信息安全技术投资的自适应模型  

Adaptive model of information security technique investment

作　　者：董红[1] 邱菀华[1] 吕俊杰[1] 张雯[2] 

机构地区：[1]北京航空航天大学经济管理学院,北京100083 [2]西北工业大学计算机学院,西安710072

出　　处：《控制与决策》2008年第5期535-540,共6页Control and Decision

基　　金：国家自然科学基金项目(70372011);高校博士点专项科研基金项目(20030006009)

摘　　要：根据攻防双方信息不对称现象,结合不完全信息博弈论及信息安全的有关理论,构建一个基于成本-收益的信息安全技术选择的投资博弈模型,得出在两种不同的安全技术配置下(仅使用防火墙或防火墙与入侵检测系统共用)博弈双方的最优策略.通过对用户攻击率、系统响应率和入侵给系统带来的损失及系统的响应成本进行分析比较,探讨了安全技术的价值,从而给出能动态调整安全技术的自适应入侵响应策略.最后通过实例进一步验证了相关结论.Focusing on the asymmetric information between attacker and defender, by applying the methodologies of game theory with incomplete information and network security, a game model of information security technique selections based on cost-benefit is constructed. The study shows the optimal strategies for the players in the deployment of two kinds of security techniques （only deploy firewall or both deploy firewall and intrusion detection systems（IDSs））. Then, by analyzing and comparing with hacking probability, investigation rate, the damage and response cost, the value of security techniques in an organization＇s IT security architecture is assessed, and thus an adaptive intrusion response strategy is made. Finally, the relative conclusion is illustrated further by an example.

关 键 词：信息安全 不完全信息博弈 防火墙 入侵检测系统 成本效益 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]