关键词: 网络安全, 态势感知, 数据融合, 态势评估, 态势预测

Abstract: Different from traditional security measures, network security situation awareness can identify the behavior of various activities in the network and conduct intent understanding and impact assessment from a macro perspective so as to provide reasonable decision support. It has great significance in improving network monitoring capabilities, emergency response capabilities, and predicting the development trend of network security. This paper first separately generalizes the definitions of situation awareness and network security situation awareness, and then sorts out the classical and newly developed system models. It introduces the key technologies of network security situation awareness, which is mainly divided into hierarchical analysis, machine learning, immune system and game theory. Then the latest application of network security situation awareness in Internet, industrial control network and Internet of Things are explained. It summarizes and forecasts the future development trends and problems that need to be solved.

Key words: network security, situation awareness, data fusion, situation assessment, situation prediction