基于不完全信息博弈模型的信息系统安全风险评估方法

博弈理论具有的目标对立性、关系非合作性和策略依存性等特征与网络攻防对抗过程保持一致,将博弈理论应用于网络信息安全已经成为研究热点,但目前已有的研究成果大都采用完全信息博弈模型,与网络攻防实际不符。基于此,为提高信息系统风险评估的准确性,本文构建不完全信息条件下的静态贝叶斯攻防博弈模型,将其应用于网络信息系统安全风险评估,构建相应的信息系统安全风险评估算法。通过仿真实验验证了本文模型和方法的有效性,能够对信息系统安全威胁进行科学、有效的评估。

Information System Security Risk Assessment Based on Incomplete Information Game Model

Game theory has the characteristics of opposition target, non-cooperation relationship and dependence policy. It is consistent with the network attack and defense process. Applying game theory to network information security has become a research hotspot, but most of the existing research results have adopted complete information. The game model does not match the actual network attack and defense. Based on this, in order to improve the accuracy of information system risk assessment, this paper constructs a static Bayesian offensive and defensive game model under incomplete information conditions, and applies it to network information system security risk assessment to construct a corresponding information system security risk assessment algorithm. The effectiveness of the model and method is verified by experiments, which can provide a scientific and effective evaluation of information system security threats.