Fuzzy Risk Assessment Method for Airborne Network Security Based on AHP-TOPSIS

With the exponential increase in information security risks,ensuring the safety of aircraft heavily relies on the accurate performance of risk assessment.However,experts possess a limited understanding of fundamental security elements,such as assets,threats,and vulnerabilities,due to the confidentiality of airborne networks,resulting in cognitive uncertainty.Therefore,the Pythagorean fuzzy Analytic Hierarchy Process(AHP)Technique for Order Preference by Similarity to an Ideal Solution(TOPSIS)is proposed to address the expert cognitive uncertainty during information security risk assessment for airborne networks.First,Pythagorean fuzzy AHP is employed to construct an index system and quantify the pairwise comparison matrix for determining the index weights,which is used to solve the expert cognitive uncertainty in the process of evaluating the index system weight of airborne networks.Second,Pythagorean fuzzy the TOPSIS to an Ideal Solution is utilized to assess the risk prioritization of airborne networks using the Pythagorean fuzzy weighted distance measure,which is used to address the cognitive uncertainty in the evaluation process of various indicators in airborne network threat scenarios.Finally,a comparative analysis was conducted.The proposed method demonstrated the highest Kendall coordination coefficient of 0.952.This finding indicates superior consistency and confirms the efficacy of the method in addressing expert cognition during information security risk assessment for airborne networks.

A Fuzzy Set-Based Approach for Model-Based Internet-Banking System Security Risk Assessment

A fuzzy set-based evaluation approach is demonstrated to assess the security risks for internet-banking System. The Internet-banking system is semi-formally described using Unified Modeling Language （UML） to specify the behavior and state of the system on the base of analyzing the existing qualitative risk assessment methods. And a quantitative method based on fuzzy set is used to measure security risks of the system, A case study was performed on the WEB server of the Internet-banking System using fuzzy-set based assessment algorithm to quantitatively compute the security risk severity. The numeric result also provides a method to decide the most critical component which should amuse the system administrator enough attention to take the appropriate security measure or controls to alleviate the risk severity. The experiments show this method can be used to quantify the security properties for the Internet-banking System in practice.

Security Risk Assessment of Cyber Physical Power System Based on Rough Set and Gene Expression Programming

Risk assessment is essential for the safe and reliable operation of cyber physical power system. Traditional security risk assessment methods do not take integration of cyber system and physical system of power grid into account. In order to solve this problem, security risk assessment algorithm of cyber physical power system based on rough set and gene expression programming is proposed. Firstly, fast attribution reduction based on binary search algorithm is presented. Secondly, security risk assessment function for cyber physical power system is mined based on gene expression programming. Lastly, security risk levels of cyber physical power system are predicted and analyzed by the above function model. Experimental results show that security risk assessment function model based on the proposed algorithm has high efficiency of function mining, accuracy of security risk level prediction and strong practicality.

Risk assessment of water security in Haihe River Basin during drought periods based on D-S evidence theory

The weights of the drought risk index （DRI）, which linearly combines the reliability, resiliency, and vulnerability, are difficult to obtain due to complexities in water security during drought periods. Therefore, drought entropy was used to determine the weights of the three critical indices. Conventional simulation results regarding the risk load of water security during drought periods were often regarded as precise. However, neither the simulation process nor the DRI gives any consideration to uncertainties in drought events. Therefore, the Dempster-Shafer （D-S） evidence theory and the evidential reasoning algorithm were introduced, and the DRI values were calculated with consideration of uncertainties of the three indices. The drought entropy and evidential reasoning algorithm were used in a case study of the Haihe River Basin to assess water security risks during drought periods. The results of the new DRI values in two scenarios were compared and analyzed. It is shown that the values of the DRI in the D-S evidence algorithm increase slightly from the original results of Zhang et al. （2005）, and the results of risk assessment of water security during drought periods are reasonable according to the situation in the study area. This study can serve as a reference for further practical application and planning in the Haihe River Basin, and other relevant or similar studies.

Resource Allocation for Network Security Risk Assessment：A Non-Cooperative Differential Game Based Approach

In this paper, we propose a non-cooperative differential game theory based resource allocation approach for the network security risk assessment. For the risk assessment, the resource will be used for risk assess, including response cost and response negative cost. The whole assessment process is considered as a differential game for optimal resource control. The proposed scheme can be obtained through the Nash Equilibrium. It is proved that the game theory based algorithm is applicable and the optimal resource level can be achieved based on the proposed algorithm.

A Website Security Risk Assessment Method Based on the I-BAG Model

In order to protect the website and assess the security risk of website, a novel website security risk assessment method is proposed based on the improved Bayesian attack graph(I-BAG) model. First, the Improved Bayesian attack graph model is established, which takes attack benefits and threat factors into consideration. Compared with the existing attack graph models, it can better describe the website's security risk. Then, the improved Bayesian attack graph is constructed with optimized website attack graph, attack benefit nodes, threat factor nodes and the local conditional probability distribution of each node, which is calculated accordingly. Finally, website's attack probability and risk value are calculated on the level of nodes, hosts and the whole website separately. The experimental results demonstrate that the risk evaluating method based on I-BAG model proposed is a effective way for assessing the website security risk.

Cyber Resilience through Real-Time Threat Analysis in Information Security

This paper examines how cybersecurity is developing and how it relates to more conventional information security. Although information security and cyber security are sometimes used synonymously, this study contends that they are not the same. The concept of cyber security is explored, which goes beyond protecting information resources to include a wider variety of assets, including people [1]. Protecting information assets is the main goal of traditional information security, with consideration to the human element and how people fit into the security process. On the other hand, cyber security adds a new level of complexity, as people might unintentionally contribute to or become targets of cyberattacks. This aspect presents moral questions since it is becoming more widely accepted that society has a duty to protect weaker members of society, including children [1]. The study emphasizes how important cyber security is on a larger scale, with many countries creating plans and laws to counteract cyberattacks. Nevertheless, a lot of these sources frequently neglect to define the differences or the relationship between information security and cyber security [1]. The paper focus on differentiating between cybersecurity and information security on a larger scale. The study also highlights other areas of cybersecurity which includes defending people, social norms, and vital infrastructure from threats that arise from online in addition to information and technology protection. It contends that ethical issues and the human factor are becoming more and more important in protecting assets in the digital age, and that cyber security is a paradigm shift in this regard [1].

Assessing the Risk Situation of Network Security for Active Defense

The risk situation assessment and forecast technique of network security is a basic method of active defense techniques. In order to assess the risk of network security two methods were used to define the index of risk and forecast index in time series, they were analytical hierarchy process （AHP） and support vector regression （SVR）. The module framework applied the methods above was also discussed. Experiment results showed the forecast values were so close to actual values and so it proved the approach is correct.

Research on Assessment Model of Information System Security Based on Various Security Factors

With the rapid development of network technology, the meaning of layers and attributes in respect of information system security must be extended based on the understanding of the concept of information system security. The layering model (LM) of information system security and the five-attribute model (FAM) based on security factors were put forward to perfect the description and modeling of the information system security framework. An effective framework system of risk calculation and assessment was proposed, which is based on FAM.

A Study on Quantitative Methodology to Assess Cyber Security Risk of Smart Grid

This paper aims to identify and clarify the cyber security risks and their interaction with the power system in Smart Grid. The SCADA system and other communication networks interact with the power system on a real time basis, so it is important to understand the interaction between two layers to protect the power system from potential cyber threats. This paper has shown the risks of the open architecture SCADA in a quantitative method and proposed effective security measures through case studies.

Dependence-Induced Risk: Security Metrics and Their Measurement Framework

Despite the tremendous effort made by industry and academia,we are still searching for metrics that can characterize Cyberspace and system security risks. In this paper,we study the class of security risks that are inherent to the dependence structure in software with vulnerabilities and exhibit a "cascading" effect. We present a measurement framework for evaluating these metrics,and report a preliminary case study on evaluating the dependence-induced security risks in the Apache HTTP Server. The experiment results show that our framework can not only clearly analyze the root cause of the security risks but also quantitatively evaluate the attack consequence of the risks.

Development and Application of On-line Wind Power Risk Assessment System

Because of the large-scale integration of wind power,the dynamic characteristics of power system have many uncertain effects.Based on deterministic analysis methods,traditional on-line security assessment system cannot quantitatively estimate the actual operating conditions of the power system for only considering the most serious and credible accidents.Therefore,the risk theory is introduced into an on-line security assessment system and then an on-line risk assessment system for wind power is designed and implemented by combining with the dynamic security assessment system.Based on multiple data integration,the wind power disturbance probability is available and the security assessment of the power grid can obtain security indices in different aspects.The operating risk index is an expectation of severity,computed by summing up all the products of the result probability and its severity.Analysis results are reported to the dispatchers in on-line environment,while the comprehensive weak links are automatically provided to the power dispatching center.The risk assessment system in operation can verify the reasonableness of the system.

Towards an integrated risk analysis security framework according to a systematic analysis of existing proposals

The information society depends increasingly on risk assessment and management systems as means to adequately protect its key information assets.The availability of these systems is now vital for the protection and evolution of companies.However,several factors have led to an increasing need for more accurate risk analysis approaches.These are:the speed at which technologies evolve,their global impact and the growing requirement for companies to collaborate.Risk analysis processes must consequently adapt to these new circumstances and new technological paradigms.The objective of this paper is,therefore,to present the results of an exhaustive analysis of the techniques and methods offered by the scientific community with the aim of identifying their main weaknesses and providing a new risk assessment and management process.This analysis was carried out using the systematic review protocol and found that these proposals do not fully meet these new needs.The paper also presents a summary of MARISMA,the risk analysis and management framework designed by our research group.The basis of our framework is the main existing risk standards and proposals,and it seeks to address the weaknesses found in these proposals.MARISMA is in a process of continuous improvement,as is being applied by customers in several European and American countries.It consists of a risk data management module,a methodology for its systematic application and a tool that automates the process.

HASN:A Hierarchical Attack Surface Network for System Security Analysis

Attack surfaces, as one of the security models, can help people to analyse the security of systems in cyberspace, such as risk assessment by utilizing various security metrics or providing a cost-effective network hardening solution. Numerous attack surface models have been proposed in the past decade,but they are not appropriate for describing complex systems with heterogeneous components. To address this limitation, we propose to use a two-layer Hierarchical Attack Surface Network(HASN) that models the data interactions and resource distribution of the system in a component-oriented view. First, we formally define the HASN by extending the entry point and exit point framework. Second, in order to assess data input risk and output risk on the HASN, we propose two behaviour models and two simulation-based risk metrics. Last, we conduct experiments for three network systems. Our experimental results show that the proposed approach is applicable and effective.

Dynamic security risk assessment and optimization of power transmission system

The paper presents a practical dynamic security region (PDSR) based dynamic security risk assessment and optimization model for power transmission system. The cost of comprehensive security control and the influence of uncertainties of power injections are considered in the model of dynamic security risk assessment. The transient stability constraints and uncertainties of power injections can be considered easily by PDSR in form of hyper-box. A method to define and classify contingency set is presented, and a risk control optimization model is given which takes total dynamic insecurity risk as the objective function for a dominant con-tingency set. An optimal solution of dynamic insecurity risk is obtained by opti-mizing preventive and emergency control cost and contingency set decomposition. The effectiveness of this model has been proved by test results on the New Eng-land 10-genarator 39-bus system.

基于组合权重的混凝土梁火灾后的安全评估

对火灾后建(构)筑物进行安全风险评估提供系统的评价体系,可为后期加固方案的制定提供参考依据。文章从混凝土梁的材料参数、作用参数和几何参数等方面选取混凝土强度、混凝土表面颜色、最高温度、受火时间、混凝土裂缝和混凝土脱落6个评价指标,基于组合权重及模糊理论建立了火灾后混凝土梁安全风险评价模型,应用于火灾后某厂房的安全风险评价,并对比分析了规范评价结果。结果表明:运用所建模型评定的损伤等级与规范评定的损伤等级吻合度较高,验证了所建立评价体系的准确性和合理性。