for people’s lives. But it is affected in many ways, but we will also encounter some difficulties in the process of using it. Informatization has had a profound impact on many areas of human social life. Especially in the context of global informationization, the information security (IS) problems encountered by China at this stage are more prominent and obvious than ever before. IS issues have also become a hot topic for many scholars to pay attention to and study. Informatization has gradually penetrated into every aspect of daily production work. However, the flow of enterprise informatization has made the public suffer from IS problems while improving office efficiency. This paper analyzes the shortcomings of current enterprise IS situation awareness; studies the construction of enterprise IS situation awareness system through big data technology, artificial intelligence algorithm, and threat intelligence technology; and puts forward the enterprise level IS situation awareness system model, situation awareness system, architecture, and specific implementation method. After analyzing the system design and deployment, the threats to corporate IS can be discovered in a more timely manner, and based on risk judgment and threat tracking, the company’s detection capabilities against security threats and security attacks can be improved, and effective security incident handling can be provided. Supported by technical means, the security situational awareness system will bring different protection and prevention to our enterprise.
1. Introduction
Cognitive computing originated from cognitive psychology, which is a branch of cognitive psychology. As the basis of cognitive science and artificial intelligence, it was first proposed by Paul Horne in a lecture at Harvard University. As a means to solve complex management problems of systems, autonomous computing considers that in the field of single machine, self-discipline computing has four biological self-discipline properties, namely, self-protection, self-configuration, self-optimization, and self-recovery, so that distributed systems have embedded adaptive characteristics; its success at the stand-alone level undoubtedly pushed the self-regulation calculation to the multimachine level or even to the network level [1–4]. Subsequent to the influence of cognitive radio research, cognitive network research is on the agenda. The researcher’s goal is to improve the cognitive ability of the network system and the ability to automatically adapt to environmental changes and extend this awareness and strain to wired, and wireless equivalent networks even extend to heterogeneous network environments [5]. Cognitive computing is also known as “capable of knowing variable,” which is to adjust the relevant settings of the system on the basis of sensing changes in the external environment, so that the system can automatically adapt to changes in the external environment [6, 7]. Based on this, many research institutions, military groups, and commercial companies at home and abroad have conducted research from cognitive circle, cognitive ability, and cross-layer design, in the hope of improving the adaptive ability of the system [8–10].
The most essential purpose of perceptual and cognitive computing is to enable the system to think independently and make correct decisions through learning, just like the human brains, but the ultimate goal is not to replace the human brains with computers [11–13]. Generally speaking, cognitive computing systems should have the following four characteristics: first, assistance function. Cognition computational systems can provide encyclopedic information-asking and support capabilities, allowing humans to use a wide range of in-depth information to easily become “senior experts” in various fields [14]; second, understanding capabilities. Cognitive computing systems should have excellent observation and understanding ability and can help humans find the intrinsic relationship between different information in the data [15]; third, decision-making ability. Cognitive computing system must have rapid decision-making ability, able to help humans quantitatively analyze all aspects that influence decision-making, thus ensuring the accuracy of decision-making. Cognitive computing systems can be used to solve big data-related problems, such as analyze a large number of traffic data to find out how to solve traffic congestion [16]; fourth, insight and discovery. The real value of cognitive computing systems is that they can sum up the needs of people from a large amount of data and information. Make the computing system have a cognitive ability similar to the human brain, thereby helping humans find new problems, new opportunities and new values faster. Dr. Shen Xiaowei of IBM China Research Institute summarized the four major eras of cognitive computing. First of all, at the top of cognitive computing are various advanced intelligent technologies, such as machine learning and human interaction [17]; the second is big data technology, including how to store and organize, managing and analyzing big data, etc. The third is the architecture of the computer. The computing power required by cognitive computing systems is much higher than the computing power we can provide today. Therefore, how to implement data-centric system design is also current. The challenge is fourth, at the bottom of the cognitive computing system, there is also a need to achieve breakthroughs in technologies such as atomic and nano [18].
In foreign countries, research on cognitive computing mainly focuses on cross-layer design, cognitive loop, and adaptiveness. The structural form of cross-layer design of cognitive computing is one of the hotspots in the current research field and has been widely accepted by academic circles [19, 20]. Sajan et al. believe that cross-layer design can solve the problem of information interaction between traditional network layers and provide theoretical guidance for the construction of cognitive computing-based system models in subsequent research [21]. Jane’s proposed Psiactive Networking, whose cross-layer design is centered on the network and nodes, uses fuzzy logic to infer the information of multiple network layers or planes and can support adaptive and predictable in highly dynamic ad hoc networks and intelligent properties such as [22].
This paper first analyzes the current shortcomings of enterprise IS situation awareness, comprehensively improves the detection capability of enterprises to deal with security threats and security attacks, and provides effective technology for security incident handling support.
2. Proposed Method
2.1. Big Data Technology and Key Technologies
First of all, we have to collect and sort the relevant data, find the data we need in a large number of books, and then store the data in the database, which can be extracted at any time in subsequent research, and then use computer big data. Analyzing the data, according to the trend and status of the data reflected by the data, we can present it to decision-makers in the form of relevant images and trend graphs to help users make more accurate judgments.
2.2. Neural Network Theory
The neural network is an information processing method based on the structure of biological nerve tissue and the mechanism of activity. It is a complex network system that is widely interconnected by a large number of processing units. It is a mathematical model of the theoretical human brain neural network. It is also a highly nonlinear network system with high parallel processing and good memory, self-adaptation, and self-adaptation. After a finite iteration calculation, it repeatedly feeds back according to the input and output of the system and then analyzes the nonlinear relationship between them. (1)Neural network model
The neural network is a complex network that processes the interconnection of neurons. We divide it into signal propagation directions: forward neural network and feedback neural network. There is no connection between the neurons in each layer, only one-way connection between adjacent layer neurons. The middle layer can have multiple layers, but the neurons in each layer can only receive the information of the previous layer of neurons. The output of the previous layer in the forward network is the input of the next layer, and the processing of information can only be transmitted layer by layer, one-way, and not cyclic. Because of this characteristic, the forward neural network can easily connect multiple analysis layers in series and establish a neural network. All the neurons in the feedback neural network are likely to be connected, so the initial input signal will be repeatedly transmitted back and forth between the neurons, starting from a certain initial state, after several changes, gradually tend to a stable state or enter other equilibrium states such as periodic oscillations. The most widely used BP neural network is a multilayer sensor based on error back propagation, which is a multilayer forward neural network. (2)Principle of neural network operation
The algorithm of neural network is as follows: (1)Set the input variable of neural network as:
The corresponding output variables are (2)Set the input of each neuron in the hidden layer as:
In formula (3), is equal to ; is the connection weight from the input layer to the hidden layer, is the threshold of neurons in the hidden layer, and is the number of cells in the hidden layer. (3)If the activation function adopts sigmoid type function:
Then, the output of the hidden layer unit is
The input of neurons in each output layer is
The outputs of neurons in each output layer are
In equations (6) and (7), , is the connection weight from the hidden layer to the output layer, and is the unit threshold of the output layer.
The neural network continuously accepts the input of external information and continuously changes the connection weight or topology of the network under its stimulation, so that the network output layer is infinitely close to the expected value. This process is called the neural network learning process, and its essence is to dynamically adjust the variable weights. In the process of learning, the connection of each neuron in the network needs to be adjusted according to certain rules. This weight adjustment rule is called a learning rule. There are many learning algorithms for neural networks, but there are three types of applications: supervised learning, unsupervised learning, and dead-memory learning. The supervised learning algorithm uses error correction rules. In the process of learning and training, it is necessary to continuously provide a supervision signal to the network. The supervisory signal generally includes an input mode and a desired output mode, and the two are generally input in pairs. The actual output of the neural network is compared with the expected output.
2.3. Multilayer Perceptron Neural Network (MLP)
2.3.1. The Basic Structure of the Multilayer Perceptron
The multilayer perceptron structure is generally composed of relatively simple structures of neurons. This structure has two layers of hidden layers; the network is fully connected; that is, except for the input layer (the input layer actually has no neurons but the input data) and the output layer, the neurons between any two adjacent layers are connected to each other. There are several definitions of hidden layers. The definitions used in this article are not included in the hidden layer except for the output layer. The rest of the network hierarchy containing neurons is counted as a hidden layer. When an input signal enters, the first hidden layer first obtains the data of the input signal, and after the signal passes through the processing of the first hidden layer neuron, the generated output is transmitted to the next hidden layer, thereby once to the entire neural network. Output.
The propagation of the forward and reverse signals of the multilayer perceptron intercepts a portion of the network structure. The function signal and the error signal can be recognized by the network: (1) For function signal, the function signal propagates forward, starting with the input signal from the input of the network. The function signal propagates forward through one neuron, and the neuron operation through each layer is finally outputted at the output end as an output signal. The function signal is sometimes referred to as an input signal in some documents. (2) For error signal, when the error signal is outputted by the network, the output is compared with the expected result to obtain an error signal. The energy function is generally used as a measure of the error signal. The error signal then reverses from the output to the multilayer perceptron network structure.
Each neuron of a multilayer perceptron structure can generally perform two calculations: (1) Accept input information and then calculate the output of the neuron. An output is obtained through a continuous nonlinear function by the sum of the input signal and the weight of the corresponding synapse. (2) Calculate the gradient vector. The magnitude of the gradient vector is obtained by the error signal transmitted back in the reverse direction for the adjustment of the weight, and the process is reversed through the network from the back to the front. In the process of training a multilayer perceptron network, the thing to be done is to continuously adjust each synaptic weight and finally reach a preset termination condition. For the synaptic weight of the output layer, it can be directly corrected by the error signal, because the error signal is directly generated at the output, but for the hidden layer synaptic weight, it is not as direct as the output layer, for the hidden layer weight. Adjustments are usually made using backpropagation algorithms, and backpropagation algorithms provide a solution to this basic problem.
2.3.2. Supervised Learning Methods
Supervised learning methods can generally be divided into batch learning and online learning. Consider a multilayer perceptron network structure, using a supervised training approach, and the sample of the training network is
is recorded as the function signal generated by the th neuron of the output layer; that is, the output produced by this neuron is also one of the output signals due to the output layer. The signal of the output layer is composed of the output generated by multiple neurons. This signal is generated by the input signal acting on the input layer. The error signal produced by the output of neuron is defined as: where is the th element of the target output vector . Next, we can get the instantaneous error energy of neuron , defined as:
By summing the instantaneous energy of all output signals of the output layer, the total instantaneous error energy can be obtained, defined as: where represents a collection of all output neurons that contain the output layer. Assuming that there are training samples, the average error energy of the entire sample is defined as:
According to the actual supervised learning method, these two definitions can be used as the optimal objective function. First, consider the batch learning method. In the batch learning method, the neural network of the multilayer perceptron structure adjusts the synaptic weights through the back propagation algorithm after all the samples of the training set pass through the network, so that one training constitutes one round (epoch). Therefore, batch learning is based on the average error energy as a cost function (i.e., the objective function). Since all synaptic weights are adjusted once per round, the learning curve is a graph drawn by ’s corresponding number of rounds. In each round, a fixed proportion of samples is randomly selected from the training set for training. Other proportions of the samples are used as the verification set and the test set. Using the gradient descent method to achieve the trainer, batch training has the following advantages: (1) It has an accurate estimate of the gradient vector, so under simple conditions, this method can be quickly reduced to the local minimum point. (2) The learning process is carried out in parallel. The downside is that batch learning has certain storage requirements in the algorithm implementation process. From a statistical point of view, batch learning can be regarded as some kind of statistical inference, which is very suitable for nonlinear regression problems.
The online learning method is based on the sample. After each sample is used, the synaptic weight adjustment is performed, and the minimized cost function is the total instantaneous error energy . Suppose a training set has samples. In one round, after the first sample is input to the network for , an output is obtained, and then, the synaptic weight is immediately adjusted using the gradient descent method. Two samples are entered into the network for , and the previous steps are repeated until the sample pair input is completed, thereby completing one round. One shortcoming of this approach is that it violates parallelism. One implementation of the learning curve of the online learning method is to draw the final value corresponding to the number of rounds of training. Due to the different network training processes, the online training and batch learning training methods can be greatly different in the learning curve.
Usually, the training samples are determined in advance, so that when the network is trained, the online learning method can make the samples accepted by the network training randomly obtained, so the trained network is equivalent to the weight determined by the random search. It is because of this feature that the network is not easy to fall into local extremum in the learning process, which is also a place where the online learning method is better than the batch learning method. Another advantage is that the online learning method has less demand for storage.
2.4. Two-Way Cognitive Computing Model Based on Cloud Transformation
represents the quantitative area, represents the qualitative definition of , represents the connotation of , represents the extension of , and represents the cognitive transformation operator; then, the quadrilateral can be expressed as:
The bidirectional cognitive computing model called concept is BCCM. Among them, operator is used to realize the cognitive transformation of concept extension (intension) to concept extension (extension), while operator is used to realize the concept extension to the concept connotation and know the conversion. The key to realizing the concept of bidirectional cognitive transformation is to construct appropriate cognitive transformation operators and .
3. Experiments
3.1. Experimental Data Set
The training and test data in this paper were taken from the data set used by MIT Lincoln Laboratory to evaluate the intrusion detection system. The data set is 9 weeks of network connection data collected from a simulated US Air Force LAN, where the training data contains 5 million data connections and the test data contains 2 million data connections. The daily data set contains a tcPdulnp file and a tcPdulnP.list file, where the tcPdump file contains the actual data package, and the toPdulnP.list file describes the properties of the connection where each data packet is located, including the time when the connection occurred, whether the connection is normal or not abnormal information.
This paper samples some data from it, uses the protocol parsing part of the packet capture module to parse the tcPdump file, compares each packet to the tcdulnP.list file, marks whether the packet is normal or abnormal, and uses the preprocessing module. The data packet attributes are digitized to form three sets of data sets. The proportions of normal data packets and abnormal data packets in each data set are different, respectively, simulating the low, medium, and large intrusion behaviors in the network environment. The types and number of packets included in each data set are shown in Table 1.
3.2. Intrusion Signal Preprocessing
The preprocessing of the intrusion signal can directly affect the intrusion perception recognition rate. In practice, the preprocessing of the intrusion signal usually includes the following contents: preemphasis processing of the intrusion signal, windowing and framing processing of the intrusion signal, and endpoint detection processing of the intrusion signal. Next, we introduce the different processing methods in the preprocessing process of the intrusion signal one by one. (1)Intrusion signal preemphasis
The transfer function of the intrusion signal preemphasis is where is the preemphasis coefficient, .
It can be calculated by the following difference equation:
In the formula, the coefficient is a preemphasis coefficient, which is often selected between 0.9 and 1. (2)Signal windowing and framing
Intrusion signals are typically nonstationary signals. Its characteristic is that it has short-term stability (the intrusion signal can be considered to be approximately unchanged within 10-30 ms). In actual processing, the intrusion signal can be divided into small time periods (about 10~30 ms), which is the framing. The window functions commonly used in intrusion signal processing are rectangular windows and Hamming windows. In this paper, the Hamming window is used, the window length is 256 points, and the Hamming window expression is shown in equation (8): where is the frame length. In this paper, 256 points are used for frame processing, and the interframe overlap is set to 128 points. (3)Intrusion signal endpoint detection
Endpoint detection is used to determine the start and end points of the intrusion signal. The endpoint detection results are shown in Figure 1. There are several methods for endpoint detection that are frequently used: (1)Short-term average amplitude(2)Short-term average zero-crossing rate detection method, which is more popular is the double-threshold endpoint detection method
As can be seen from Figure 1, when the average amplitude in a short period is particularly small, it can be concluded that the nearby time period must be the start or end point.
3.3. Feature Extraction of Intrusion Signals
In this paper, some data are randomly extracted from the data set of intrusion detection system, and the start and end points of intrusion signal are judged by calculating the short-term average amplitude of intrusion signal. The essence of intrusion signal feature extraction is to digitize the intrusion signal. The original intrusion signal is processed by a certain digital signal processing technique to obtain a vector sequence, which can represent the information carried by the original intrusion signal, so that the intrusion is initially realized while completing the tone number conversion. Compression of data. In practical applications, the most commonly used characteristic parameters are MFCC coefficients, LPC coefficients, and MEL frequency cepstral coefficients. In this paper, 12-dimensional MFCC coefficients and 12-dimensional first-order differential MFCC coefficients are used. MFCC (Mel frequency cepstral coefficients) is a feature widely used in automatic speech and speaker recognition. Also known as isolated word pattern recognition, it is one of the ways of speech recognition. This extracts a 24-dimensional spectral value for each frame of the intrusion signal.
4. Discussion
4.1. Perceptron Neural Network Performance Analysis
Four kinds of neural networks are trained by using the training data in the above three sets of data sets, and the weighted value and the value matrix with smaller convergence errors are selected to detect the detected data. The results obtained are shown in Figure 2. The results of mixing the three sets of data using a neural network without algorithm improvement are shown in Figure 3. The fuzzy packet in the table refers to the output of the detected neural network. The value cannot be judged to be a normal package or an abnormal package. In the implementation of this paper, the output is 0.9-1.0, 0-0.1 is considered to be a normal package, 0-0.1, 0.9-1 is considered to be an abnormal package, and the other can not be judged as a fuzzy package.
False positive rate = the number of abnormal packets before the detection is normal packets and the total number of normal packets before detection.
Missing rate the number of normal packets before detection and the total number of abnormal packets before detection.
Detection rate = data packets that are normal after normal detection before detection + packets that are abnormal after abnormality detection before detection/total number of packets.
As can be seen from Figures 2–4, the deletion rate of the improved and classified neural network group increased from 10% to about 15%. The improvement of the standard algorithm of the perceptual neural network helps to accelerate the convergence speed of the neural network. Mainly reflected in the reduced training time length after the improvement, the improved algorithm training time for each set of sample data is the shortest, but this speed is still very slow. For each set of sample data, the false negative rate and false positive rate in Figure 3 are lower than the false negative rate and false positive rate in Figure 2, and as can be seen from Figure 4, as the input vector dimension increases, the nerve the network’s false negative rate and false positive rate are generally declining. Therefore, classifying network data packets and adding specific input vector dimensions to different types of data packets can effectively improve the recognition capability of the neural network and reduce the false negative rate and false positive rate of the intrusion detection system.
4.2. Cognitive Computing Analysis
In the simulation part, we mainly compare the cognitive decision algorithms of deep belief network (DBN) and multilayer perceptron (MLP).
4.2.1. The Effect of the Number of Repetitions of the Training Set on the Performance of the Algorithm
In the study, when we control the number of neurons in the hidden layer to 40 and the number of network layers to 3, the parameter of the number of repetitions varies from 150 to 400 intervals, and the corresponding results are shown in Figure 5. We can see from the results that there is a big difference between the results they get. In the case of reasonable parameter selection, the accuracy of our proposed algorithm is more advantageous than the deep belief network.
4.2.2. The Effect of the Number of Hidden Layer Neurons on the Performance of the Algorithm
The parameters of hidden layer neurons increase from 10 to 40 intervals. The result is shown in Figure 6. We can clearly see. When the number of neurons exceeds 10, the accuracy of cognitive calculation is significantly higher than that of deep belief network intrusion signal feature extraction. The essence of intrusion signal feature extraction is to digitize the intrusion signal. The original intrusion signal is processed.
5. Conclusions
(1)This paper first analyzes the current shortcomings of enterprise IS situation awareness: the model, architecture, and implementation of the system(2)The neural network used in the construction of perceptual computing strategy is a multilayer perceptron structure network, which is a classic network type. In addition to this neural network, there are other neural network types and different training methods. These are all tools for research and development. This paper only does some shallow research on the multilayer perceptron network, which is a simple perceptual computing attempt for the neural networks to security systems(3)Performance evaluation process algebra to form the formal representation, abstract the interlayer information transfer and service request, and complete the abstraction of the cognitive process of the cross-layer structure. Then, the formal representation model based on performance evaluation process algebra is vectorized by continuous space state approximation, which is transformed into a fixed number of ordinary differential equations, and the external global target demand is transformed into the perception and calculation of internal cognitive computing model. Decision-making problem to solve the problem of state space explosion is encountered in the analysis and solution of traditional Markov chain algorithm(4)The application of computer big data and computer technology is the development of our society. It is an inevitable trend, so relevant departments should pay attention to it. To discuss the characteristics of modern development, and then we need to start from the firewall technology, virus detection technology, authentication technology, encryption technology, intrusion detection technology, etc., face computer ISTechnology analysis, and then effectively improve the performance of the computer, for our country. The healthy development of the meeting lays a good foundation
Data Availability
The data that support the findings of this study are available from the corresponding author upon reasonable request.
Conflicts of Interest
The authors declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Acknowledgments
This work was supported by the Liaoning Social Science Planning Fund Project (L19BXW010).