Abstract:

Risk assessment plays an important role in classified protection of information system. Through the risk assessment, threats and vulnerabilities can be clearly, level of risk and expected loss can be evaluated. System administrators can consolidate the problems which are found during the assessment to improve the security of the system. However the assessment result is greatly influenced by evaluator’s subjective factors in risk assessment progress. When assigning the safety of assets, it is difficult to give a precise number to describe the safety of assets. And evaluators give the safety assignments number based on their experience, knowledge and other factors, this number has certain subjectivity, but it can’t completely describe the evaluator’s subjective state of mind, so it influences the objective of assessment result. A risk assessment method is researched; it has some advantages in describing the evaluator’s subjective factors and reducing the influence caused by subjective factors in order to improve the objective of assessment result. The evaluator’s subjective states, such as certain, deny and hesitate, are described by interval-valued intuitionistic fuzzy sets. An interval-valued intuitionistic fuzzy similarity algorithm is proposed, and considering the national standard information security technology — baseline for classified protection of information system, the risk assessment method is proposed based above knowledge. The experimental result proves the effectively of this method, and it has a certain application value.

Key words: information security, risk assessment, information system, fuzzy system theory, interval-valued intuitionistic fuzzy sets