{'fraction_non_alphanumeric': 0.02811886943253651, 'fraction_numerical': 0.006975223425125336, 'mean_word_length': 4.984347826086957, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A Method of Network Security Risk Measurement Based on Improved D-S Evidence Theory

This paper applies Dempster-Shafer (D-S) evidence theory to network security measurement and assessment, which improved the accuracy of network security measurement results. The main contents include improving the composition rules to solve the paradox, establishing a security measurement model, and proving the rationality of the improved method by three Distributed Denial of Service (DDoS) attacks experiment. The results show that this method is more accurate in detecting traffic attacks.


Introduction
With the development of Internet technology, network security is facing new challenges. Network security risk measurement and assessment is an emerging technology, which can provide help to network security problems [1]. Among the evaluation methods, there are more studies on attack graph technology and Analytic Hierarchy Process (AHP). As an effective tool for complex decision-making problems, AHP can help decision makers to prioritize and make the best choice. This paper applies D-S evidence theory to network security measurement and assessment. First, this paper introduced two conflicts and solutions of D-S evidence synthesis; Then, basing on D-S evidence theory and the hierarchical security evaluation model [2], specific indicators data that can represent the real network environment was selected to establish a security measurement model. Finally, a network simulation environment was set up, DDoS attack experiments were conducted, and the corresponding indicators data was taken to calculate and verify the improved D-S evidence theory and corresponding security measurement models.

Related Research
Commonly used index-based network security assessment methods include AHP, Grey System Theory, Fuzzy Evaluation, D-S evidence theory, etc. Based on AHP, Wengang Wu et al. proposed a security risk assessment model combined with fuzzy comprehensive evaluation [3]. Wang H et al. constructed three evaluation indexes and solved large index and low efficiency problems of evaluation [4]. Based on Grey System Theory and fuzzy theory, some researchers proposed a combination-based model for network risk prediction [5]. Zouzhen Wan et al. proposed a security assessment model based on fuzzy theory to quantify the security assessment of industrial control network systems [6].  [7]. Based on the D-S evidence theory, [8] proposed an improved D-S evidence theory based on grey relational analysis and verified its effectiveness through experiments. The literatures [9] and [10] combined D-S evidence theory with rough sets and Compressed Sensing Error Back-Propagation (CS-BP) neural network, respectively, to conduct network situation assessment, and effectively reduced the intervention of human factors and improved the accuracy of the assessment. Combined with effective discount evidence sources and D-S theory, Lan L et al. proposed a conflict evidence synthesis method [11]. Wenjun Ma et al. made patching improvements to the D-S theory for Dempster composition rules [12]. The research methods and results used in the references are shown in Table 1: D-S evidence theory Improved composition rules Although AHP can simplify the abstract problems, the lack of certain objectivity, resulting in a certain degree of subjectivity in the measurement results. When researchers apply D-S evidence theory to the study of network situation assessment, they often choose information about vulnerability and threat as evidence, and do not select specific indicators data, which is not representative.

D-S Synthesis Rules
D-S evidence theory was a mathematical reasoning theory [13] .The core idea of D-S evidence theory is to make an evaluation decision on the uncertainty of network security by combining multiple types of evidence. Here are the synthetic rules for D-S evidence theory: For∀A ⊆ Θ, the finite mass function on the recognition frame Θ, the Dempster synthesis rule for m 1 , m 2 ..., m n is: K in above: In the above formula, K stands for normalization factor and 1-K represents the coefficient of conflict, which reflects the degree of conflict of evidence.

Paradox of Synthesis Rule
In D-S evidence theory, synthesizing highly conflicting evidence may invalidate its synthesis rules or produce results contrary to common sense. According to the research of domestic and foreign experts and scholars, paradox problems can be generally classified into the following three types: (1) The complete conflict paradox, as shown in Table 2.Among them, the evidence E 1 and E 2 are completely conflicting. Then the synthetic rule [13] in D-S evidence theory is invalid. Table 2. Complete conflict paradox Composition rule is invalid (2) 0-trust paradox, as shown in Table 3.Since the basic probability assignment value of evidence E 3 to proposition A 1 is 0, no matter how large A 1 is, the final composite result is always 0.Among them, the conflict coefficient 1−K is 0.98, so the final synthesized result is contrary to the facts. Table 3. 0-trust paradox (3) 1-Trust paradox, as shown in Table 4. Although the evidence E1and E2have a low basic probability distribution for proposition A2,but in the final synthesis result, proposition A2is true, and the conflict coefficient 1−K is 0.99 .Therefore, the result of the final synthesis is contrary to the facts.

Paradox Solution
Aiming at the paradox or conflict problem of D-S evidence theory, researchers mainly used two methods to solve the conflict problem: Improve the synthesis rule, improve the source of evidence. [14] and [15] respectively proposed an improved method for synthesis rules and evidence sources. The two methods are described in detail below.
(1) Improvements to synthesis rules: P(A) in above: is expressed as the credibility of the evidence, which is calculated based on the degree of conflict. As the conflict between two pieces of evidence increases, the credibility of the evidence decreases.
(2) Improvement of evidence source: First modify the basic probability distribution value according to the formula:  Among them, n is the number of propositions in the recognition frame, and 1/n is the average basic probability value, which is used as the minimum criterion for judging whether the evidence recognition result is credible. On this basis, the obtained basic probability value is normalized according to the following formula: It can be deduced through computational verification, both improved methods can effectively solve the three paradox problems, as shown in Tables 5, 6, and 7.Multiple fusion results show that using the improved method for data fusion can not only make the synthesis result more accurate, but also have a higher degree of credibility.

Model Design
In this chapter, we combined D-S evidence theory with the hierarchical security assessment model introduced in [2] to establish a security measurement model as shown in Figure 1, including the indicators layer, D-S evidence theory fusion evidence, host layer and network system layer.
The metric calculation flowchart of this model is shown in Figure 2:

Indicator Layer
The indicator layer is the indicators data that can reflect the occurrence of the attack when the host in the network system is under attack. You can choose different indicator data according to different attacks. For example, when a DDoS attack occurs, the indicators that can be collected include Central Processing Unit (CPU) utilization, disk utilization, Transmission Control Protocol (TCP) segments, Internet Protocol (IP) datagrams, User Datagram Protocol (UDP) datagrams, and the number of transmitted data packets. The indicator set of the second host is:

D-S Evidence Theory Fusion Evidence
The indicator data collected at the indicator layer is fused to obtain the measurement result value of the host layer. The specific fusion process is as follows: In this article, define the probability distribution function of each indicator for the first host, as follows: Where Index ij is the index j in the host i. Then, according to formula (2), the synthesis rule of hosti can be obtained, that is, the measurement value of host i , as follows: The above formulas (5) and (6) are the improvements to the synthesis rules in Chapter 3. The following are the improvements to the source of evidence: First improve the evidence according to (3): Then normalize it according to (4): Finally, calculate the metric of host i according to (1): Among them, 1 k ∏ ∏ 1 ,1 K is the normalization factor, and m is the number of propositions. The propositions in this section are network security and insecurity, so the value of m is 2.

Host Layer
This layer includes multiple hosts in a network system. Through the data fusion process of D-S evidence theory, the measurement results of each host in the network system can be obtained, laying a foundation for measuring the entire network system.

Network System Layer
The network system layer measures and assess the entire network system. The measurement value of the network system is a weighted calculation of the host measurement value and the host weight. The importance of the host depends on the type of service, the importance of the data, etc. This is still a dynamic, multi-variable, and relatively subjective issue. The measurement results of the network system are as follows: Where w i is the weight of the host i. Host weight is related to the type of service provided on the host. The importance of the service can be divided into three levels: high, medium, and low. The importance calculation formula of the host is as follows: Among them, K h ,K m and K l are quantitative scores of three important levels: high, medium, and low. N h ,N m and N l are three levels of service data on a certain host. The weight of host i is:

Experiment Scheme Design
In order to experimentally verify the feasibility of the proposed measurement and evaluation model in practical networks, this article designed and simulated a DDoS attack experiment. During the simulated attack, multiple significantly changed indicators can be collected, which can be used for dynamic network security measurement and assessment. The network topology diagram constructed in this experiment is shown in Figure 3. This attack experiment is to attack from the outside of the network system, and use the corresponding tools to collect and record the indicator data in preparation for the subsequent calculation of network security metrics. There are four attack hosts in this experiment, which launched the attack outside the network system. Host7 in the lower right sub-net in Figure3 is the target host, which has SSH service, Redis service, and Web service installed on it, and is attacked by four hosts outside the system.

Experiment Process
There were three attacks in this experiment, which totaled 3 hours and 18 minutes. The indicator collection time was 176 minutes, and a total of 176 sets of data were collected. Spotlight and Wireshark tools were used to collect indicators in the network at an interval of 1 minute. Collected indicators include CPU utilization, disk utilization, TCP segments, IP datagrams, UDP datagram, sand transmission packet transmission volume. The above indicators are selected for measurement.

Experiment Data
Seven indicators are selected, as shown in Table 8.
After the normalization process is completed, the processed data is substituted into the security measurement model for calculation, and the experiment results are shown below. The measurement results of the security measurement model proposed in this paper are compared with the measurement models using the traditional AHP method. The results are shown in Figures 4 and 5, which are the methods of improving the composition rule and the evidence source, respectively.

Experiment Results and Analysis
It can be seen from Figure 4 that the measurement result using the improved synthesis rule method has a measurement value of 0 most of the time and a small number results of 1, which is inaccurate and unreasonable. The result of improved source of evidence shows that attacks occurred in three time periods, which are consistent with the actual attack situation. Therefore, the use of improved methods of evidence sources is more accurate and advantageous. According to the experimental results, the hierarchical security measurement model proposed in this paper, after applying D-S theoretical evidence for data fusion, is also more reasonable and feasible than traditional AHP models, and more sensitive to data traffic (especially IP datagrams).This model has good availability for security measurement of traffic-type attacks in the network.

Conclusion
This article first briefly introduces the network security assessment method based on D-S evidence theory, and describes three paradoxical problems and two different improvement methods to solve them. Then, a new model of the measurement method is established, and calculation formulas for the measurement values of each host and the entire network system are given. Finally, a DDoS attack experiment was designed and simulated. The indicators data was collected and two improved D-S evidence theory methods were calculated to verify its rationality and feasibility of the security measurement model. Experimental results show that this method is suitable for the measurement of traffic-type attacks. Compared with the traditional method, this method selects specific indicators data that can represent the real network environment when measuring. It can measure traffic attacks more accurately. At the same time, human intervention factors are also reduced in the calculation process, which makes the results more objective.