关键词: 信息系统, 风险评估, DS证据理论, 证据合成, 可信度分配

Abstract: In view of the characteristics of incomplete data, strong randomness and fuzziness of risk items in the information security system, this paper proposes the method of “concentration rate” on the basis of the previous risk assessment model which is based on DS evidence theory, and effectively deals with the evidence conflicts among risk items. Then, the improved Dempster's evidence combination rule is used to synthesize the risk items, which reduces the uncertainty in the security risk assessment of the whole system. Finally, an example analysis of the hierarchical model of information system security risk assessment is given to verify the method proposed in this paper. The example shows that the improved method proposed in this paper is feasible and effective.

Key words: information system, risk assessment, DS evidence theory, evidence synthesis, credit assignment