信息系统脆弱性被利用概率计算方法

A computing approach of information system vulnerability's exploited probability

针对现有信息系统风险评估工作中对脆弱性的评估未考虑各脆弱性间的相关性,评估结果受到较多人为主观因素的影响,提出"被利用难易程度"和"被选择概率"两个指标将现有对脆弱性的"被利用难易程度"评价转换为更为科学的"被利用概率"评价,并用贝叶斯网络的正向推理计算脆弱性节点的累积"被选择概率"。通过理论和实验分析,与相关的研究成果相比,提出的脆弱性被利用概率计算方法更准确、合理。

The evaluation results are impacted by many subjective factors since the existing risk assessment for information systems does not take the correlation of vulnerabilities into account. By combining two assessment vectors, i.e. access complexity and chosen probability, we transfer the so called ＂accessed complexity＂ evaluation method into an ＂exploited probability＂ evaluation approach, and use Bayesian networks＇ forward inference to accumulation each of vulnerability＇s chosen probability. Theoretical and experimental analysis show that the proposed ＂exploited probability＂ evaluation method is more accurate and reasonable than associated existing research work.