Vulnerability Assessment Method of Information System Based on Analytic Hierarchy Process

LIU Bao-Li,XIAO Xiao-Chun,ZHANG Gen-Du

DOI: https://doi.org/10.3969/j.issn.1002-137X.2006.12.016

2006-01-01

Computer Science

Abstract:Vulnerability assessment is an important aspect of information system security risk assessment process. Combined with AHP(Analytic Hierarchy Process), we provide a quantitative vulnerability assessment method of information system.

What problem does this paper attempt to address?

Vulnerability Threat Assessment Based on AHP and Fuzzy Comprehensive Evaluation

Jiao Yue,Ke Zhang

DOI: https://doi.org/10.1109/iscid.2014.231

2014-01-01

Abstract:The paper starts with the study of present methods for evaluation of Vulnerability Threat. It puts forward a new classification method to make up the insufficiency of key elements of assessment. It establish the index system by considering the aspects of time, environment and attack damages and so on. It proposes an assessment method based on Analytic Hierarchy Process (AHP) and fuzzy comprehensive evaluation, obtaining the factor weights by AHP, and quantifying the vulnerability based on the fuzzy comprehensive evaluation. At the end, it gives a practical example to prove that this method can be applied very well for vulnerability harm assessment.
Research on Network Security Situation Assessment and Quantification Method Based on Analytic Hierarchy Process

Huan Wang,Zhanfang Chen,Xin Feng,Xiaoqiang Di,Dan Liu,Jianping Zhao,Xin Sui

DOI: https://doi.org/10.1007/s11277-017-5202-3

IF: 2.017

2018-01-03

Wireless Personal Communications

Abstract:In hierarchical network security situation assessment model, there are many problems, such as subjective index weight factor, large evaluation index system, large amount of calculation and low efficiency. A network security situation assessment model and quantification method based on AHP is proposed to solve this problem. The AHP analytic hierarchy process (AHP) is combined with the hierarchical model of situation assessment to simplify the situation assessment problem. The D–S evidence theory is used to fuse the fuzzy results of multi-source equipment to solve the problem of single information source and large deviation of accuracy. Through the construction of three evaluation indexes of risk situation, basic operation situation and damage situation, the problem of large evaluation index system and low evaluation efficiency is solved. AHP analytic hierarchy process is used to determine the weights of different index items, so as to avoid the subjectivity and randomness of weighting factors. The simulation results show that the model can reflect the security status of the network as a whole, and the situation assessment is accurate and can better serve the high-level decision-making.

telecommunications
Study on information system risk assessment method

WANG Wei,LI Chun-ping,LI Jian-bin

DOI: https://doi.org/10.16208/j.issn1000-7024.2007.14.060

2007-01-01

Abstract:Safe field in the information,the risk assessment is foundation and premises that builds up the safe system of the information system,but the risk assessment method rises to the usefulness of the assessment prominent function.The risk assessment method contain a lot of kinds,each method have it the place of the shortage.The risk assessment method adopted threat tree model and analytical hierarchy process that method combine together,made use of two kinds of vantages that assessment method,made up the shortage of the one risk assessment method,the aim is search into a kind of more valid,more reasonable and more accurate risk assessment method.
RISK-BASED VULNERABILITY ASSESSMENT IN COMPLEX POWER SYSTEMS

CHEN Wei-hua,JIANG Quan-yuan,CAO Yi-jia,HAN Zhen-xiang

DOI: https://doi.org/10.3321/j.issn:1000-3673.2005.04.004

2005-01-01

Abstract:Based on probability theory the risk theory was applied to the vulnerability assessment of power system. Here, the power system was defined as a vulnerable system and a set of risk indices to assess the power system vulnerability and corresponding algorithm were built, thus the defects of traditional determinsistic security assessment method, which cannot satisfy the requirement of electricity market and complicated power grid, could be overcome. On this basis, a risk theory and risk indices based power system vulnerability assessment software was developed. Taking the New England test system for example, the effectiveness and advanced property of the presented method were proved.
Risk Assessment of Power Monitoring System Based on Fuzzy Analytical Hierarchy Process

Huifeng Li,Tiecheng Li,Qigui Yao,Weixun Li,Libo Yang,Guanghui Sun

DOI: https://doi.org/10.1088/1742-6596/2137/1/012023

2021-01-01

Journal of Physics Conference Series

Abstract:The security threat of power monitoring system is increasing, it is valuable to carry out effective risk assessment, which helps to find the security threats of the system in time, then carry out security management and avoid disasters. This paper presents a risk assessment method of power monitoring system based on Fuzzy Analytic Hierarchy Process (FAHP) and CVSS. Firstly, Considering the structure and security requirements of power monitoring system, the analytic hierarchy process (AHP) model is established, and CVSS is used to quantify the evaluation indicators. Then, the fuzzy consistent judgment matrix is constructed by using the results of index quantification by using AHP and fuzzy comprehensive evaluation theory, and the power monitoring system is comprehensively evaluated from the bottom to the top. Finally, the risk evaluation value and safety level of the system are obtained. The example shows that the method can effectively overcome the difficulty of AHP in checking the consistency of judgment matrix, and can effectively quantify the system risk, and provide reference and basis for risk management decision-making of power monitoring system.
A Hybrid ANP-DEA Approach for Vulnerability Assessment in Water Supply System

C. Zhang,X. Liu

DOI: https://doi.org/10.1007/978-981-4451-98-7_164

2013-01-01

Abstract:Vulnerability reflects the potential of disrupting the whole system to some extent when the system is exposed to hazard. One of the most important issues of the indicator-based vulnerability assessment problem is to determine the weights of vulnerability indicators, especially when they are correlated with each other in multiple dimensions (i.e., physical, functional and organizational). In this paper, a framework for assessing vulnerability of critical infrastructure system is identified and applied to the evaluation in a water supply system. A complete critical infrastructure system vulnerability index is developed, which contains dimensions of “protection and defense”, “quick response after disaster”, “maintenance and recovery capacity” and “possible damage to system”. A quantitative method, integrating analytic network process (ANP) and game cross-efficiency data envelopment analysis (DEA) model, is proposed to analyze the vulnerability of interdependent infrastructures. Finally, the assessed vulnerability level of each infrastructure in water supply system is graded into four classes.
An Approach for Quantitative Assessment of Interoperability of Information Systems

Huabing HAN,Fande YANG,Guang CHEN,Xiaoying BAI

DOI: https://doi.org/10.3783/j.issn.2095-3828.2014.02.027

2014-01-01

Abstract:The paper proposes quantitative approach for evaluating the interoperability of infor-mation systems based on analytic hierarchical process (AHP) and analytic network process (ANP) methods .It uses levels of information systems interoperability (LISI) standard to construct a hierar-chical interoperability model including four levels of goals ,attributes ,sub-level ,and indexes .It cal-culates the weights at two levels of sub-level and indexes following AHP ,and the comprehensive weights following ANP .A case study is exercised to illustrate the proposed approach .
Risk Based Vulnerability Assessment for Hvdc Transmission System

Chen Weihua,Jiang Quanyuan,Cao Yijia

DOI: https://doi.org/10.1109/ipec.2005.207004

2005-01-01

Abstract:With the increasing utilization of HVDC system, security assessment of HVDC system has become a hot topic. This paper presents a novel approach using the framework of vulnerability to assess HVDC system security. First, equivalent models of HVDC systems, based on Markov model and logical diagram, are built to solve "dimension disaster" problem. Second, the risk index is used as an indicator of the level of security, and its sensitivity to a changing system parameter is used as an indicator of its trend. These two indicators are combined to determine the degree of HVDC system vulnerability to contingent disturbances. Finally, artificial neural network (ANN) is applied to the fast pattern recognition and classification of system vulnerability status. A case of Gezhouba-Shanghai HVDC system in China is presented to verify correctness and effectiveness of the approach.
Vulnerability Assessment on WAMS Communication System Based on Attack Tree Model

张恺伦,江全元

2013-01-01

Abstract:With the promotion and application of wide area measurement systems (WAMS) in power system, the security of its communication system is attracting a growing body of research. To analyze the vulnerability of WAMS communication infrastructures when facing network intrusions, an assessing method of vulnerability based on attack tree model is proposed. First, the attack tree model of WAMS communication system is established, which directly reflects the intrusion scenarios when the system is maliciously attacked. Second, a more reasonable assessing method for the vulnerability of passwords and ports is proposed, as well as the vulnerability of the system with all scenarios taken into consideration. Finally, the paper puts forth the concept of vulnerability sensitivity, which can quantitatively evaluate the effect of changes in the leaf vulnerability on the system, so as to find out the critical port.
Application of Analytical Hierarchy Process in Hazard Degree Assessment of Major Hazard Installations

ZHANG Ming-guang,JIANG Jun-cheng

DOI: https://doi.org/10.3969/j.issn.1671-7627.2006.02.008

2006-01-01

Abstract:Several assessment methods of major hazard installations were introduced.Based on analytical hierarchy process(AHP),this paper established the hierarchy structure of assessment factors about major hazard installations,and built the pairing comparison matrix.Taking characteristic vectors of the matrices as the weights of assessment,the influence order of the factors was determined.Assessment index system of hazard degree for major hazard installations was set up.A new method of assessment for major hazard installations to support the classification and management of major hazard installations was proposed.This method was applied to a practical case.
Hierarchical algorithm for cyberspace situational awareness based on analytic hierarchy process

Wei Hu,Jianhua Li,Xinghao Jiang,Yueguo Zhang,Xiuzhen Chen

2007-01-01

Abstract:The existing network security management systems are unable either to provide users with useful security situation and risk assessment, or to aid administrators to make right and timely decisions based on the current state of network. These disadvantages always put the whole network security management at high risk. This paper establishes a simulation environment, captures the alerts as the experimental data and adopts statistical analysis to seek the vulnerabilities of the services provided by the hosts in the network. According to the factors of the network, the paper introduces the two concepts: Situational Meta and Situational Weight to depict the total security situation. A novel hierarchical algorithm based on analytic hierarchy process (AHP) is proposed to analyze the hierarchy of network and confirm the weighting coefficients. The algorithm can be utilized for modeling security situation, and determining its mathematical expression. Coupled with the statistical results, this paper simulates the security situational trends. Finally, the analysis of the simulation results proves the algorithm efficient and applicable, and provides us with an academic foundation for the implementation in the security situation.
A Real Time Information Security Risk Assessment Method

Shi Jian,Guo Shanqing,Xie Li

DOI: https://doi.org/10.3321/j.issn:1002-8331.2006.01.034

2006-01-01

Abstract:Risk assessment is critical to establishing an effective Information Security Management System and it is the foundation of information system security systematism.After introducing information security risk assessment briefly,this paper provides a real-time risk assessment method using qualitative and quantitative assessment synthetically.By analyzing the assets,vulnerabilities and threats of information system,this method can evaluate the risk of the system in real time with the events produced by security devices.
Evaluation Index System of Bank Network Security based on Analytic Hierarchy Process

Jiu XU,Qiang ZHANG,Zhang-fan LU,Zhi XUE,Yong SHI

DOI: https://doi.org/10.3969/j.issn.1002-0802.2018.01.039

2018-01-01

Abstract:With advent of the Internet+ era, internet financial security attracts more and more attention. Based on the current research status of financial network security, including the characteristics and truth of domestic banks, the evaluation index system of bank network security is constructed. The system includes three first-level indicators of threat-event management, vulnerability management and intelligence management, and down to 12 secondary-level indicators. In terms of index quantification, the system uses analytic hierarchy process (AHP) to determine the weight of the indicators at all levels relative to the higher level, while the judgment matrix is determined by expert method. After the consistency check, the comprehensive weight of the index is calculated, and the system model of security evaluation index system for bank network system is finally acquired.
A Quantitative Risk Assessment Approach for Host System Security

Zhang Yongzheng,FANG Binxing,YUN Xiaochun

DOI: https://doi.org/10.3969/j.issn.1000-3428.2005.14.053

2005-01-01

Abstract:With increasing security problems of information technology, developers of information security products seek for the trusted security assessment by the third part. But there are some defects in present assessment methods for host software systems. This paper proposes a quantitative risk assessment approach for host system security, combining with the vulnerability information in software system. An assessment instance is given to analyze the assessment algorithm. Finally, this paper illuminates the advantages of this assessment approach.
Synthetic security assessment based on variable consistency dominance-based rough set approach

Zhao Liang,Xue Zhi

DOI: https://doi.org/10.3772/j.issn.1006-6748.2010.04.014

2010-01-01

Abstract:Security assessment can help understand the security conditions of an information system and yield results highly conducive to the solution of security problems in it. Taking the computer networks in a certain university as samples, this paper, with the information system security assessment model as its foundation, proposes a multi-attribute group decision-making (MAGDM) security assessment method based on a variable consistency dominance-based rough set approach (VC-DRSA). This assessment method combines VC-DRSA with the analytic hierarchy process (AHP) , uncovers the inherent information hidden in data via the quality of sorting (QoS) , and makes a synthetic security assessment of the information system after determining the security attribute weight. The sample findings show that this method can effectively remove the bottleneck of MAGDM, thus assuming practical significance in information system security assessment.
Network Security Situation Assessment and Prediction Technology based on Analytic Hierarchy Process

Xiaohong Shi,Chenglong Liu,Gong Chen,Huihui Tang,Song He

DOI: https://doi.org/10.1109/icetci55101.2022.9832324

2022-05-27

Abstract:The development of the Internet has brought a lot of convenience to people, but it also has some drawbacks and threats. For netizens, the study of the network security situation(SS) is the protection of privacy and security, as well as the maintenance of basic rights. Therefore, the research on network security situation assessment(NSSA) is based on security considerations. It can help people better understand this problem and take corresponding measures to control and prevent possible dangers. This article mainly uses experimental method and data method to carry out relevant research on AHP and NSSA and prediction technology(PT). Experimental results show. In the second to third time periods, the number of messages collected and the number of Trojan horse attacks changed inversely, and the fluctuations changed sharply. This shows that it is necessary to apply the analytic hierarchy process(AHP) for situation assessment.

Computer Science
Study on Construction and Application of Vulnerability Database

OU Xin-feng,HU Ming-zeng,ZHANG Tao,ZHANG Yong-zheng

DOI: https://doi.org/10.3969/j.issn.1001-3695.2007.03.062

2007-01-01

Abstract:Authors designed and established a multi-attribute quantitative vulnerability database,by introducing attributes like privilege sets,confidentiality,integrality,availability.The vulnerability information was also analyzed further.Practice has proved that it is a more comprehensive and powerful way for security assessment system by using this vulnerability information support.
Intelligent Mobile Terminal System Security Risk Assessment Based on AHP Algorithm

Tang Jie,Lu Quan-fang,Wen Hong

DOI: https://doi.org/10.3969/j.issn.1674-9456.2013.03.005

2013-01-01

Abstract:With the development of mobile communications technology and terminal technology,mobile intelligent terminal has been widely used in people's daily life and will be integrated into a variety of information system in the future.Therefore,the mobile intelligent terminal system security risk assessment is necessary.This article unifies the related standards and the security threats of current mobile intelligent terminal,which aimed to propose a concept of intelligent terminal system safety risk assessment.Because the intelligent terminal system safety assessment lacks of necessary model description,we design a model based on AHP algorithm to evaluate the security risk of intelligent terminal by calculated each evaluation elements of relative risk aversion and the grade of whole intelligent terminal security risk,which will play an important tool to establish the grade system of risk evaluation.
Quantitative Vulnerability Assessment for Power Information System Based on Adj acency Matrix

YE Xiaming,ZHAO Junhua,WEN Fushuan

DOI: https://doi.org/10.7500/AEPS20130324004

2013-01-01

Abstract:With the development of smart grids,a power system and its information system are going to be seamlessly integrated.Hence the quantitative vulnerability assessment for a power information system becomes an important research topic.Given this background,a quantitative vulnerability assessment method based on the adjacency matrix is developed first. The proposed method employs the transition probability to describe the characteristics of attackers at two stages,i.e.selecting the access point first,and then attacking other nodes in the network from the access point.Besides,the transfer probability index between nodes is used to describe the intelligent ability of the attacker to choose the attack node.Next,the effectiveness of the method developed is demonstrated through an established evaluation example based on the information model of a slave station of a distribution automation system.
A Business Process-based Method on Security Requirement Analysis of Information Systems

Yu Zhiwei,Tang Rengzhong,Jia Dongjiao,Ye Fanbo

DOI: https://doi.org/10.3321/j.issn:1004-132X.2007.04.021

2007-01-01

Abstract:To identify the security requirements of information systems, a business process-based security requirement analysis method was presented. Focused on the business process security, the related assets which affect the business process security were identified by security tree model. The security requirements of assets were identified by risk packet and risk transferring model, and then the security requirements list was formed after coverage analysis. Finally, a case was studied to illustrate the proposed method.

Vulnerability Assessment Method of Information System Based on Analytic Hierarchy Process

Vulnerability Threat Assessment Based on AHP and Fuzzy Comprehensive Evaluation

Research on Network Security Situation Assessment and Quantification Method Based on Analytic Hierarchy Process

Study on information system risk assessment method

RISK-BASED VULNERABILITY ASSESSMENT IN COMPLEX POWER SYSTEMS

Risk Assessment of Power Monitoring System Based on Fuzzy Analytical Hierarchy Process

A Hybrid ANP-DEA Approach for Vulnerability Assessment in Water Supply System

An Approach for Quantitative Assessment of Interoperability of Information Systems

Risk Based Vulnerability Assessment for Hvdc Transmission System

Vulnerability Assessment on WAMS Communication System Based on Attack Tree Model

Application of Analytical Hierarchy Process in Hazard Degree Assessment of Major Hazard Installations

Hierarchical algorithm for cyberspace situational awareness based on analytic hierarchy process

A Real Time Information Security Risk Assessment Method

Evaluation Index System of Bank Network Security based on Analytic Hierarchy Process

A Quantitative Risk Assessment Approach for Host System Security

Synthetic security assessment based on variable consistency dominance-based rough set approach

Network Security Situation Assessment and Prediction Technology based on Analytic Hierarchy Process

Study on Construction and Application of Vulnerability Database

Intelligent Mobile Terminal System Security Risk Assessment Based on AHP Algorithm

Quantitative Vulnerability Assessment for Power Information System Based on Adj acency Matrix

A Business Process-based Method on Security Requirement Analysis of Information Systems