{'fraction_non_alphanumeric': 0.017528190242268617, 'fraction_numerical': 0.00725689404934688, 'mean_word_length': 5.064996614759648, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Research and simulation of network security situation prediction algorithm

Monitoring and predicting the security state of network environment is the key to solve network security. On the basis of studying the principle of network security situation awareness, a network security situation prediction model based on artificial immunity and Kalman algorithm is designed according to the artificial immunity evaluation model. First, Wireshark software was used to analyse DARPA99 dataset. Then, the situation value was obtained by using the artificial immune evaluation model. In the Curver Fitting Tool, the Kalman algorithm is written to achieve the optimal prediction of the situation value. The test results show that the model has a good prediction effect.


Network security situation prediction architecture design
Network security situational prediction refers to the evaluation of current network security state and prediction of future development trend based on network data obtained from known network environment, which is used to make security decisions and improve network defense capability.

Construction of network security situation model
It mainly includes three modules: extraction of network security situation factors, situation assessment and situation prediction.
Extraction of network security situation factors is the premise of security situation assessment. The factors that have influence on network security such as attack intensity, network traffic and traffic change rate are extracted.
Network security situation assessment refers to the analysis and processing of the obtained network security situation factors. A numerical value representing the threat degree of the current network system under attack is obtained by calculating the appropriate mathematical model.
Network security situation prediction refers to finding the relationship between current situation value, future situation value and other influencing factors according to the situation value information obtained from situation assessment, obtaining some calculation equation, and then combining with the influencing factors to obtain a predicted situation value.

Model Functional module design
Specifically in this paper, the function module of the model mainly includes three parts: obtaining the attack times, calculating the situation value and the situation value prediction.

Calculation of the situation value.
The function of calculating situation value belongs to the security situation assessment module, and the artificial immunity assessment model was used in this paper.
The relationship between host and network attack is analogous to that between antibody of human immune system and pathogen invasion. When pathogen invasion occurs, the number of antibodies in the body increases, and when the attack decreases, the number of antibodies gradually decreases. Therefore, the network security situation assessment method based on artificial immunity can well 3 reflect the change of host security degree when attacked. The calculation of the situation value in this paper refers to the calculation of the situation value when the whole system contains multiple servers under certain attack. Under type J attack, the system posture value is calculated as shown in Formula (1) [7].
Nij is the number of antibodies to detect type j attacks on host I, αj is the danger of type J attack, and βi is the importance of host i. According to the formula, the greater the situation value is, the greater the risk of the current system is, and the more dangerous the system is.

Situation value prediction.
Kalman algorithm is used to make the prediction. Kalman filter is an algorithm that utilizes linear system state equation to estimate the system state optimally through the system input and output observation data. Attack intensity has the greatest correlation with situation value. For the convenience of the experiment, only the control variables affecting attack intensity on situation value are selected. In the artificial immune model, the risk value was calculated by antibody concentration, based on which the Kalman filter prediction model could be established. Combining the network security situation value of the previous period with the change value of the current attack intensity, a binary one-order function model is established with the network security situation value of the current period. The regression model is as follows: Xk+1 represents the network situation value at time k+1, Xk represents the network situation value at time k, Uk represents the change of attack intensity at time k, Wk represents the state transition error at time k, Zk+1 represents the calculated risk value at time k+1, and Yk+1 represents the observed value of situation value at time k+1. A is the state vector, B is the control vector, H is the observation transfer vector, Wk is the process noise, and Vk is the observation noise.
The prediction principle based on Kalman algorithm is to find a linear description equation that represents the relationship between the situation value at the moment k and the situation value at the previous moment and the control variable, and to list the observation equation. It can be seen from the real environment that both equations inevitably contain certain errors. The Kalman gain coefficient k with the minimum covariance can be obtained through Kalman filtering algorithm. The predicted value is equal to the desired value of the state equation plus k times the difference between the state value and the observed value.
Due to two equations inevitably contains a certain error, the Kalman gain coefficient k with the minimum covariance can be obtained through Kalman filtering algorithm. Predicted value is equal to the state equation desired value plus k times the difference between the state value and the observed value, and at this time are to satisfy the desires of the optimal estimate.

Simulation and result analysis
In Windows 7.0, Wireshark, Matlab, Curver Fitting Tool and other tools were used to implement the algorithm.

Module of obtaining network security situation factors
Wireshark software is used to open part of Darpa99 data set, and I/O chart tool is used to analyze the data set. Dispay Filter is set as TCP. Flags ==0x02, Y Axis is set as Packets. The filtered attack packets are of type SYN. The analysis results are shown in Figure 2. Data packets of 30 consecutive periods including the peak value are selected to record and stored in the file shuju.mat. According to the number of captured attack packets, it can be seen that the number of 0-24s network attack packets is at a normal level, while the number of 25s attack packets is significantly increased, and it returns to the normal level after 26s. Combined with the situation diagram, the 0-24s situation value is lower than 0.5, and the situation value increases to 0.95 around 25s, indicating that the system is more dangerous, and tends to around 0.3 at 26s. It can be seen that the situation value evaluation method is more reasonable and can reflect that the situation value increases with the increase of attack intensity.  The situation value T3 of 1-29s and the normalized value U2 of 1-29s change in attack times were taken as the independent variable, and the situation value T4 of 2-30s was taken as the dependent variable to construct a multivariate function equation. As can be seen from the figure, the parameters in the equation of state obtained were A=0.8147 and B=0.832. The regression prediction equation can be obtained as shown in Formula (4).   The prediction results are shown in Figure 6. The blue line represents the predicted value obtained after the application of Kalman algorithm. Kalman algorithm is a Kalman gain obtained by integrating two equations to obtain the minimum full football covariance, so as to obtain the optimal predicted value. It can be seen from the result figure that the blue line is between the red line and the green line, and closer to the red line, indicating that the observed values are more likely to reflect the change of the system's situation value, and also indicating that the Kalman prediction model has better prediction effect compared with the ordinary linear regression prediction model.

Conclusions
This paper mainly studies the principle of network security situation awareness, and designs a network security situation prediction model compared with the evaluation model of artificial immunity based on artificial immunity and Kalman algorithm. Finally, the simulation is carried out. The results show that Kalman algorithm achieves the expected prediction effect. However, only one SYN-Flood attack analysis was selected for obtaining the security situation value in this experiment, while it were too limited for the factors considered, and was insufficient for the dynamic nature of prediction. These all will be the focus of the next step.