A Novel Network Security Risk Assessment Approach by Combining Subjective and Objective Weights under Uncertainty

Abstract

Nowadays, computer networks are playing a more and more important role in people's daily lives. Meanwhile, the security of computer networks has also attracted widespread concern. However, up to now, there is no universal and effective assessment approach for computer network security. Therefore, a novel network security risk assessment approach by combining subjective and objective weights under uncertainty is proposed. In the proposed evaluation approach, the uncertainty of evaluation data is taken into account, which is translated into objective weights through an uncertainty measure. By combining the subjective weights of evaluation criteria and the objective weights of evaluation data, the final weights can be obtained. Then, Dempster-Shafer (D-S) evidence theory and pignistic probability transformation (PPT) are employed to derive a consensus decision for the degree of the network security risk. Two illustrative examples are given to show the efficiency of the proposed approach. This approach of risk assessment, which combines subjective and objective weights, can not only effectively evaluate computer network security, but also be widely used in decision-making.

A Comprehensive Evaluation Model for Curtain Grouting Efficiency Assessment Based on Prospect Theory and Interval-Valued Intuitionistic Fuzzy Sets Extended by Improved D Numbers

“…The D number concept was developed by Deng [48] as an effective representation of missing data and incomplete decision-making information. It has been shown that D numbers can overcome the existing deficiencies in traditional Dempster-Shafer theories [49,50]. D numbers have been widely applied in the comprehensive evaluation field.…”

Exploring How Component Factors and Their Uncertainty Affect Judgements of Risk in Cyber-Security

“…Both objective and subjective measures of risk provide useful information to aid decision making in vulnerability assessment [4,5]. Several different methods can be used to assess vulnerability and risk in a cyber-security system, such as vulnerability scanning tools [18] or the Common Vulnerability Scoring System (CVSS) [15], which gives qualitative severity ratings of low, medium, and high, and CVSS Version 3, which extends the ratings to include none and critical [8].…”

“…Between-expert uncertainty is often modelled implicitly, for example, through probability distributions [7] or uncertainty measures [5]. These methods model the between-expert uncertainty, but they do not capture within-expert uncertainty.…”

A New Belief Entropy to Measure Uncertainty of Basic Probability Assignments Based on Belief Function and Plausibility Function

“…D–S theory assigns probabilities to the power set of events [ 5 ], so it has advantages of dealing with uncertainty and unknown problems. In addition, it has wide applications, such as sensors’ network analysis [ 6 ], classification and clustering [ 7 , 8 , 9 ], decision-making [ 10 , 11 , 12 ], knowledge reasoning [ 13 , 14 ], risk assessment and evaluation [ 10 , 15 ], and others [ 9 , 11 , 16 , 17 , 18 ].…”