Programming Risk Assessment Models for Online Security Evaluation Systems

Risk assessment is often done by human experts, because there is no exact and mathematical solution to the problem.Usually the human reasoning and perception process cannot be expressed precisely. This paper propose a genetic programming approach for risk assessment. Preliminary results indicate that genetic programming methods are robust and suitable for this problem when compared to other risk assessment models.

1 Introduction

Risk analysis [8] [11] [12] is fundamentally all about es-tablishing probabilities. Different people have different opinions about risk and the association of its dependent variables and in our previous research we have used fuzzy logic to model risk [6]. In the DIPS framework [6], the risk analysis was done using threat levels, vulnerability and asset value [5]. We consider that all components within a network scenario falls into one of these categories, and each has attributes, or derived factors, that contribute positively or negatively to risk.