Risk assessment expert system for the complex system
MA Gang1,2, DU Yuge3, YANG Xi1, ZHANG Bo1,2, SHI Zhongzhi1
1. Key Laboratory of Intelligent Information Processing, Institute of Computing Technology, Chinese Academy of Sciences, Beijing 100190, China;
2. University of Chinese Academy of Sciences, Beijing 100049, China;
3. China Information Technology Security Evaluation Center, Beijing 100085, China
Abstract：A set of simple and convenient risk assessment expert system with knowledge was developed based on the existing risk assessment algorithms and the object-oriented knowledge processing system to assess the security risk of complex systems. The risk assessment results for a typical complex system prove that the developed expert system can be used to collect the information and assess security risk for the complex system, while guiding the risk assessment analyzer to make a reasonable security protection strategy for assets in the complex system, which is more objective and more accurate compared with the traditional expert artificial analysis.
马刚, 杜宇鸽, 杨熙, 张博, 史忠植. 复杂系统风险评估专家系统[J]. 清华大学学报（自然科学版）, 2016, 56(1): 66-76,82.
MA Gang, DU Yuge, YANG Xi, ZHANG Bo, SHI Zhongzhi. Risk assessment expert system for the complex system. Journal of Tsinghua University(Science and Technology), 2016, 56(1): 66-76,82.
[1] Jamin S, Raz D, Shavitt Y, et al. Guest editorial Internet and WWW measurement, mapping, and modeling [J]. IEEE Journal on Selected Areas in Communications, 2003, 21(6): 877-878.
[2] Jeong H, Tonbor B, Albert R, et al. The large-scale organization of metabolic networks [J]. Nature, 2000, 407(6804): 651-654.
[3] 王占山, 王军义, 梁洪晶. 复杂网络的相关研究及其进展 [J]. 自动化学会通讯, 2013, 34(170): 4-16.WANG Zhanshan, WANG Junyi, LIANG Hongjing. Research and progress of complex networks [J]. Communications of CAA, 2013, 34(170): 4-16. (in Chinese)
[4] Watts D J, Strogatz S H. Collective dynamics of "small-world" networks [J]. Nature, 1998, 393(6684): 440-442.
[5] 何大韧, 刘宗华, 汪秉宏. 复杂系统与复杂网络 [M]. 北京: 高等教育出版社, 2009.HE Daren, LIU Zonghua, WANG Binghong. Complex Systems and Complex Networks [M]. Beijing: Higher Education Press, 2009. (in Chinese)
[6] 吴晓平, 付钰. 信息安全风险评估教程 [M]. 武汉: 武汉大学出版社, 2011.WU Xiaoping, FU Yu. Textbook for Information Security Risk Assessment [M]. Wuhan: Wuhan University Press, 2011. (in Chinese)
[7] 张永铮, 方滨兴, 迟悦, 等. 用于评估网络信息系统的风险传播模型 [J]. 软件学报, 2007, 18(1): 137-145.ZHANG Yongzheng, FANG Bingxing, CHI Yue, et al. Risk propagation model for assessing network information systems [J]. Journal of Software, 2007, 18(1): 137-145. (in Chinese)
[8] 李晓蓉, 庄毅, 许斌. 基于危险理论的信息安全风险评估模型 [J]. 清华大学学报: 自然科学版, 2011, 51(10): 1231-1235.LI Xiaorong, ZHUANG Yi, XU Bin. Risk assessment model for information security based on danger theory [J]. Journal of Tsinghua University: Sci & Technol, 2011, 51(10): 1231-1235. (in Chinese)
[9] 张利, 彭建芬, 杜宇鸽, 等. 信息安全风险评估的综合评估方法综述 [J]. 清华大学学报: 自然科学版, 2012, 52(10): 1364-1368.ZHANG Li, PENG Jianfen, DU Yuge, et al. Information security risk assessment survey [J]. Journal of Tsinghua University: Sci & Technol, 2012, 52(10): 1364-1368. (in Chinese)
[10] 马刚, 杜宇鸽, 荣江, 等. 基于威胁传播的复杂信息系统安全风险评估 [C]//第六届信息安全漏洞分析与风险评估大会. 北京, 2013: 21-38. MA Gang, DU Yuge, RONG Jiang, et al. Risk assessment of the complex information system based on threat propagation [C]//The 6th Conference on Vulnerability Analysis and Risk Assessment. Beijing, 2013: 21-38. (in Chinese)
[11] 金鸿章, 韦琦, 郭建, 等. 复杂系统的脆性理论及应用[M]. 西安: 西北工业大学出版社, 2010. JIN Hongzhang, WEI Qi, GUO Jian, et al. Vulnerability Theory and Application of Complex Systems [M]. Xi'an: Northwestern Polytechnical University Press, 2010. (in Chinese)
[12] 穆成坡, 黄厚宽, 田盛丰. 入侵进程的层次化在线风险评估[J]. 计算机研究与发展, 2010, 47(10): 1724-1732. MU Chengpo, HUANG Houkuan, TIAN Shengfeng. Hierarchical online risk assessment for intrusion scenarios [J]. Journal of Computer Research and Development, 2010, 47(10): 1724-1732. (in Chinese)
[13] 时云峰, 张金祥, 冯建华. 基于异常捕获的强脆弱性分析与利用[J]. 软件学报, 2010, 21(11): 2944-2958. SHI Yunfeng, ZHANG Jinxiang, FENG Jianhua. Critical vulnerability analysis and exploitation based on exception capture [J]. Journal of Software, 2010, 21(11): 2944-2958. (in Chinese)
[14] 赵刚, 况晓辉, 李津, 等. 一种基于权值的大规模分布式系统结构脆弱性分析算法[J]. 计算机研究与发展, 2011, 48(5): 906-912. ZHAO Gang, KUANG Xiaohui, LI Jin, et al. A structural vulnerability analysis algorithm for large-scale distributed system [J]. Journal of Computer Research and Development, 2011, 48(5): 906-912. (in Chinese)
[15] 周亮, 李俊峨, 陆天波, 等. 信息系统漏洞风险定量评估模型研究[J]. 通信学报, 2009, 30(2): 71-76. ZHOU Liang, LI Jun'e, LU Tianbo, et al. Research on quantitative assessment model on vulnerability risk for information system [J]. Journal on Communications, 2009, 30(2): 71-76. (in Chinese)
[16] 陶倩, 马刚, 史忠植. 基于Agent的专家系统推理模型 [J]. 智能系统学报, 2013, 8(2): 135-142. TIAO Qian, MA Gang, SHI Zhongzhi. Research on the expert system reasoning model based on Agent [J]. CAAI Transactions on Intelligent System, 2013, 8(2): 135-142. (in Chinese)
[17] 张勇斌, 马玉书. 专家系统开发平台OKPS的设计与实现[J]. 西安石油学院学报: 自然科学版, 2003, 18(2): 76-78. ZHANG Yongbin, MA Yushu. Design and implementation of expert system development platform OKPS [J]. Journal of Xi'an Petroleum Institute: Natural Science Edition, 2003, 18(2): 76-78. (in Chinese)
2016, Vol. 56 
