基于多维云模型和熵理论的机载娱乐系统安全风险评估  

Security risk assessment of airborne entertainment system based on multidimensional cloud model and entropy theory

作　　者：王静 漆书凡[3] 李国 WANG Jing;QI Shufan;LI Guo(College of Safety Science and Engineering,CAUC,Tianjin 300300,China;Information Security Evaluation Center,CAUC,Tianjin 300300,China;College of Computer Science and Technology,CAUC,Tianjin 300300,China)

机构地区：[1]中国民航大学安全科学与工程学院,天津300300 [2]中国民航大学信息安全测评中心,天津300300 [3]中国民航大学计算机科学与技术学院,天津300300

出　　处：《中国民航大学学报》2024年第6期9-16,共8页Journal of Civil Aviation University of China

基　　金：国家自然科学基金民航联合基金重点项目(U2033205,U2233214);中国民航大学信息安全测评中心开放基金资助项目(ISECCA-202006)。

摘　　要：针对现有机载娱乐系统风险评估方法存在一定的不确定性、随机性和模糊性,其评估指标也具有很强的主观性,导致评估结果不够准确和客观等问题,本文提出一种基于多维云模型和熵理论的机载娱乐系统风险评估方法。首先使用更为全面、细粒度和客观的系统漏洞作为评估指标,并基于该指标数据生成多维云模型图,直观展现不同风险的隶属度大小;然后结合安全事件发生的可能性及安全事件损失的可能性来计算整个核心组件的风险值,并与风险对照表进行比较得出整个系统的风险评估结果。多次实验结果表明,本文方法的评估结果具有更好的稳定性、准确性和客观性。In response to the certain uncertainty,randomness,and fuzziness of existing risk assessment methods of airborne entertainment system,as well as the strong subjectivity of their evaluation indicators,which leads to inaccurate and non-objective evaluation results,this paper proposes a risk assessment method of airborne entertainment system based on multidimensional cloud model and entropy theory.Firstly,more comprehensive,fine-grained,and objective system vulnerabilities are used as evaluation indicators,and based on this indicator data,a multidimensional cloud model graph is generated to visually display the membership degree of different risks.Then,the risk value of the entire core component is calculated based on the probability of security events occurring and the probability of security events losses.And compared with the risk comparison table,the risk assessment result of the entire system is obtained.Multiple experimental results have shown that the evaluation results of the proposed method in this paper have better stability,accuracy,and objectivity.

关 键 词：风险评估 云模型 熵权法 机载娱乐系统 

分 类 号：V243[航空宇航科学与技术—飞行器设计] TP39[自动化与计算机技术—计算机应用技术]