School of Criminal Justice, Shanghai University of Political Science and Law, Shanghai 201701, China.
Comput Intell Neurosci. 2022 Jul 8;2022:7512289. doi: 10.1155/2022/7512289. eCollection 2022.
Network security risk quantification involves both technical and management aspects. Risk quantification has great uncertainty and cannot be fully quantified. Therefore, the fully objective realization of network information security risk quantification is not yet mature. This paper analyzes and quantifies the network security risks caused by various threat sources through a network security risk quantification model based on the Bayesian algorithm. By combining expert knowledge, the conditional probability matrix under the inference rule of the Bayesian algorithm is clarified, and the subjective judgment information of experts on the damage degree of the target information system is synthesized into the prior information system of network security threat. The Bayesian algorithm is used to realize the observation node of objective assessment information and combining subjective security threat levels to achieve continuity and accumulation of security assessments. The error is about 3%, which has a very good effect on the quantification of network security risk.
网络安全风险量化涉及技术和管理两个方面。风险量化具有很大的不确定性,不能完全量化。因此,网络信息安全风险量化的完全客观实现尚不成熟。本文通过基于贝叶斯算法的网络安全风险量化模型,对各种威胁源造成的网络安全风险进行分析和量化。通过结合专家知识,阐明贝叶斯算法推理规则下的条件概率矩阵,并将专家对目标信息系统受损程度的主观判断信息综合到网络安全威胁的先验信息系统中。贝叶斯算法用于实现客观评估信息的观测节点,并结合主观安全威胁级别,实现安全评估的连续性和积累。误差约为 3%,对网络安全风险的量化具有非常好的效果。