A Network Security Situation Assessment Scheme With Attack Detection Optimized by TAG-Net

The rapid development and spread of digital technology, information and communications technology, have led to an increasing number of individuals and organizations relying on the Internet for their daily work and life. However, a variety of emerging threats pose significant obstacles to traditional defense strategies. Network Security Situation Assessment (NSSA) is an effective measure to protect network systems from malicious attacks and provides an effective solution to protect network security. However, the existing NSSA schemes suffer from low accuracy and poor efficiency when dealing with network traffic data, which is characterized by large scale, nonlinearity, irregularity, high dimensionality, and temporal correlation. To solve these problems, we propose a novel integration of Time-Attention and residual connections, and design a NSSA scheme for network in this paper. Specifically, we first design a Time-Attention mechanism, which can achieve sufficient feature extraction with linear complexity. Subsequently, we integrate the Time-Attention and residual connection to improve the Gated Recurrent Unit (GRU) and design a novel integration of Time-Attention and residual connections neural network model called Time Attention Gated Network (TAG-Net). TAG-Net uses Time-Attention and residual connection as a reset gate and an update gate to reduce conflicts between reset and update gates. Meanwhile, we propose a TAG-Net-based NSSA scheme for network, which can improve the assessment accuracy and efficiency. Finally, we implement our proposed scheme and provide a performance evaluation. The experimental results show an accuracy of 81.87% for the NSL-KDD dataset, 98.28% for the UNSW-NB15 dataset, and 99.99% for the Bot-IoT dataset compared to the state-of-the-art models.