A Hierarchical of Security Situation Element Acquisition Mechanism in Wireless Sensor Network

In wireless sensor network, the processing ability of the sensor nodes is poor. And the security situational element acquisition is also a serious problem. Thus, this paper proposes a hierarchical framework of security situational elements acquisition mechanism. In this framework, support vector machine hyper sphere multi class algorithm is introduced as basic classifier. The method of attribute reduction uses non negative matrix factorization algorithm. The fuzzy classification algorithm used to initialize non negative matrix factorization, in order to avoid the local optimal which is caused by non negative matrix factorization random initialization. In the sink node classification rules and attribute reduction rules are formed by learning. The classification analyses respectively focus on the cluster head and sink node, which can reduce the requirement of the sensor node properties. Attribute reduction before the data transmission, which reduces communication consumption data transmission, improves the performance of classifiers. By simulation analysis, the scheme has preferably accuracy in the situation elements acquisiton, and smaller communication overhead in the process of information transmission.


INTRODUCTION
The security situation elements acquisition is to acquire the factors that poses a threat and makes influence on the network in a large number of network information, and carrie on the classification according to the relevant rules, finally, form the network security situation element.Network security situation element extraction is the foundation of network security situation awareness, and it is the base of evaluating and forecasting the status of network security.Based on WSN clustering topology and different processing capabilities of node, hierarchical security situation element acquisition mechanism is designed in this paper.The support vector machine hyper sphere multi class algorithm is selected as the classifier.Non negative matrix factorization algorithm is used to reduce attribute, which can reduce the amount of computation and improve the classification performance.Meanwhile, the fuzzy classification of the center of mass is used to initialize the non negative matrix factorization to reduce the defect of NMF of local optimum.

HIERARCHICAL SECURITY SITUATION ELEMENT ACQUISITION FRAMEWORK
According to the different node processing ability, we construct the hierarchical acquisition framework based on the sink nodes, cluster head and sensor nodes.In the acquisition architecture of the schema, the underlying sensor nodes are responsible for the local data acquisition task.The upper nodes are responsible for the data analyzing.Sink layer introduces elements of historical situation elements.Through training, the classification and attribute reducing rules are formatted.By this way, we can reduce the sensor node performance requirement as far as possible.Reducing the data's attribute before uploaded, which can reduce the storage space and the amount of communication.

THE SITUATION ELEMENTS ACQUISITION METHOD
As a attribute reducing method, NMF is chosen in this paper.NMF can potentially finding the structure and characteristics of data, which can realize feature extraction and dimensionality reduction.At the same time, using fuzzy clustering to initialize NMF can reduce the local minimization bring by random initialization.The base classifier uses support vector machine hyper sphere multi class.The historical situation element is used to train the attribute reduction module and classifier.

Attribute Reduction
Firstly, the sink node use fuzzy to de-classify the historical situation element.The centroid of the obtained classification is regarded as the NMF basis matrix W initialization, R is as the attribute dimension.
Assuming historical situation element set is is the membership matrix, and . W is representation of fuzzy weighted index.The update function of the degree of membership shows as follow.
as the objective function.
Set  as the iterative stopping condition.When D   , the iteration is stop.The cluster center is regarded as the NMF's based matrix initial value.
And then the historical situation elements attributes are reduced by the NMF.The core idea of non negative matrix is that a non negative matrix mn V  can be decomposed into non negative matrix Every column matrix in mn V  is projected by the corresponding row vector in the base matrix


.When and only when V WH  , the value is 0. In the objective function, for one terms of W and H , the objective function is a convex function.But for both terms, The objective function is not convex function.At the same time, the algorithm is initialized randomly.Both of two questions may cause the local optimal.
The process of non negative matrix factorization is to solve an optimization problem, as shown in the following formula.arg min ( , ) W and H are updated alternately until the objective function convergence.The iterative rule is as follows.
( ) Then we can reduce attribute of the data set , which is acquisitioned from the lower node.
That is is the generalized inverse matrix of mr W  .

Constructing Classifier
Classification function is (x) sgn( (x, x ) ) Hyper sphere core idea is introduced.The main idea is finding the smallest hyper sphere that contains data most in high dimensional space.The optimization problem is transformed to the following formula.
R is hyper sphere of radius.a is hyper sphere centre.Using Lagrange formula, the problem transforms into the following form.
, max ( , ) ( , ) Gauss function is 2 ( , ) exp( ) . Any data set point to the center of the distance is 2 2 ( ) ( ) The k samples are trained respectively, we get hyper sphere of radius R and centers a , we select the largest category classification function as the point corresponding to the category.The classifier is ( ) arg max ( ) 1,...,

THE SITUATION ELEMENTS ACQUISITION PROCESS
Assuming the historical situation element data set is , which is say n Historical situation element information.Step3: Updating the formula (4) ,( 5) and( 6 Step6: On the historical situation element matrix weight training support vector machine hyper sphere one ball multi classifier, get each class center a and the hyper sphere radius R ; Step7: We calculate the value of the distance 2 () dhfrom the records i X in the data set x H to the centre a of sphere.
Then we calculate the value of classification function

SIMULATION AND THE RESULT ANALYSIS
The

Simulation Experiment
In order to validate the feasibility of this project, this paper uses data set Data0 as historical situation information, data set Data1 as test data.The scheme compared with the SVM algorithm and attribute reduction using NMF before support vector machine hyper sphere multi classification(NMF+SVM-hsmc).From the above diagram, compared with using SVM classification algorithm directly, the overall acquisition accuracy of this program is higher than the former.In the situation of in different dimension of data attribute reduction.Above the results suggested, using NMF can improve the accuracy of data acquisition.Compared with the latter method, the scheme of situational element of the overall acquisition accuracy is higher than that of the former in most cases, which indicates that the NMF initialization can improve the overall accuracy.The initialization method can not only reduces the blindness of random initialization, but also reduces the effect of trapping in local optimum defects in NMF.As can be seen from the table, after optimization, most elements obtaining accuracy is improved.Especially when the dimension is 10,after the initialization for each kind of situation element extraction accuracy is significantly improved.Figure 4 indicates that accuracy of the two kinds of the schemes to acquire the small sample situation elements .The initialization of NMF is effective to obtain the small sample situation elements, and improves the small sample situation elements acquisition precision.
Experiment two is aimed to verify this scheme generalization.The data1 is selected to be the historical situation elements.Data4, separately on the Data4, Data5, Data6, Data7, Data8 test.
According to the first experiment result, the data attribute reduced to 10 dimensions by NMF.The experimental result is shown as follows.This experiment shows that the scheme by non negative matrix factorization of attribute reduction can improve the overall classifier for multi attribute safety factor to obtain accuracy and small sample class accuracy.

CONCLUSION
According to the structure and properties of WSN, the hierarchical situation element access schema is established.And the situation elements acquisition machine is designed.This methods using NMF as the attribute reduction, by using the fuzzy C mean for the initialization, it reduced deficiencies of the NMF, and improved the classification precision.According to KDD CUP99 data, obtained the satisfactory results, verify the validity situation acquisition model, and provides a way of thinking and new method for WSN the situation elements acquisition.But through the experiment we also see the effect of R on experimental results, determine how to better R value, but also the need for theory and experiment further analysis.
mr W  , and get the column vector elements in the coefficient matrix rn H  .The mn V  can be indicated by rn H  .This paper uses Frobenius minimize residual as the objective function.That is 2 , 11

d
is the security information.Step1: The historical situation element data is classified by the fuzzy c means.Updating the formula (1) and (2), we can get the center of mass Z and the number of categories r .Step2: To make 0 ,k=r W Z  .Decompose the data use NMF algorithm.
), we can get the basis matrix mr W  and weight matrix rn H  .Step4: To make the test data of the basis matrix

ihFigure3.
Figure3.Network security situation element extraction process Figure3.Different r values of network security situational elements acquisition accuracy

Figure4.
Figure4.Initialize effect on small sample situation elements acquire accuracy Table2.The influence of initialize on each kind of security situation element acquisition accuracyDimension Method Normal Probe Dos U2R R2L Figure5.r =10 The different data acquire accuracy

Hierarchical network security situation element extraction framework
UploadFigure1.
SVM algorithm is to find an optimal separating hyper plane, The objective minimization function are as follows.
paper uses the KDD CUP 99 correct data which is the 10% of the KDD CUP 99 data set.In WSN, the Flooding attacks can be classified to the Dos attack, such as black hole attack, wormhole attack and forgery response.The distortion of information is classified as a R2L type of attack.The internal attack is classified as U2R.The normal data is classified as Normal.Experimental data are shown in the following table.