Implementing a Security Operations Baseline Through Process Tree Modeling for Network Security Situational Awareness

Abstract

Network security situational awareness (NSSA) has become a critical requirement for modern cyber-infrastructures to promptly identify threats and dynamically mitigate risks. However, existing NSSA approaches often suffer from inaccurate behavioral baselines, high false positive rates, and inflexible defensive responses. To address these limitations, this paper proposes a novel NSSA framework based on process tree modeling and dynamic service-chain orchestration. Specifically, a process tree-based behavioral baseline is constructed to capture normal network operations with structural and temporal dependencies. An anomaly-detection pipeline is designed by integrating multi-source heterogeneous data and employing advanced feature selection techniques, including Statistical Process Embedding (SPE), PCA, and evolutionary strategies. Detected anomalies trigger a dynamic adjustment of the security service chain, leveraging NFV and SDN technologies to reconfigure virtual and physical security functions on demand. Extensive experiments using CICIDS2017 and real-world traces demonstrate the proposed framework’s effectiveness in accurately detecting anomalous activities, reducing false positives, and improving dynamic defensive responsiveness. The SPE-based feature selection significantly outperforms PCA and Basic Evolution in terms of true positive and false positive rates, while the dynamic service-chain mechanism ensures efficient resource utilization and rapid threat containment.