In order to improve the defense ability of information security for APT attack

more and more attentions is put on the information network security situation awareness technology in order to realize the prediction and prevention of security events. This paper analyzes the necessity of studying the network security situation awareness technology. The architecture

methods and key algorithms in the existing domestic and overseas research works in this field are described in detail. Finally this paper summarizes the network security situation awareness technology and looks forward to its development trend.