Table I gave the records reported by the sensors during
the 5 stages of the whole network attack process. According
with the security situation modeling, alert events generated
from various security sensors were simplified, filtered, fused
and correlated. The number of the warning events decreased
greatly from 64481 to 6164. At the same time, according to
the corelation rule, it converts many trivial attacks which
aimed at the victim host from Forged IP into a DDoS attack.
With calculation of the risk value, mark the nodes of the
experiment network with different colors. The nodes with
high risk were marked in red. Furthermore, with analysis of
the attack events, the path of the attack was marked, and the
current network security situation view is formed, as shown
in Figure 2.