基于模糊理论的漏洞危害等级评估.pdf

网络出版时间：2013-11-05 11:23 网络出版地址：/kcms/detail/51.1196.TP1123.014.html 优先出版 计 算 机 应 用 研 究 第31 卷 * 基于模糊理论的漏洞危害等级评估 1 1 1, 2 1 1 马 驰 ，高 岭 ，孙 骞 ，何 林 ，高学玲 （1．西北大学 信息科学与技术学院,西安 710127；2．西北大学 现代教育技术中心,西安 710127 ） 摘 要：针对安全漏洞危害难以量化评估的问题，提出一种基于模糊理论的漏洞危害等级评估方法。使用层次分析法建 立漏洞等级评估体系并计算漏洞评估影响因素的权重。利用模糊综合判断法对漏洞危害等级进行定量评价，综合可利用 性和安全影响两方面因素实现对漏洞危害的评估。实验结果表明该方法对于漏洞危害能够得到更加准确的评估结果。 关键词：安全漏洞;漏洞评估;层次分析;模糊综合评价 中图分类号：TP309 文献标志码：A Assessment of vulnerability threat based on fuzzy theory 1 1 1, 2 1 1 MA Chi , GAO Ling , SUN Qian , HE Lin , GAO Xue-ling (1. Dept. of Computer Science Technology, Northwest University, Xi ’an 710127, China; 2. Center of Modern Education Technology, Northwest University, Xi ’an 710127, China) Abstract: A hierarchical evaluation method was proposed to quantitative evaluate vulnerability attributes to improve vulnerability risk evaluation process.A evaluation system was developed based on the analytic hierarchy process to obtain the factor weights.The vulnerability severity was quantified based on the fuzzy comprehensive evaluation to give the severity rank.Vulnerability was evaluated by the combining of exploitability attributes and safety influence attributes.Experimental results show that this method can evaluate the vulnerability severity more accurately. Key Words: vulnerability; vulnerability evaluation;analytic hierarchy