A new information security risk analysis method based on membership degree

Abstract

Purpose -In a risk analysis system, different underlying indices often play different roles in identifying the risk scale of the total target in a system, so a concept of discriminatory weight is introduced first. With the help of discriminatory weight and membership functions, a new method for information security risk analysis is proposed. The purpose of this paper is to discuss the above issues. Design/methodology/approach -First, a concept of discriminatory weight is introduced. Second, with the help of fuzzy sets, risk scales are captured in terms of fuzzy sets (namely their membership functions). Third, a new risk analysis method involving discriminatory weights is proposed to realize a transformation from the membership degrees of the underlying indices to the membership degrees of the total target. At last, an example of information security risk analysis shows the effectiveness and feasibleness of the new method. Findings -The new method generalizes the weighted-average method. The comparative analysis done with respect to other two methods show that the proposed method exhibits higher classification accuracy. Therefore, the proposed method can be applied to other risk analysis system with a hierarchial. Originality/value -This paper proposes a new method for information security risk analysis with the help of membership functions and the concept of discriminatory weight. The new method generalizes the weighted-average method. Comparative analysis done with respect to other two methods show that the proposed method exhibits higher classification accuracy in E-government information security system. What is more, the proposed method can be applied to other risk analysis system with a hierarchial.

Respite for SMEs: A Systematic Review of Socio-Technical Cybersecurity Metrics

“…Dantu and Kolan [83] Other DE, AB BN Yes Depoy et al [105] Other DE, AB WP, WCP Yes Hasle et al [106] Enterprise (A) AW WLC No Villarrubia et al [107] Enterprise (A) RE WLC No Bhilare et al [74] Enterprise (M/L) RE None Yes Grunske and Joyce [108] Other DE, AB WP, WM Yes Sahinoglu [84] Other RE WLC, BN Yes Dantu et al [85] Other DE, AB BN Yes Chen and Wang [87] Other AW WP No Chan [88] Enterprise (M/L) RE WLC, WP No Shin et al [78] Other AW, KN WLC No Bojanc et al [109] Enterprise (A) RE WLC, WM Yes Lo and Chen [50] Enterprise (M/L) AW, RE WLC No Rantos et al [110] Enterprise (A) AW, DE, KN, AB, RE WLC Yes Shameli-Sendi et al [80] Enterprise (A) KN, AB WC No Bojanc and Jerman-Blažič [111] Enterprise (A) AW, RE WLC Yes Marconato et al [79] Other AW, DE None No Taubenberger et al [112] Enterprise (M/L) AW, RE None No Alencar Rigon et al [102] Enterprise (M/L) RE WLC No Boggs et al [113] Other AW WLC Yes Chen et al [114] Enterprise (M/L) RE WLC No Cheng et al [115] Other AW WLC, WP, WM Yes Feng et al [86] Enterprise (M/L) AW, RE BN Yes Manifavas et al [77] Enterprise (A) AW, DE, KN, AB, RE WLC Yes Silva et al [81] Other RE WLC, WP No Suhartana et al [116] Enterprise (A) AB, RE WLC Yes Yadav and Dong [117] Other AW, KN, AB, RE None Yes Dehghanimohammadabadi and Bamakan [118] Enterprise (M/L) RE WLC, WP Yes Juliadotter and Choo [119] Other AW, DE, KN, AB, RE WLC Yes Otero [120] Enterprise (M/L) AW, AB, RE None Yes Solic et al [121] Enterprise (A) AW, KN, AB WLC No Sugiura et al [122] Enterprise (A) AW, RE None No Wei et al [123] Other AW, AB WLC No You et al [7...…”

“…Dantu and Kolan [83] 2005 Risk Theoretical Attacker Depoy et al [105] 2005 Risk Theoretical Attacker Hasle et al [106] 2005 Resilience Theoretical Defender Villarrubia et al [107] 2006 Maturity Theoretical Defender Bhilare et al [74] 2008 Security Theoretical Defender Grunske and Joyce [108] 2008 Risk Theoretical Attacker Sahinoglu [84] 2008 Risk Theoretical Defender Dantu et al [85] 2009 Risk Theoretical Attacker Chen and Wang [87] 2010 Risk Theoretical Defender Chan [88] 2011 Risk Theoretical Defender Shin et al [78] 2011 Vulnerability Theoretical Defender Bojanc et al [109] 2012 Risk Theoretical Defender Lo and Chen [50] 2012 Risk Theoretical Defender Rantos et al [110] 2012 Awareness Theoretical Defender Shameli-Sendi et al [80] 2012 Risk Theoretical Defender Bojanc and Jerman-Blažič [111] 2013 Risk Theoretical Defender Marconato et al [79] 2013 Risk Theoretical Defender Taubenberger et al [112] 2013 Risk Implementation Defender Alencar Rigon et al [102] 2014 Maturity Theoretical Defender Boggs et al [113] 2014 Resilience Theoretical Defender Chen et al [114] 2014 Risk Theoretical Defender Cheng et al [115] 2014 Awareness Theoretical Defender Feng et al [86] 2014 Risk Theoretical Defender Manifavas et al [77] 2014 Awareness Implementation Defender Silva et al [81] 2014 Risk Theoretical Defender Suhartana et al [116]…”

User Access Management Based on Network Pricing for Social Network Applications

“…For a heterogeneous network, the unascertained membership degree [ 15 , 24 , 25 , 26 ] method works as follows. (1) Compare and judge each of the parameters of different networks.…”