Neural Networks in Vulnerability Assessment

Experiments

Experimental background

This system is mainly designed and developed on the platform of virtual resource environment provided by network shooting range. From the performance of platform compatibility considerations, in order to make the network range to provide users with the required test platform and realize the Metasploit adding auxiliary module Nmap, the function of the Nessus system mainly adopts the NS and Ruby script language, the NS script is established in order to realize the automation of network range experiment platform, and the Ruby language is in order to achieve the load based on the framework of Metasploit existing auxiliary module Nmap and Nessus. In the structure of the whole software transaction management system, it adopts the browser/front-end server (B/S) structure. B/S structure of management system is characteristic of this structure, which is one of the more popular software architectures; in this architecture, the processing of the user interface is implemented directly by the user and the browser, few major transaction logics are to handle the user and the front-end server implementation, the other major transaction logic processing is in the user and the server-side implementation, and it has the advantage that can well realize different people and from different time and place of user access.

The system is based on a set of system platform of real equipment, accurately determines the weapons and equipment evaluation and training, and completes the system platform, the file data layer and the combination of application service layer; the second is to build a high controllability, high availability, high reliability, system platform structure system; the system platform of network structure form domain includes the attack and defense domain and target domain. It includes six key function modules: hardware resource control, simulation and virtualization, operation control, detection and collection, evaluation and analysis, and network platform system display. The test process of network shooting range can be roughly divided into the following seven steps: determination of user needs, determination of experimental tasks, operational deployment, resource allocation, operational experiments, data collection and analysis and evaluation. All of the above are deeply explored by the system.

Experimental design

1. Determine the number of neurons in the input layer
   The input layer parameters of specific problems are used to determine the number of neurons in the input layer, and the number of evaluation indicators is generally used. The number of neurons in the input layer is a three-level index number of network vulnerability evaluation indexes; Table 1 shows that the degree of sensitivity involves 13 evaluation indexes, their coping capacity involves 15 evaluation index, so the sensitivity degree of BP neural network has 13 input neurons, and their coping capacity of BP neural network has 15 input neurons.
   
   
2. Determine the number of neurons in the output layer
   The number of neurons in the output layer is the evaluation result of network vulnerability, namely 1. The evaluation of computer network vulnerability is a process from qualitative to quantitative to qualitative. The simulation results of sample setting are shown in Table 2, while the simulation results without weight setting are shown in Table 3.
   
   
3. Number of hidden layer neurons
   In BP network, the selection of the number of hidden layer neurons is very important, which not only has a great impact on the performance of the established neural network model, but also is the direct cause of "overfitting" in training. However, there is no scientific and universal method to confirm it theoretically. At present, most formulas calculate the number of hidden layer neurons in the case of arbitrarily large number of training samples presented in most literature, and most of them are most unfavorable in the case that it is difficult to meet the general engineering practice and not suitable for use.
   
   
4. The learning rate affects the stability of the system learning process
   Large network learning rate may directly lead to the excessive weight correction of network weights and may even directly lead to the incomplete convergence of network weights due to the irregular jump of the minimum value beyond a certain weight error in the process of each correction. However, too small learning rate may lead to a relatively long learning time for weights, which can well ensure that weights converge to the minimum value of some error. If the learning rate is too small, it may lead to a slow rate of weight convergence, leading to a relatively long time for weight training. If the rate of weight learning is too high, it may directly lead to the instability of the system and may also cause the system to iterate violently. At the same time, the initial training needs to be effective network learning operation speed, later training may not be appropriate. Therefore, the general training tends to select a smaller network learning rate to ensure the stability and convergence (that is, the stability of the system) of the network learning system, usually between 0.01 and 0.8.

Table 1 Main parameters of BP neural network evaluation model

Table 3 Sample simulation results without set weights