基于FAHP的信息安全风险评估方法  

Risk Assessment Approach for Information Security Based on FAHP

作　　者：秦大力[1,2] 张利[3] 李吉慧[3] 

机构地区：[1]湖南大学机械与汽车工程学院,长沙410082 [2]湖南农业大学信息科学技术学院,长沙410128 [3]中国信息安全产品测评认证中心系统隐患研究实验室,北京100089

出　　处：《计算机工程》2009年第15期156-158,共3页Computer Engineering

基　　金：中国信息安全产品测评认证中心基金资助项目

摘　　要：提出基于模糊层次分析法的信息安全风险综合评估模型,从主观评测和工具检测两方面对各个风险因素分别评价其重要程度。利用模糊偏好法求出各个风险因素在系统风险评估中的优先级排序,给出目标系统在不同安全侧面上的量化风险,增强评估准确性。实例分析表明,该模型可方便地应用于信息安全风险评估,具有实用性。A model of risk assessment based on Fuzzy-AHP（FAHP） is introduced to the estimation of the information security. The important degree of each risk factor is judged in the aspects of the subjective assessment and tools inspection. By utilizing fuzzy preference programming method, the risk value of each factor is calculated. Next the quantitative risk degree of the target system is calculated, and the veracity of risk assessment is improved. The study case of the assets value shows that the model can be easily used to the risk assessment of the information security, and the results are in accord with the reality.

关 键 词：风险评估 模糊层次分析法 信息安全 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]