基于属性综合评价系统的漏洞静态严重性评估  

Evaluation of vulnerability static severity based on attribute synthetic assessment system

作　　者：肖云[1] 彭进业[1] 王选宏[2] 

机构地区：[1]西北大学信息科学与技术学院,西安710127 [2]西安邮电学院通信工程系,西安710121

出　　处：《计算机应用》2010年第8期2139-2141,2150,共4页journal of Computer Applications

基　　金：国防基础科研项目(A322061163);陕西省教育厅自然科学专项(08JK449)

摘　　要：针对计算机安全漏洞的静态严重性评估问题,提出了一种基于属性综合评价系统的漏洞静态严重性分析方法。该方法从漏洞的基本属性中提取漏洞的威胁性、影响度、流行性和修补难易4个指标,运用属性综合评价系统理论评价其静态严重性,获得二元组表示的漏洞静态严重性,其中的定性表示值表示漏洞的静态严重性等级,定量表示值表示漏洞静态严重性分值。应用实例表明该方法对于漏洞静态严重性的评估是准确有效的。相比于现有的漏洞严重性分析方法,该方法兼备了定性和定量表示的优点,体现了同一级别之下不同漏洞的静态严重性的细微差别。To solve the problem of evaluating static severity of computer security vulnerability a method of evaluating vulnerability static severity based on the attribute synthetic assessment system was proposed.Four factors threat epidemic incidence and easy or hard repair were advanced from the basic attributes of vulnerability and the proposed method used the attribute synthetic assessment system to get a binary tuple denotation of vulnerability static severity of which qualitative denotation shows static severity rank and quantitative denotation shows static severity metirc.Application cases show that the proposed method is exact and effective.Compared with other existing methods the proposed method has merits of quantitative and qualitative denotation and embodies nuance of different vulnerabilities which are in the same quantitative static severity level.

关 键 词：漏洞 属性综合评判系统 静态严重性 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]