用于评估网络信息系统的风险传播模型.PDFVIP

ISSN 1000-9825, CODEN RUXUEW E-mail: jos@ Journal of Software, Vol.18, No.1, January 2007, pp .137−145 http://www.j DOI: 10. 1360/jos1 80137 Tel/Fax : +86-10 © 2007 by Journal of Software. All rights reserved. ∗ 用于评估网络信息系统的风险传播模型 + 张永铮 , 方滨兴, 迟 悦, 云晓春 (哈尔滨工业大学 计算机网络与信息安全技术研究中心,黑龙江 哈尔滨 150001) Risk Propagation Model for Assessing Network Information Systems + ZHANG Yong-Zheng , FANG Bin-Xing, CHI Yue, YUN Xiao-Chun (Research Center of Computer Network and Information Security Technology, Harbin Institute of Technology, Harbin 150001, China) + Corresponding author: Phn: +86-10 E-mail: zhangyongzheng@ Zhang YZ, Fang BX, Chi Y, Yun XC. Risk propagation model for assessing network information systems. Journal of Software, 2007,18(1):137−145. /1000-9825/18/137.htm Abstract: To assess the security risk of network information systems, this paper proposes a risk propagation model including a risk network and a risk propagation algorithm. A representative example is given to illustrate the application of this model to network risk assessment and validate the correctness of the propagation algorithm. The analysis of the example indicates that the evaluating method using the risk propagation model is superior to the traditional methods in the accuracy of evaluating conclusions and making cost-effective security advices. Key words: network security ; network risk assessment; risk propagation; risk analysis 摘 要: 为了评估网络信息系统的安全风险,提出了一个由风险网络和风险传播算法构成的风险传播模型,并 以一个具有代表性的实例阐明了该模型在网络风险评估中的应用,验证了传播算法的正确性.实例分析表明,应 用风险传播模型的评估方法较传统方法在评估结论的准确性和制定符合最优成本效应的安全建议等方面更具 优势. 关键词: 网络安全; 网络风险评估;风险传播;