一种面向多对象的网络系统安全风险评估方法  

A Method for Multi-objects Oriented Networks Information Systems Security Risk Assessment

作　　者：付钰[1] 吴晓平[1] 叶清[1] 

机构地区：[1]海军工程大学信息安全系,武汉430033

出　　处：《武汉理工大学学报（交通科学与工程版）》2011年第5期1031-1034,1039,共5页Journal of Wuhan University of Technology（Transportation Science & Engineering）

基　　金：国家自然科学基金项目资助(批准号:60774029)

摘　　要：针对传统多对象评估问题中单个对象逐一评估的缺陷,提出了一种基于评估对象和评估基准之间广义权距离的面向多对象的信息系统安全风险评估方法.在充分分析网络信息系统安全性因素的基础上,建立了系统安全风险评估模型,并对资产、威胁性及脆弱性指标进行了标准化赋值;通过构造问题的拉格朗日函数,求解系统的安全状态矩阵,进而确定系统所处的安全风险等级.算例分析表明,该方法合理有效.Network information systems involve some sub-systems.In order to solve the problem of assessment in multi-objects systems,an approach for the information systems security risk assessment based on the generalized weight-distance is proposed.After systematic analysis of security factors of network information systems,a model for the security risk assessment is established,and the indexes about assets,threat,and vulnerability are standardizing evaluated.Then by constructing Lagrange function,security states matrix is calculated.Hence,the risk grade of the systems is determined.Finally,an illustrative instance is given to demonstrate its rationality and feasibility.Thus it may provide a new way for assessing multi-objects systems security.

关 键 词：多对象 网络信息系统 风险评估 广义权距离 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]