Abstract:Aiming at the weakness of being unable to evaluate the threat of combination of vulnerabilities on network security for most systems of security evaluation, a novel model of security evaluation based on rough set theory was put forward. This model considered the vulnerability as a security factor and the security evaluation model was built from historical evaluation records by using attribute reduction. Further, the measurement model of hierarchical security risk with three levels: security factor, service and host computer, was built, which calculated the security risk of the host by weighting the importance of service and security factor, then the security situation of the system was analyzed and evaluated. Compared with other evaluation methods, this method can create a rule-based model of security evaluation automatically and has advantage of evaluating threat of isolated security factor and combination of security factors on the same host. It can also monitor the impact of changes of the system configuration on system security. Nine useful rules for security evaluation were discovered from 7 days' evaluation records and security situation curves were established through simulation experiment, which shows that evaluation results by our method are more accurate and intuitive than others.

An Information Security Evaluation Method Based on Rough Set

Approach to Security Evaluation Based on Rough Set Theory for Host Computer

An Object-Oriented Method for Information System Security Evaluation

Research on Information Security Model and Security System Design

A Security Risk Evaluation Model for IT System and Its Application on Railway Passenger Ticket System

RESEARCH AND IMPLEMENTATION OF MODEL OF INFORMATION SECURITY EVALUATION

The Comprehensive Evaluation Method for Organizing Information Security Risk based on Fuzzy Multi-criteria Fusion

A Fuzzy Set-Based Approach for Model-Based Internet-banking System Security Risk Assessment

A Real Time Information Security Risk Assessment Method

An Information System Security Evaluation Method Based on FCME Model

Research on Risk Assessment of Engineering Based on Rough Sets Theory

Research of Information System Security Evaluation

New Security Model of Information Network System and Mathematical Evaluation

Synthetic security assessment based on variable consistency dominance-based rough set approach

Variable Consistency Dominance-based Rough Set Approach to Security Assessment of Preference Information System

Study on Evaluation Method of Information System in Enterprise Based on CSF

Study of Security Metrics of Software System for Comparative Evaluation

Introduction and Advancement of Information System Security Evaluation Criteria and Technology

Quantitative Evaluation Technology of Computer System Security Based on Probability and Statistics

Application of the Grey Fuzzy Theory in Evaluation of Informationization Risk

A Business Process-based Method on Security Requirement Analysis of Information Systems