Abstract:

Considering that there are many uncertainty factors in the process of information systems security risk assessment, such as lack of evaluation data, incomplete knowledge and system modeling, inadequate risk identification, method based on fuzzy theory of evidence was presented. Concepts of related risk assessment were introduced firstly, and calculation model for the information systems risk assessment was established after that. And then fuzzy sets were introduced into theory of evidence. The basic probability assignments which are core to theory of evidence were constructed using the membership function of fuzzy sets. When the fuzzy relations between risk indexes set and evaluation standard, the problem that the basic probability assignments were difficult to determine was solved. Moreover, the result is more reasonable. An illustration example dedicates that the method was feasible and effective, and provides reasonable data for constituting the risk control strategy of the information systems security.

Key words: DS theory of evidence, fuzzy sets, information systems, risk assessment