Information Security Risk Assessment Based on AHP/DST

To enhance the security management on information systems, it is urgent to apply some effective approaches for assessing their security. In this paper, a novel approach, in which analytic hierarchy process (AHP) and Dempster-Shafer theory of evidence (DST) can be combined organically, is presented. In this approach, AHP is applied to acquire all propositions´ basic probability assignments (BPA) based on a large amount of experts´ opinion when assessing the security. Thus, the DST´s ability of dealing with uncertain information and AHP´s performance of quantitative and qualitative analysis may be utilized fully. Furthermore, a hierarchical risk assessment model for the information security is established. Finally, an illustrative example is given to explain the application of the proposed approach and its feasibility.