| Orginal Article |
|
|
|
|
|
Risk assessment of complex information system security based on threat propagation |
Gang MA1,2,Yuge DU3,Jiang RONG1,2,Jiarui GAN1,2,Zhongzhi SHI1( ),Bo AN1 |
1. The Key Laboratory of Intelligent Information Processing, Institute of Computing Technology, Chinese Academy of Sciences, Beijing 100190, China
2. University of Chinese Academy of Sciences, Beijing 100049, China
3. China Information Technology Security Evaluation Center, Beijing 100085, China |
|
|
|
| Guide |
|
|
Abstract This paper presents a risk assessment method based on threat propagation between assets for assessing the risks related to complex information system security. This method describes the threat propagation route between assets as a threat propagation tree, with the risk to the complex information system security assessed by the expected value loss of each node in the threat propagation tree with the probability of each step in the threat propagation tree. The accuracy of this model is evaluated by applying the model to a representative complex information system. The analysis shows that this method represents the different probabilities for different threatened nodes and the threat propagation between nodes to identiby the key protected nodes during different periods. The system is more objective and accurate than the traditional isolated node analysis method and is able to guide security risk managers to formulate reasonable security protection strategies for complex information systems.
|
| Keywords
risk assessment
asset
threat propagation tree
|
|
|
| Fund: |
|
Issue Date: 15 January 2014
|
|
|
| [1] |
Jamin S, Raz D, Shavitt Y, et al.Guest editorial Internet and WWW measurement, mapping, and modeling [J]. IEEE Journal on Selected Areas in Communications, 2003, 21(6): 877-878.
url: http://dx.doi.org/10.1109/JSAC.2003.814664
|
| [2] |
Jeong H, Tonbor B, Albert R, et al. The large-scale organization of metabolic networks [J]. Nature, 2000, 407(6804): 651-654.
url: http://dx.doi.org/10.1038/35036627
|
| [3] |
王占山, 王军义, 梁洪晶. 复杂网络的相关研究及其进展[J]. 自动化学会通讯, 2013, 34(170): 4-16. WANG Zhanshan, WANG Junyi, LIANG Hongjing. Research and progress of complex networks[J]. Communications of CAA, 2013, 34(170): 4-16. (in Chinese)
url: http://www.cnki.com.cn/Article/CJFDTotal-HUAI200602033.htm
|
| [4] |
Watts D J, Strogatz S H. Collective dynamics of “small-world” networks[J]. Nature, 1998, 393(6684): 440-442.
url: http://dx.doi.org/10.1038/30918
|
| [5] |
何大韧, 刘宗华, 汪秉宏. 复杂系统与复杂网络 [M]. 北京: 高等教育出版社, 2009. HE Daren, LIU Zonghua, WANG Binghong. Complex Systems and Complex Networks [M]. Beijing: Higher Education Press, 2009. (in Chinese)
|
| [6] |
吴晓平, 付钰. 信息安全风险评估教程 [M]. 武汉: 武汉大学出版社, 2011. WU Xiaoping, FU Yu. Textbook for Information Security Risk Assessment [M]. Wuhan: Wuhan University Press, 2011. (in Chinese)
|
| [7] |
张利, 彭建芬, 杜宇鸽, 等. 信息安全风险评估的综合评估方法综述[J]. 清华大学学报: 自然科学版, 2012, 52(10): 1364-1368. ZHANG Li, PENG Jianfen, DU Yuge, et al.Information security risk assessment survey[J]. Journal of Tsinghua University: Science and Technology, 2012, 52(10): 1364-1368. (in Chinese)
url: http://d.wanfangdata.com.cn/Conference_8100435.aspx
|
| [8] |
张永铮, 方滨兴, 迟悦, 等. 用于评估网络信息系统的风险传播模型[J]. 软件学报, 2007, 18(1): 137-145. ZHANG Yongzheng, FANG Bingxing, CHI Yue, et al.Risk propagation model for assessing network information systems[J]. Journal of Software, 2007, 18(1): 137-145. (in Chinese)
url: http://www.cnki.com.cn/Article/CJFDTotal-RJXB200701016.htm
|
| [9] |
李晓蓉, 庄毅, 许斌. 基于危险理论的信息安全风险评估模型[J]. 清华大学学报: 自然科学版, 2011, 51(10): 1231-1235. LI Xiaorong, ZHUANG Yi, XU Bin. Risk assessment model for information security based on danger theory[J]. Journal of Tsinghua University: Science and Technology, 2011, 51(10): 1231-1235. (in Chinese)
url: http://www.cnki.com.cn/Article/CJFDTotal-QHXB201110002.htm
|
| [10] |
金鸿章, 韦琦, 郭建, 等. 复杂系统的脆性理论及应用 [M]. 西安: 西北工业大学出版社, 2010. JIN Hongzhang, WEI Qi, GUO Jian, et al.Vulnerability Theory and Application of Complex System [M]. Xi'an: Northwestern Polytechnical University Press, 2010. (in Chinese)
|
| [11] |
穆成坡, 黄厚宽, 田盛丰. 入侵进程的层次化在线风险评估[J]. 计算机研究与发展, 2010, 47(10): 1724-1732. MU Chengpo, HUANG Houkuan, TIAN Shengfeng. Hierarchical online risk assessment for intrusion scenarios[J]. Journal of Computer Research and Development, 2010, 47(10): 1724-1732. (in Chinese)
url: http://www.cnki.com.cn/Article/CJFDTotal-JFYZ201010010.htm
|
| [12] |
时云峰, 张金祥, 冯建华. 基于异常捕获的强脆弱性分析与利用[J]. 软件学报, 2010, 21(11): 2944-2958. SHI Yunfeng, ZHANG Jinxiang, FENG Jianhua. Critical vulnerability analysis and exploitation based on exception capture[J]. Journal of Software, 2010, 21(11): 2944-2958. (in Chinese)
|
| [13] |
赵刚, 况晓辉, 李津, 等. 一种基于权值的大规模分布式系统结构脆弱性分析算法[J]. 计算机研究与发展, 2011, 48(5): 906-912. ZHAO Gang, KUANG Xiaohui, LI Jin, et al.A structural vulnerability analysis algorithm for large-scale distributed system[J]. Journal of Computer Research and Development, 2011, 48(5): 906-912. (in Chinese)
url: http://www.cnki.com.cn/Article/CJFDTotal-JFYZ201105030.htm
|
| [14] |
周亮, 李俊峨, 陆天波, 等. 信息系统漏洞风险定量评估模型研究[J]. 通信学报, 2009, 30(2): 71-76. ZHOU Liang, LI June, LU Tianbo, et al.Research on quantitative assessment model on vulnerability risk for information system[J]. Journal on Communications, 2009, 30(2): 71-76. (in Chinese)
url: http://www.cnki.com.cn/Article/CJFDTotal-TXXB200902016.htm
|
| [15] |
Gabow H N, Myers E W. Finding all spanning trees of directed and undirected graph[J]. Society for Industrial and Applied Mathematics, 1978, 7(3): 280-287.
|
|
Viewed |
|
|
|
Full text
|
|
|
|
|
Abstract
|
|
|
|
|
Cited |
|
|
|
|
| |
Shared |
|
|
|
|
| |
Discussed |
|
|
|
|
2014,
Vol. 54
