基于AHP的云租户主机安全风险评估研究
|
摘要
针对信息安全等级保护测评中云租户主机安全风险评估指标不够全面、云平台风险影响因素不能具体体现和评估结果模糊度高等问题,提出一种基于AHP的多层次云租户主机安全风险评估方法。通过云主机自身影响因素和云平台影响因素的相关安全措施的评估结果构造云主机风险评估规则;依据国家信息系统等级保护测评要求,采用层次分析法构建风险评估指标模型,对不同作用的云主机实现调整指标权重的优化。实验结果表明,该方法能对云租户主机系统进行合理评价,简单有效,实际操作度高,具有一定的应用价值。
In view of the problem that the host Security Risk Assessment(SRA) index of cloud tenants is not complete in the information security level protection evaluation,cloud platform risk factors can't be embodied and the assessment results are ambiguous. We propose a method for cloud tenants host SRA based on Analytic Hierarchy Process(AHP). The cloud host SRA rules are constructed based on the evaluation results of its own influencing factors and related security measures of cloud platform influencing factors. According to the requirements of national information system level protection evaluation,AHP is used to construct the risk assessment index model,and the weight of the adjustment index for cloud hosts with different functions is carried out. Experimental results show that this method can evaluate the cloud tenant host system rationally,which is simple,effective,practical and with application value.
In view of the problem that the host Security Risk Assessment(SRA) index of cloud tenants is not complete in the information security level protection evaluation,cloud platform risk factors can't be embodied and the assessment results are ambiguous. We propose a method for cloud tenants host SRA based on Analytic Hierarchy Process(AHP). The cloud host SRA rules are constructed based on the evaluation results of its own influencing factors and related security measures of cloud platform influencing factors. According to the requirements of national information system level protection evaluation,AHP is used to construct the risk assessment index model,and the weight of the adjustment index for cloud hosts with different functions is carried out. Experimental results show that this method can evaluate the cloud tenant host system rationally,which is simple,effective,practical and with application value.
引文
[1]公安部信息安全等级保护评估中心.信息安全等级保护培训教程[M].北京:电子工业出版社,2016:90-111.
[2]谭彬,杨明,梁业裕,等.基于等级保护的云计算安全防护体系研究[J].网络空间安全,2017,8(Z4):12-15.
[3]王和平,朱凯华.基于云计算环境下的等级保护基本要求思考与改进[J].网络安全技术与应用,2017,17(4):114-115.
[4]晏裕生.基于等级保护的云计算Iaa S安全评估研究[D].北京:北京交通大学,2016:15-20.
[5]赖建华,林宁思.Iaa S环境下云主机安全配置基线设计[J].情报探索,2017,31(1):88-92.
[6]李国伟,王付明,王南星.基于模糊AHP法的网络空间联合反恐作战指挥体系效能评估[J].兵器装备工程学报,2016,37(4):111-113,117.
[7]张坤.基于AHP和BP的信息安全风险评估研究[D].邯郸:河北工程大学,2016:16-44.
[8]李鹏宇.基于层次分析法的信息安全风险评估量化方法研究[D].南昌:江西财经大学,2012:19-48.
[9]杨笑源,赵晓刚.应用改进层次分析法和模糊综合评判的油库静电灾害评估[J].重庆理工大学学报(自然科学),2015,29(2):136-140.
[10]龚斯谛.基于AHP和攻击图的工控系统信息安全风险评估研究[D].南昌:南昌航空大学,2017:16-43.
[11]赵雪岩,陈天平,张串绒.主机系统安全实时风险量化评估方法的研究[J].西安工程大学学报,2010,24(2):203-207.
[12]张永梅,黄蕊,刘爱超,等.三级信息安全等级保护标准的安全防护措施[J].网络安全技术与应用,2017,13(6):16-17.
[13]武文博,康锐,李梓.基于攻击图的信息物理系统信息安全风险评估方法[J].计算机应用,2016,36(1):203-206.
[14]刘鹏,张园林,晏湘涛,等.基于专家动态权重的群组AHP交互式决策方法[J].数学的实践与认识,2007,36(13):85-90.
[15]刘仁山,孟祥宏.主机系统安全态势实时评估方法的研究[J].河南理工大学学报(自然科学版),2014,33(3):344-348.
[2]谭彬,杨明,梁业裕,等.基于等级保护的云计算安全防护体系研究[J].网络空间安全,2017,8(Z4):12-15.
[3]王和平,朱凯华.基于云计算环境下的等级保护基本要求思考与改进[J].网络安全技术与应用,2017,17(4):114-115.
[4]晏裕生.基于等级保护的云计算Iaa S安全评估研究[D].北京:北京交通大学,2016:15-20.
[5]赖建华,林宁思.Iaa S环境下云主机安全配置基线设计[J].情报探索,2017,31(1):88-92.
[6]李国伟,王付明,王南星.基于模糊AHP法的网络空间联合反恐作战指挥体系效能评估[J].兵器装备工程学报,2016,37(4):111-113,117.
[7]张坤.基于AHP和BP的信息安全风险评估研究[D].邯郸:河北工程大学,2016:16-44.
[8]李鹏宇.基于层次分析法的信息安全风险评估量化方法研究[D].南昌:江西财经大学,2012:19-48.
[9]杨笑源,赵晓刚.应用改进层次分析法和模糊综合评判的油库静电灾害评估[J].重庆理工大学学报(自然科学),2015,29(2):136-140.
[10]龚斯谛.基于AHP和攻击图的工控系统信息安全风险评估研究[D].南昌:南昌航空大学,2017:16-43.
[11]赵雪岩,陈天平,张串绒.主机系统安全实时风险量化评估方法的研究[J].西安工程大学学报,2010,24(2):203-207.
[12]张永梅,黄蕊,刘爱超,等.三级信息安全等级保护标准的安全防护措施[J].网络安全技术与应用,2017,13(6):16-17.
[13]武文博,康锐,李梓.基于攻击图的信息物理系统信息安全风险评估方法[J].计算机应用,2016,36(1):203-206.
[14]刘鹏,张园林,晏湘涛,等.基于专家动态权重的群组AHP交互式决策方法[J].数学的实践与认识,2007,36(13):85-90.
[15]刘仁山,孟祥宏.主机系统安全态势实时评估方法的研究[J].河南理工大学学报(自然科学版),2014,33(3):344-348.