基于模糊集与熵权理论的信息系统安全风险评估研究

An Approach for Information Systems Security Risk Assessment on Fuzzy Set and Entropy-Weight

借助模糊集合理论,对信息系统所涉及的风险因素分别从资产影响、威胁频度、脆弱性严重程度三方面进行分析,并给出其等级描述;构造了各因素所对应评判集的隶属度矩阵,采用熵权系数法确定因素权重以减少传统权重确定方法的主观偏差;运用系统综合法集成三要素的安全风险值,进而判定信息系统安全风险等级.实例分析表明,该方法可行有效.

The risk factors of information systems are classified into three aspects of influence on asset,frequency of threat and severity extent of survivabulity,which are analysed based on the fuzzy set theory to describe their fuzzy-valued grades.And their membership matrices for judgement set are presented.Then the weights of the risk factors are calculated with the entropy theory to reduce the subjectivity.The approach of comprehensive eveluation is applied into integrating the respective risk assessment results of such three factors to obtain the final risk grade.Finally,an illustrative example is shown that this proposed method is effective and reliability.