Information system security risk assessment model based on combined evaluation method

Abstract

The invention relates to an information system security risk assessment model based on a combined assessment method. The model integrates the advantages of qualitative analysis and quantitative analysis, defines a reasonable index hierarchical structure and an algorithm flow and has a core idea of collecting current risk assessment methods into a method base. In assessment, data envelopment analysis (DEA) based on fuzzy comprehensive evaluation is firstly used to screen out a plurality of methods aiming at the highest performance value of an assessment system, and then the assessment results of the screened methods are combined according to fuzzy analytic hierarchy process (FAHP) to solve the problem of inconsistent result of assessment by a plurality of methods and achieve the goal of more scientific and reasonable assessment for information system risk grade.

Description

technical field [0001] The invention relates to an information system security risk assessment model, in particular to an information system security risk assessment model based on a combined assessment method. Background technique [0002] Information security risk assessment is a key link in strengthening the construction and management of information security assurance system. Information security risk assessment is the starting point and foundation of information security construction. solutions to many critical problems. [0003] After years of development, there are many existing risk assessment methods at home and abroad, and their common goal is to find out the risks and impacts faced by the organization's information system, as well as the gap between the current security level and the organization's security needs. However, the choice of assessment method will directly affect every link in the assessment process, and can even influence the final assessment result....

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide an information system security risk assessment model based on the combined assessment method, so as to solve the problem of inconsistency in the assessment conclusions of multiple methods, that is, when the same object with a certain attribute value is evaluated using a variety of different methods There are differences in the conclusions at the time, and it is difficult to obtain a consistent evaluation that is consistent with the objective reality

Finally, according to the weight of each method, the evaluation results of each method are combined to obtain a risk assessment report for the entire information system, so as to solve the problem of inconsistency in the evaluation conclusions of multiple methods, so as to achieve a more scientific and reasonable assessment of the information system. Purpose of Risk Level Assessment

Images