Network security situation awareness (NSSA) is an integral part of cybersecurity defense, and it is essential for cybersecurity managers to respond to increasingly sophisticated cyber threats. Different from traditional security measures, NSSA can identify the behavior of various activities in the network and conduct intent understanding and impact assessment from a macro perspective so as to provide reasonable decision support, predicting the development trend of network security. It is a means to analyze the network security quantitatively. Although NSSA has received extensive attention and exploration, there is a lack of comprehensive reviews of the related technologies. This paper presents a state-of-the-art study on NSSA that can help bridge the current research status and future large-scale application. First, the paper provides a concise introduction to NSSA, highlighting its development process. Then, the paper focuses on the research progress of key technologies in recent years. We further discuss the classic use cases of NSSA. Finally, the survey details various challenges and potential research directions related to NSSA.

The biggest difficulty of hidden Markov model applied to multistep attack is the determination of observations. Now the research of the determination of observations is still lacking, and it shows a certain degree of subjectivity. In this regard, we integrate the attack intentions and hidden Markov model (HMM) and support a method to forecasting multistep attack based on hidden Markov model. Firstly, we train the existing hidden Markov model(s) by the Baum-Welch algorithm of HMM. Then we recognize the alert belonging to attack scenarios with the Forward algorithm of HMM. Finally, we forecast the next possible attack sequence with the Viterbi algorithm of HMM. The results of simulation experiments show that the hidden Markov models which have been trained are better than the untrained in recognition and prediction.

A risk assessment method is introduced to the estimation of network security. The method, which combines AHP method and fuzzy logical method, is applied to the risk assessment. AHP method and fuzzy logical method are improved according to the actual condition of the risk assessment of network security. Each risk factor is estimated in the aspect of the probability, the impact severity and uncontrollability. The important degree of each risk factor is obtained. By comparing the important degree of each factor, which risks will be controlled by some means are known. On the other hand, by applying entropy-weight coefficient, the risk degree of the whole network system is obtained, the method of entropy-weight coefficient is applied to objective computation, and subjective judgment is overcome. The study of the case shows that the method can be easily used to the risk assessment of the network security and its results conform to the actual situation

In the previous research of the risk assessment, AHP method and Fuzzy logical method used are obvious subjectivity and limitation. In this paper, AHP method and Fuzzy logical method are improved, the formula of risk degree and entropy-weight coefficient are put forward to the estimation of the information security. Firstly, the hierarchy structure of the risk assessment is constructed and the method of fuzzy comprehensive judgment is improved according to the actual condition of the information security. Secondly, the risk degree put forward is likelihood estimation of the risk probability, the risk impact severity and risk uncontrollability. Finally, for the determination of the weight vector of the risk factor, a method of entropy-weight coefficient is applied to objective computation, and subjective judgment is overcome. The study of the case shows that the method can be easily used to the risk assessment of the information security and its results conform to the actual situation.