Security policy level joint modeling method based on consultative objective risk analysis system (CORAS)-Petri

Abstract

The invention relates to the field of network information security risk assessment and discloses a security policy level joint modeling method based on a consultative objective risk analysis system (CORAS)-Petri. Aimed at a vulnerable spot and defect of a CORAS framework and improving of the CORAS framework, and based on unified modeling language modeling, a Petri net describing network or information system dynamic behavior is introduced, a risk assessment method based on an analytic hierarchy process (AHP) and fuzzy comprehensive evaluation risk assessment method is introduced in a risk computing method of the CORAS framework to compute the risk, and the security policy level joint modeling method can not only reduce working amount of estimation and improves estimation efficiency, but also can refer to previous estimation conclusion, strengthens accuracy and effectiveness of estimation, and therefore improves acquaintance of information system security risk. People can take effectively security protection measures to ensure security of an information system.

Description

technical field [0001] The invention relates to the field of network information security risk assessment, in particular to a CORAS-Petri-based security policy hierarchical joint modeling method, which can effectively perform security risk assessment on information network systems. Background technique [0002] All countries in the world attach great importance to the issue of information security. In the mid-1980s, in order to meet the confidentiality needs of military computers, the US Department of Defense formulated the "trusted computer System Security Evaluation Criteria" (TCSEC), and later made a series of security explanations for network systems, databases, etc., forming the earliest principles of security information system architecture. So far, the United States has developed more than 100 safety systems that meet the requirements of TCSEC, but these systems still have limitations, and have not really reached the highest level of formal description and proof. In ...

AI Technical Summary

Problems solved by technology

[0005] In order to accurately predict the security risk of the information system, improve the lack of comprehensive protection of the traditional single security measurement technology, comprehensively evaluate t...

Images