Vulnerability Threat Assessment Based on AHP and Fuzzy Comprehensive Evaluation

The paper starts with the study of present methods for evaluation of Vulnerability Threat. It puts forward a new classification method to make up the insufficiency of key elements of assessment. It establish the index system by considering the aspects of time, environment and attack damages and so on. It proposes an assessment method based on Analytic Hierarchy Process (AHP) and fuzzy comprehensive evaluation, obtaining the factor weights by AHP, and quantifying the vulnerability based on the fuzzy comprehensive evaluation. At the end, it gives a practical example to prove that this method can be applied very well for vulnerability harm assessment.

I. Introduction

Security vulnerability, is defect or deficiency in the process of the design and implementation of the hardware, software or protocol in computer system. Illegal users can use the security vulnerabilities to obtain additional privileges of computer systems, access or improve their access rights without authorization, damage the system, endanger the computer system. Nowadays the number of vulnerability is growing rapidly and diversified, how to resolve the risk of information security which caused by vulnerabilities effectively has become an important topic in network security. Since the existing defenses such as firewalls, intrusion detection systems and other network security devices can not completely block attacks, preventions of the attacks become increasingly important. Assessing the degree of hazard caused by vulnerabilities, understanding the risk prioritization of the system security vulnerabilities, processing the vulnerabilities more effectively and reducing the harm are very meaningful to the management of network security.