Approach for information systems security situation evaluation using improved FAHP and Bayesian network

An approach for the information systems security situation assessment based on an improved FAHP and Bayesian network was proposed to solve the problem of obtaining the risk grade. The improved FAHP was used to quantify the factor of attack severity which was hard to scale. Simultaneously, the conditional probability matrices for all factors were defined with the expert knowledge. Then a model for information security situation assessment was established by the Bayesian network inference, and the corresponding approach was presented. Finally, an illustrative instance was given to demonstrate its rationality and feasibility. Thus it may provide a new way for assessing information systems security situation.