基于D-AHP与灰色理论的信息安全风险评估  

Information Security Risk Assessment Based on D-AHP and Grey Theory

作　　者：许硕 唐作其[1] 王鑫 XU Shuo;TANG Zuoqi;WANG Xin(College of Computer Science and Technology,Guizhou University,Guiyang 550025,China)

机构地区：[1]贵州大学计算机科学与技术学院

出　　处：《计算机工程》2019年第7期194-202,共9页Computer Engineering

基　　金：贵州省科技计划项目(黔科合平台人才[2018]5616);贵州大学青年教师科研基金项目(贵大青合字(2013)01号)

摘　　要：充分考虑评估信息不确定性对评估结果的影响,提出一种基于D数层次分析法(D-AHP)与灰色理论的信息安全风险评估方法。根据相关行业标准识别信息系统的资产、威胁、脆弱性及已有安全措施,构建评估指标体系并建立层次化结构模型。使用D-AHP方法求解各指标的影响权重,以解决评估信息不确定性问题。针对评估过程中信息资源不足的灰性特征,运用灰色理论求解灰色评价矩阵。在此基础上,对信息安全风险进行综合评估并直观显示评估结果。分析表明,该方法可利用不确定信息进行风险评估,为制定有针对性的风险管控策略提供参考。Fully considering the influence of uncertainty of evaluation information on evaluation results,an information security risk assessment method based on D-number Analytic Hierarchy Process(D-AHP) and grey theory is proposed.According to the relevant industry standards,the assets,threats,vulnerabilities and existing security measures of information system are identified,the evaluation index system is constructed,and the hierarchical structure model is established.The D-AHP method is used to calculate the influence weights of each index to solve the uncertainty problem of the evaluation information.In view of the grey characteristics of insufficient information resources in the evaluation process,the grey theory is used to solve the grey evaluation matrix.On this basis,the information security risk is assessed comprehensively and the assessment results are displayed intuitively.Analysis show that this method can use uncertain information for risk assessment and provide reference for formulating targeted risk management and control strategies.

关 键 词：信息安全风险评估 D数理论 D数层次分析法 灰色理论 模糊偏好关系 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]