结合灰色网络威胁分析的信息安全风险评估  

Information security risk assessment based on G-ANP

作　　者：赵刚[1] 吴天水[1] 

机构地区：[1]北京信息科技大学信息管理学院,北京100192

出　　处：《清华大学学报（自然科学版）》2013年第12期1761-1767,共7页Journal of Tsinghua University(Science and Technology)

基　　金：国家"十二五"科技支撑计划项目(2012BAH08B02);国家自然科学基金资助项目(61272513);北京市属高等学校高层次人才引进与培养三年行动计划资助项目(CIT&TCD201304117)

摘　　要：以加强风险评估威胁要素关联性分析、减少模糊判断的影响为目标,提出基于灰色网络、以威胁分析为核心的信息安全风险评估方法。该方法依据风险评估规范选取威胁指标,运用网络分析法求出各威胁指标的影响权重,结合灰色统计理论确定各指标的灰数及信息系统风险等级。实例表明:从风险评估流程入手、运用该方法实施风险评估,能够得出更为客观的风险等级,为组织建议更加有效的风险管理控制措施。该方法能够合理地反映风险要素相互依赖、相互影响的关系,在已有信息量有限的情况下、为制定有针对性的风险管理控制策略提供科学依据。This paper presents a gray network based information security risk assessment method that correlates threat factors and reduce the irr^pact of fuzzy judgments. The risk assessment specification uses the analytic network process to derive threat index weights which are combined with statistical theory for gray systems to produce a security risk rating. A practical simulation shows that the method produced more objective risk rating and provided scientific measures for the risk assessment. The interdependence and interaction relationship among risk elements were also performed which can be use for risk management and control strategies when the information is insufficient.

关 键 词：风险评估 威胁分析 网络分析法 灰色统计 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]