基于三角模糊熵的信息安全风险评估研究  

Research on Information Security Risk Assessment Based on Triangular Fuzzy Entropy

作　　者：宋杰鲲[1] 张丽波[2] 

机构地区：[1]中国石油大学(华东)经济管理学院,山东青岛266580 [2]黑龙江大学信息管理学院,黑龙江哈尔滨150080

出　　处：《情报理论与实践》2013年第8期99-104,共6页Information Studies:Theory & Application

基　　金：教育部人文社会科学研究青年基金项目(项目编号:10YJC630207);山东省自然科学基金项目(项目编号:ZR2011GQ004);山东省高校人文社会科学研究计划项目(项目编号:J10WG94);中央高校基本科研业务费专项资金项目(项目编号:10CX04012B;11CX04034B);黑龙江大学第十届学生学术科技创新项目的研究成果

摘　　要：通过对甲企业整体业务运转流程进行分析,整合加工传统GB/T 20984—2007标准中5种资产类型,构建信息安全风险评估指标体系,在离差平方和最大原则下,综合运用三角模糊数及熵值法建立信息安全风险评估模型,对甲企业信息安全风险进行评估。研究证实,三角模糊熵法在评估企业信息安全风险时最大限度地减少了主观因素对评估结果的影响,该方法使指标量化结果更贴近实际,同时离差平方和最大原则的应用使评估对象多属性综合评价值尽可能分散,使评估结果更加清晰。Based on the analysis of the overall business operation process of an enterprise, this paper constructs an information security risk assessment index system by integrating and processing 5 types of assets of the traditional GB/T 20984--2007 stand- ard. Then by the principle of the maximum sum of deviation square, the paper makes a comprehensive use of the triangular fuzzy number and entropy method to construct an information security risk assessment model to assess the information security risk of the enterprise. The research proves that the triangular fuzzy entropy method reduces the influence of the subjective factors on the assess- ment results to the greatest extent when assessing the information security risk of the enterprise. The method makes the index quanti- fication results more close to reality, and the use of the principle of the maximum sum of deviation square makes the multiple attrib- ute comprehensive assessment value scattered as much as possible and makes the assessment results clearer.

关 键 词：信息安全 风险评估 三角模糊熵 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]