Risk assessment of information system using the shell theory and attack graph

In order to improve the accuracy of risk assessment of corporate networks, the paper introduces the concept of network shell into the field of security risk assessment. After analyzing the actual needs of corporate networks, we give the risk assessment model of network shell, then based on this model we analyze the application of network shell and give the algorithm to repair the network shell through the attack graph. After that, a calculation method of the integrated value of network shell is given. Finally, an example is given to verify the validity of assessment model.