基于主成分分析法的信息资产安全价值识别研究

在信息安全风险评估工作中,资产、威胁、脆弱性是三大主要风险因素。其中资产作为衍生出脆弱性的母体、威胁的作用对象,使得信息资产识别成为信息安全风险评估工作的核心环节。根据信息资产的特点,按照"资产集合"的思想对信息资产进行分析;然后,运用专家调研法和条件广义方差极小法,从现有的信息安全风险评估指标体系中筛选出适用于被评估系统特点和主成分分析法的指标体系;最后,运用主成分分析法对信息资产的安全价值进行识别、赋值。整个过程大大减少了资产属性关联性、专家的主观因素对于评估结果的影响。

To Study on Information Assets' Security Value Identification Based on Principal Component Analysis

During the working of information security risk assessment, assets、threats and holes are the three most important element. There are assets which holes derive form and threats act on, enable information assets analysis becomes the key link of the information security risk assessment. First, On the basis of information assess' characteristics, analyses the information assets according to the thought of assets set. Then using the method of Delphi and Conditional generalized minimum variance, filtrates the indicator system which fit the system assessed and the principal component analysis from the existing indicator system. Finally, identifies and evaluates the security value of the information assets by using principal component analysis. It sharply reduce the properties' relationship of the assets and the influences form the experts' subjective factors through the whole process..