Danger Theory Inspired Model for Network Security Situation Awareness

The danger theory is changing the traditional thinking ways of self/non-self discrimination. Aiming at the deficiencies of the immunity based security situation awareness method, a danger theory inspired model for network security situation awareness is proposed in this paper. After introducing the main idea of danger theory, the model architecture and the formal definitions of state space, antigen, antibody, affinity and danger signal, are defined. Following that, with the danger signal computation method illustrated, the principle of security situation awareness is given. Theoretical analysis shows that the proposed model is feasible. Thus, it provides a good solution to the field of information security evaluation.