A Long and Short Term Network Security Situation Prediction Method Based on RSMHA

Currently, traditional network passive defense mechanisms like firewalls prove inadequate against the escalating sophistication of cyber threats. There is an urgent need for more advanced proactive defense strategies, such as network security situation prediction (NSSP). NSSP aims to predict the future development of network through historical and current data. Nevertheless, the majority of existing prediction approaches are capable of achieving either short-term or long-term prediction individually, yet there remains a need for enhancing prediction speed to meet the requirements for practical deployment. Therefore, This paper proposes an integrated long and short-term prediction method called RSMHA. This approach draws on Split-Attention Networks (ResNeSt) and Multi-Head Attention (MHA) to maximize feature extraction capabilities and comprehensively enhance both long-term and short-term prediction abilities. The methods chosen in RSMHA are highly efficient, allowing for a streamlined model structure and enhanced running speed. We evaluated RSMHA using both a real-world intrusion detection system (IDS) alert dataset and the UNSW-NB15 dataset. The experimental results demonstrate that, in comparison to other state-of-the-art methods, our RSMHA approach reduces the prediction error to a certain extent while maintaining a comparable prediction accuracy, and realizes a significant enhancement in prediction speed.