Aiming at the information acquisition issues in network security situational awareness

a specific service-oriented security sensor technology was proposed

service security data were classified based on service index requirement

and detailed scheme of this security sensor was put forward.Data of flow

performance and configuration were collected and analyzed to generate network security events in the form of multi-tuple

and temporal correlation analysis was used in analyzing these events in order to reflect the variations of service availability and its performance.Case validation of DNS service data acquisition and analysis showed that this security sensor could handle the security data from specific service and reflect its situational variations well and truly.This sensor technology was also proved to be better feasibility and practicability.