Abstract:

The existing information security risk assessment approaches commonly ignore the relations among the assessment factors. To overcome the ambiguity and complexity of relations among the factors, and the difficulty of acquiring the correlative fusion weights of attributes in practice, a hierarchical risk assessment model based on Shapley entropies and Choquet integrals is proposed. By introducing the Shapley value concept of nperson cooperative game theory into the assessment model, this approach solves the information security risk assessment problem under poor information conditions by using the analytic hierarchy process with Choquet integrals from bottom to top, which is based on the maximum Shapley entropy principle. The effectiveness of the proposed approach is illustrated via an actual information security risk assessment for four subnets of the intranet in a community.

Key words: information security, risk assessment, Shapley entropy, Choquet integral, analytic hierarchy process