Information security risk assessment based on grey relational decision-making algorithm

Yang Gao,Junzhou Luo
2009-01-01
Abstract:An approach based on grey system theory is put forward to evaluate information system security for solving uncertainty in parameter values. Firstly, uncertainty in parameter values is analyzed and classified to grey parameter values and vacant parameter ones. According to the actual condition and history statistical data, the vacant parameter values may meet three kinds of distributions: uniform distribution, exponential distribution, and normal distribution. The corresponding prior estimates are given to fill them up. Then, the algorithm of grey relational decision-making is applied to estimate information security risk. The study of an example proves the validity of this method. And the results show that the approach can properly deal with uncertainty in parameter values, decrease the subjectivity in evaluation process, and easily rank each information system by security level. It brings a new thought to information security risk assessment approaches.
What problem does this paper attempt to address?