一种基于风险传播的信息系统风险评估方法

An Information System Risk Assessment Method Based on Risk Propagation

传统信息系统的风险评估方法未考虑节点的状态变化和风险的传播方向,且评估结果的准确性受专家主观性的影响,对此,提出了一种基于风险传播的信息系统风险评估方法。首先,确定节点的初始状态转移概率矩阵,并根据攻击属性对矩阵进行修正,得到节点状态转移概率;其次,基于系统风险传播网络拓扑图和节点属性值计算节点在各方向的传播概率;然后,利用三参数区间数方法获取节点威胁事件的量化值;最后,根据风险评估方法计算各节点的风险值。实验结果表明,基于风险传播方法的评估流程更客观、合理,可提高信息系统风险评估的整体性和准确性。

Traditional information system risk assessment methods do not consider the state change of nodes and the direction of risk propagation,and the accuracy of the evaluation results is affected by the subjectivity of experts.To solve these problems,an information system risk assessment method based on risk propagation is proposed.First,the initial state transition probability matrix of the node is determined,and the node state transition probability is obtained by modifying the matrix according to the attack attributes.Then,the propagation probability of nodes in all directions is calculated based on the topology network and node attribute value.Next,the three-parameter interval number method is used to obtain the quantitative value of node threat events.Finally,the risk value of each node is calculated according to the risk assessment method.Experimental results show that the proposed methodis more objective and reasonable,and it improves the integrity and accuracy of the risk assessment of information systems.