基于灰色关联决策算法的信息系统风险评估研究

Research on information system risk assessment based on grey relational decision algorithm

为了解决信息系统在安全风险评估中面临的参数估值不确定性问题,文章引入灰色关联决策算法对信息系统参数评估值不确定性进行了分析,并将其划分为灰色参数值和缺失参数值,同时建立了信息系统风险评估指标体系,结合参数评估了实际情况并统计了历史数据资料。其中,缺失参数评估值需满足均匀分布、指数分布、正态分布三种情况,文章以对应先验预估填充原本缺失的参数评估值,在成功填充之后应用灰色关联决策算法对信息系统进行风险评估。经验证,此方法可以对参数值不确定问题进行妥善处理,从而降低评估主观的影响程度,方便对比不同信息系统的安全性,可在信息系统的风险评估中进行推广应用。

In order to address the uncertainty of parameter estimation faced by information systems in security risk assessment,this article introduces the grey relational decision-making algorithm to analyze the uncertainty of information system parameter evaluation values,and divides them into grey parameter values and missing parameter values.At the same time,an information system risk assessment index system is established,and the actual situation is evaluated based on parameters and historical data is statistically analyzed.Among them,the evaluation values of missing parameters need to meet three conditions:uniform distribution,exponential distribution,and normal distribution.The article fills in the original missing parameter evaluation values with corresponding prior estimates,and applies the grey correlation decision-making algorithm to risk assessment of the information system after successful filling.After verification,this method can properly handle the problem of uncertain parameter values,thereby reducing the subjective impact of evaluation and facilitating the comparison of the security of different information systems.It can be promoted and applied in risk assessment of information systems.