WNN-Based Prediction of Security Situation Awareness for the Civil Aviation Network

3.1 Introduction of the ATM Network

The ATM network is the backbone network for civil aviation information transmission and sharing. It consists of aeronautical communication, navigation, surveillance, and automation subsystems, as shown in Figure 1.

Figure 1

ATM System Structure.

The ATM network is connected to the local authority by means of automatic message switching, packet switching, and satellite communications. It mainly covers all international and domestic routes, assumes the ATC message, aviation weather information, flight plan and dynamic message, integrated management, international data exchange, and other services. These data and information have a direct impact on the safety of civil aviation. The security information of the ATM network can guarantee business safety and its efficient operation.

The security of network equipment, operating systems, and application can affect the safety of the ATM. Network equipment include communications, navigation, meteorological, intelligence, and other network equipment. The operating system refers to the host and the server operating system that runs on the ATM network, and application refers to the various services available in the ATM network. The security of the ATM network is related to the safety of civil aviation. It is necessary to design appropriate information security measures in these areas, including data encryption, secure authentication, firewall, intrusion detection system, and redundancy backup.

To change the status quo that the civil aviation network security incident response lags behind, it is necessary to carry out measures for the network security situational awareness of the ATM and understand the dynamic changes in network security, in addition to taking passive safety measures. It is of great significance for improving the emergency response capabilities of the aviation network system, alleviating the hazards of network attacks and finding potentially malicious intrusions.

To predict the security situation value of the ATM, we can evaluate the security situation in each subsystem, analyze the services of the network, and evaluate the security measures taken in each subsystem. The security situation for the entire ATM network system is obtained from the security situation of the four subsystems in a comprehensive way, as shown in Figure 2.

Figure 2

Topology for Subnets of the ATM.

3.2 A Learning Method Based on the WNN

The topology of the WNN is similar to the BP network; however, the transfer function of the hidden layer is a wavelet basis function. The WNN topology [14, 19] is shown in Figure 3.

Figure 3

Topology of the WNN.

In Figure 3, X₁, X₂, …, X_k indicate the input of the WNN, and Y₁, Y₂, …, Y_m are the prediction outputs of the WNN.

When the input sequence is x_i(i = 1, 2, …, k), the output of the hidden layer is calculated by formula (1):

where h(j) denotes the output of the hidden layer, j indicates the number of hidden layer nodes, w_ij is the weight between the input layer and the hidden layer, b_j is the translation factor of the wavelet basis functions, a_j is the stretching factor of the wavelet basis function, and h_j is a wavelet basis function. Because the Morlet wavelet function has power-stable computing ability and strong anti-jamming capability, in this article, we apply the Morlet wavelet function as the basis function in the WNN. The expression is shown in formula (2):

The output of WNN is

In formula (3), w_ik is the weight between the hidden layer and the output layer, h(i) is the output of node i of the hidden layer, l is the number of nodes for the hidden layer, and _m is the number of nodes for the output layer.

Using a gradient correction method to adjust the weights of the WNN, concrete steps are performed as follows [6]:

• Computing the prediction error of neural network by using formula (4):

  (4)e = ∑k = 1myn(k) − y(k), (1)

  where, yn(k) is the expected result and y(k) is the prediction output of the WNN.

• Adjusting the weights and wavelet basis function coefficients of the WNN based on the prediction error by using the following equations:

  (5)wn, k(i + 1) = wn, ki + Δwn, k(i + 1), (5)

  (6)ak(i + 1) = aki + Δak(i + 1), (6)

  (7)bk(i + 1) = bki + Δbk(i + 1),

  where Δwn, k(i + 1), Δak(i + 1), and Δbk(i + 1) are calculated on the basis of the network prediction error:

  (8)Δwn, k(i + 1) = − η∂e∂wn, k(i), (8)

  (9)Δak(i + 1) = − η∂e∂ak(i), (9)

  (10)Δbk(i + 1) = − η∂e∂bk(i), (10)

  where η is the learning rate.

The training steps of the WNN are as follows:

• Initialize the network. Initialize the wavelet function dilation factor a_k; translation factor b_k; the network connection of the right weight w_ij, w_jk; and set the learning rate μ.

• Put the sample into the WNN. Use the input samples to train the network structure.

• Predict the output of the WNN. Train samples to the network, compute the network-predicted output, and calculate the error of the network output and the desired output e.

• Modify the weight. Adjust the weights and parameters of the wavelet function for the neural network on the basis of the prediction error, and make the predicted values of the network approach expectations.

• Determine whether the algorithm is ended; if it is not the end, return to (c).

3.3 Prediction Model of the ATM Network Security Situation

According to the theory of the WNN, we can use the historical security situation of the ATM network that is obtained from the assessment of the ATM to train the WNN, and then use the trained network to predict the value of the security situation in the coming period. The prediction model is shown in Figure 4.

Figure 4

Model of Time-Series Forecasting Based on the WNN.

In this model, the WNN has a single hidden layer structure; the input is the civil aviation network security situation value at the historical moment normalized using the trial method to determine the hidden layer. The output layer node is the one that indicates the situation value of the current moment.

4.1 Calculating the Trend Value

Weights and attacks to the four subnets are assumed under the same conditions, and the network’s security situation values can be calculated by using a series of mathematical methods. These values are able to demonstrate some of the characteristics of the network operating conditions. When the frequency of network security incidents and the level of threats are not the same, the network’s security situation values are different. The greater the value of the network security situation, the more unsafe the network would be.

In this article, ratio of weighted threats to weighted defenses solving security situation values for the network is used:

where F_SA(T_i, N_i) indicates the value of the network security situation, N_i is the number of times the attack occurred, T_i is the threat level corresponding to the attack of i, and DS_i is the defense capability of the system for those kinds of attacks. According to the statistics of the attacks, we use the statistical average value DS_i instead of the defense capability. Actually, 5-day data are used in the test. In this study, the data of the first 4 days are used as historical data to forecast the network security situation of the next 24 h, and the prediction span is 1 h. The data of the fifth day are used for comparison with the 24-h data predicted previously, and the prediction error can be minimized by the comparison. By using formula (18), the values of the network security situation in the first 4 days can be easily computed, as shown in Figure 6. The prediction starts from the zeroth hour and ends at the 96th hour.

Figure 6

Values of the Network Security Situation in the First 4 Days.

The formula of the network security situation shows that the network security situation has non-linear characteristics, and access to the network security situation can be considered as the processing of a time series. Hence, the WNN model is used to solve the non-linear problem.

4.2 Determination of the Model of the WNN

A single hidden layer network model is applied in this article. The input layer of the WNN has four nodes, indicating the network security situation of four time points before the current time point. The number of nodes of the hidden layer is 6, whereas that of the output layer is 1, which indicates that the network security situation will be forecasted. The number of nodes of the hidden layer has a great influence on the prediction of the WNN; when the number of nodes is too few, the network would display a bad learning experience and the number of training would increase. By changing the hidden nodes, the impact on predicting performance with different hidden nodes can be explored. In this experiment, the number of nodes of the hidden layer is 6. The initialization weights of the network are random parameters.

The number of training sets for the WNN is 100; the learning rates are lr1 = 0.01, lr2 = 0.001; and the target of error is 0.001. Then, the trained neural network is used to predict the network security situation of the next 24 h and analyze the forecasting result.

4.3 Prediction Based on the WNN and BP Neural Network

We apply the WNN model and the BP neural network model to predict the next 24 h trend value and compare the predictive performance of the two algorithms with the convergence rate, forecasting error, and regression.

4.3.1 Comparison of Error Convergence Speed

Applying the WNN and BP neural network to train the trend value, the number of training sets is 100. The training error curves are shown in Figures 7 and 8.

Figure 7

Training Curve of the WNN.

Figure 8

Training Curve of the BP Neural Network.

Because the WNN must adjust the translation factor and the dilation factor in addition to the network structure parameters and weights during the training, the convergence speed of the WNN is slower than that of the BP neural network. The training error of the BP neural network reaches 0.0311, compared with 0.0452 for the WNN. Therefore, the effect of learning samples based on the WNN is weaker than that based on the BP neural network.

4.3.2 Comparison of the Prediction of Results

The value of the network security situation is predicted by using the trained network. The predicted results are shown in Figures 9 and 10.

Figure 9

Prediction of the WNN.

Figure 10

Prediction of the BP Neural Network.

In the figures, “o” represents the actual value,“*” indicates the predicted value, and the bottom curve represents the prediction error. The corresponding numerical results are shown in Table 1.

Table 1

Numerical Results of Prediction.

Time point	Actual value	Predictive value of WNN	Predictive value of BP neural network	Absolute predictive error of WNN	Absolute predictive error of BP neural network
1	1.977	1.8238	1.8468	0.1532	0.1302
2	2.215	2.0116	1.9161	0.2034	0.2989
3	1.826	1.8077	1.8857	0.0183	0.0597
4	2.354	2.1013	2.0824	0.2527	0.2716
5	1.298	1.4113	1.4982	0.1133	0.2002
6	0.320	0.4188	0.5785	0.0988	0.2585
7	1.620	0.2501	0.2665	0.0881	0.1045
8	0.050	0.0864	0.0854	0.0814	0.0904
9	1.732	1.4384	1.3008	0.2936	0.4312
10	1.964	1.9469	1.7280	0.0171	0.2360
11	2.130	1.9929	2.1545	0.1371	0.0245
12	2.345	2.1622	2.2143	0.1828	0.1307
13	2.485	2.2132	2.2668	0.2718	0.2182
14	1.815	1.7718	1.9308	0.0432	0.1158
15	2.201	1.9437	1.8990	0.2573	0.3020
16	2.435	2.1303	2.0342	0.3047	0.4008
17	2.51	2.2443	2.3450	0.2657	0.1650
18	1.746	1.7100	1.8939	0.036	0.1479
19	1.956	1.7602	1.7596	0.1958	0.1964
20	2.103	1.9359	1.8184	0.1671	0.2846
21	2.304	2.1349	2.1814	0.1691	0.1226
22	2.314	2.1209	2.1757	0.1931	0.1383
23	1.965	1.8688	1.9719	0.0962	0.0069
24	2.153	1.9458	1.9220	0.2072	0.2310

According to the error curves in Figures 9 and 10, we can see that range of prediction error for the WNN is smaller than that of the BP neural network. The absolute forecasting errors in Table 1 show that prediction of most of the time points based on WNN is more accurate than that based on the BP neural network. Therefore, the learning ability and the generalization ability of the WNN are better than those of the BP neural network.

4.3.3 Analyzing the Regression Performance

To validate the performance of the WNN, this article adopts the plotstreg function as the prediction output of the WNN and BP neural network, targets the output non-linear regression, and then analyzes and compares the results. The correlation coefficient between the two indicates that the network approximation of the target data is the basis of the merits of the discriminant of the performance for the WNN prediction. The linear regression curves are shown in Figures 11 and 12.

Figure 11

Regression Performance of the WNN.

Figure 12

Regression Performance of the BP Neural Network.

In this article, we analyze the linear regression between the output vector of the neural network and the actual vector, and adopt the correlation coefficient between the target vector and the prediction as a sign of network performance evaluation. When network performance is in good condition and is achieved to a certain extent, the network-predicted output value should be equal to the actual output value, which means that the correlation coefficient is in the first quadrant of the axes on the diagonal. At this point, the intercept is equal to 0, slope is equal to 1, and the goodness of fit is equal to 1. In practical applications, a goodness of fit of >0.80 will be acceptable. From Figures 11 and 12, we can see that the correlation coefficient of the WNN is 0.99016, higher than the coefficient of 0.97584 of the BP neural network, which indicates that the capability of non-linear function approximation of the WNN is better than that of the BP neural network.

According to the prediction of the WNN and BP neural network, we can find the following:

1. The approximation capability of the WNN prediction method is better than that of the BPNN method where there are numerical mutations in the value.

2. Because the WNN must adjust the translation factor and the dilation factor in addition to the network structure parameters and weights during the training, the WNN has a problem in parameter selection and debugging; it cannot guarantee that each forecast result is convergent. If the initial value is set as unreasonable, the network easily gets into the local minimum area, resulting in oscillation increases and non-convergence of the network. In the next work, we can use the initial weights and thresholds to optimize the WNN to predict the network security situation.

A comparison of the proposed approach with classical techniques is shown in Table 2.

Table 2

Comparison of the Proposed Approach with Classic Techniques.

Method	Error precision	Training speed
BP	Low	Slow
RBF	Low	Fast
FNN	High	Faster
WNN	Higher	Fast

We can conclude that situation prediction based on the WNN is feasible and effective, through a series of experiments. The prediction is of high accuracy, and the error is very small. The WNN has non-linear capabilities, generalization ability, and fault tolerance. It can be used for the prediction of the actual security situational awareness in the civil aviation network.