A security situation awareness method based on the change of network security attack and defense status

With the continuous development of cyber attack methods, traditional security situational awareness methods can no longer meet the needs of dynamic and complex network environments. This paper proposes a security situational awareness method based on changes in network security attack and defense status. By monitoring and analyzing attack behaviors and defensive measures in real-time within the network, it dynamically assesses the network security situation. Initially, this method establishes a multidimensional state change model, dividing attack and defense states into multiple layers such as attack source, attack target, and response measures. Subsequently, through data mining and machine learning techniques, it identifies correlations and change patterns between attack and defense states, enabling the prediction and early warning of potential threats. Experimental results demonstrate that this method exhibits significant advantages in enhancing situational awareness accuracy and response speed, providing more effective technical support for network security protection.