Cyber Security Situation Awareness Based On Data Mining

Situation awareness is a kind of the third generation of information security technology, which aims to provide the global security views of the cyberspace for administrators. A framework of cyber security situation awareness based on data mining is proposed in this paper. The framework can be viewed from two perspectives, one is data flow, which presents the abstracting of cyber data, and the other one is logic view, which presents the procedure of situation awareness. The framework's core component is correlation state machine, which is an extension of state machine. The correlation state machine is a data structure of achieving situation awareness, which is created based on the technology of data mining. After being created, it can be used to assess and predict the threat situation to achieve cyber knowledge. We conclude with an example of how the framework can be applied to real world to provide cyber security situation for administrators.