A quantitative model for network security situation awareness based on immunity and grey theory

To effectively evaluate and predict network security situation, a quantitative model for network security situation awareness based on artificial immune system and grey theory is proposed. In this model, the formal definitions of self, non-self, antigen and detector is given. According to the relationship between the antibody-concentration of memory detector and the attack intensity of network, network security situation evaluation sub-model based on artificial immune system is given. And to forecast the attack intensity that the current network faces in the next step, network situation predication sub-model based on grey theory is given. Experimental results exhibit that the proposed model provides a novel approach for network security situation awareness, and holds better characters of self-adaptability and real-time processing.