Abstract: In the process of network operation, it is easy to be invaded by external abnormal data or virus, which leads to network collapse or even failure to operate normally. Therefore, a network security operation platform based on multi-source heterogeneous sensors is designed. Firstly, the DS / AHP ( Dempster-Shafer/ Analytic Hierarchy Process) method is improved by combining rules of DS(Dempster/ Shafer)evidence demonstration, to fuse the security data submitted by multi-source heterogeneous sensors. Finally, through centralized log management, threat analysis, control analysis of security assets, asset identification management, attack traceability analysis, function analysis of threat intelligence and work order, intelligence driven security operation analysis, intrusion alarm can be realized and the source of intrusion can be traced to complete the design. The experimental results show that the platform can identify the intrusion data, trace the source of the intrusion successfully, and effectively ensure the security of the platform operation.

Key words: multi source heterogeneous sensor, network security, operation platform design, dempster/ shafer(DS) evidence, attack traceability analysis