网络信息系统漏洞可利用性量化评估研究  

Quantitative evaluation of vulnerability exploitability in network information systems

作　　者：杨宏宇[1] 朱丹[1] 谢丽霞[1] 

机构地区：[1]中国民航大学计算机科学与技术学院,天津300300

出　　处：《清华大学学报（自然科学版）》2009年第S2期2157-2163,共7页Journal of Tsinghua University(Science and Technology)

基　　金：国家自然科学基金资助项目(60776807);国家"八六三"高技术项目(2006AA12A106);天津市科技支撑计划重点项目(07ZCKFGX01700);中国民航科技基金项目(RKXZY0814);中央高校基本科研业务费中国民航大学专项项目(ZXH2009A006)

摘　　要：为解决网络环境下的信息系统漏洞安全评估和分析难题,提出了一种获取漏洞可利用性量化值的评估模型。根据系统漏洞的可利用性影响因素分析结果建立一种漏洞可利用性评估指标体系,采用层次分析法获得各评估指标的权重,运用灰色评估方法对漏洞可利用性影响因素进行量化处理,通过综合分析和计算得到漏洞可利用性的量化值。运用该模型对典型系统漏洞进行评估实验,得到每个漏洞从0到10的可利用性量化值和从极低到极高的严重等级。实验结果表明该模型能有效评估系统漏洞的可利用性量化值和严重程度。An evaluation model was developed to quantitative evaluate vulnerability exploitability to improve system security evaluations in network environment.A vulnerability exploitability evaluation index system was developed based on an analysis of factors in fluency system vulnerability.The factor weights were obtained using the analytical hierarchy process,and the factors were quantified using the grey evaluation method.The overall vulnerability exploitability was then obtained by combining the effects of the various factors.Vulnerabilities in a typical system were evaluated with exploitability values from 0 to 10 and severity degrees from extremely low to extremely high for each vulnerability.Tests demonstrate that the model can accurately identifies the exploitability and severity of system vulnerabilities.

关 键 词：安全评估 信息系统 漏洞 层次分析法 灰色评估方法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]