一种信息系统业务波及影响评估方法

doi:10.19665/j.issn1001-2400.2021.04.024

摘要/Abstract

摘要：

为有效地评估业务连续中断对信息系统造成的影响,提出一种信息系统业务波及影响评估方法。首先,识别系统主要业务并量化其脆弱性;然后,以业务为网络拓扑节点并基于业务重要性值对节点赋权,以业务间有序关联为边并基于资产-业务关联对边赋权;最后,根据有向加权网络结构熵方法评估业务中断至恢复时间段内信息系统受影响的程度。实验结果表明,这种方法在评估准确性方面与其他方法相比有明显优越性,在保障信息系统安全方面具有一定应用价值。

关键词: 脆弱性, 波及影响, 业务流程, 网络拓扑, 网络结构熵

Abstract:

To effectively analyze the impact of continuous business interruption on the information system,an information system business affecting impact evaluation method (IBAIE) is proposed.First,we identify the main businesses of the system and quantify their vulnerability.Then,we take the businesses as the nodes of network topology and weight nodes based on the business significance.The orderly association between businesses is taken as the edges which are weighted based on the association between asset and business,and the directed weighted business network topology is obtained.Finally,the method of directed weighted network structure entropy is used to evaluate the change of system business network structure during the period from business interruption to recovery.Experiments show that this method has obvious advantages in evaluating accuracy compared to other methods,and can be applied in ensuring information system security.

Key words: vulnerability, affecting impact, business process, network topology, network structural entropy

中图分类号:

TP309

谢丽霞,白宇. 一种信息系统业务波及影响评估方法[J]. 西安电子科技大学学报, 2021, 48(4): 184-191.

XIE Lixia,BAI Yu. Information system business affecting impact evaluation method[J]. Journal of Xidian University, 2021, 48(4): 184-191.

图/表 9

图1

图2

图3

图4

表1

图5

图6

表2

图7

参考文献 16

[1]	CATELANI M, CIANI L, VENZI M. RBD Model-Based Approach for Reliability Assessment in Complex Systems[J]. IEEE Systems Journal, 2019, 13(3):2089-2097. doi: 10.1109/JSYST.4267003
[2]	范洲平. ISO22301:2012业务连续性管理体系标准解读[J]. 中国标准化, 2012(9):76-79.
	FAN Zhouping. Interpretation of ISO 22301:2012 Societal Security-Business Continuity Management Systems-Requirements[J]. China Standardization, 2012(9):76-79.
[3]	杨宏宇, 韩越. 基于动态信誉的无线Mesh网络安全路由机制[J]. 通信学报, 2019, 40(4):195-201.
	YANG Hongyu, HAN Yue. Wireless Mesh Network Secure Routing Mechanism Based on Dynamic Reputation[J]. Journal on Communications, 2019, 40(4):195-201.
[4]	杨宏宇, 王在明. Android共谋攻击检测模型[J]. 通信学报, 2018, 39(6):27-36.
	YANG Hongyu, WANG Zaiming. Android Collusion Attack Detection Model[J]. Journal on Communications, 2018, 39(6):27-36.
[5]	ZOLANVARI M, TEIXEIRA M A, GUPTA L, et al. Machine Learning-Based Network Vulnerability Analysis of Industrial Internet of Things[J]. IEEE Internet of Things Journal, 2019, 6(4):6822-6834. doi: 10.1109/JIoT.6488907
[6]	HARIYANTI E, DJUNAIDY A, SIAHAAN D O. A Conceptual Model for Information Security Risk Considering Business Process Perspective[C]//Proceedings of the 2018 4th International Conference on Science and Technology (ICST).Yogyakarta:Indonesia, 2018:1-6.
[7]	董慧宇, 唐涛, 王洪伟. 基于二维结构熵的CBTC系统信息安全风险评估方法[J]. 自动化学报, 2019, 45(1):153-162.
	DONG Huiyu, TANG Tao, WANG Hongwei. A 2D Structure Entropy-based Approach to Security Assessment of Communication-based Train Control System[J]. Acta Automatic Sinica, 2019, 45(1):153-162.
[8]	杨宏宇, 王峰岩. 基于无监督多源数据特征解析的网络威胁态势评估[J]. 通信学报, 2020, 41(2):143-154.
	YANG Hongyu, WANG Fengyan. Network Threat Situation Assessment Based on Unsupervised Multi-Source Data Feature Analysis[J]. Journal on Communications, 2020, 41(2):143-154.
[9]	杨宏宇, 张旭高. 基于自修正系数修匀法的网络安全态势预测[J]. 通信学报, 2020, 41(5):196-204.
	YANG Hongyu, ZHANG Xugao. Self-Corrected Coefficient Smoothing Method Based Network Security Situation Prediction[J]. Journal on Communications, 2020, 41(5):196-204.
[10]	SUN Y, WU T Y, LIU X, et al. Multilayered Impact Evaluation Model for Attacking Missions[J]. IEEE Systems Journal, 2016, 10(4):1304-1315. doi: 10.1109/JSYST.2014.2344048
[11]	MUKHERJEE P, MAZUMDAR C. “Security Concern” as a Metric for Enterprise Business Processes[J]. IEEE Systems Journal, 2019, 13(4) :4015-4026. doi: 10.1109/JSYST.4267003
[12]	慕彩红, 柴文壹, 刘逸, 等. 一种改进的网络鲁棒性与有效性增强方法[J]. 西安电子科技大学学报, 2018, 45(4):6-11.
	MU Caihong, CHAI Wenyi, LIU Yi, et al. Improved Approach to Enhancing the Robustness and Effectiveness of Networks[J]. Journal of Xidian University, 2018, 45(4):6-11.
[13]	吴俊, 谭跃进, 邓宏钟, 等. 无标度网络拓扑结构非均匀性研究[J]. 系统工程理论与实践, 2007, 27(5):101-105.
	WU Jun, TAN Yuejin, DENG Hongzhong, et al. Heterogeneity of Scale-free Network Topology[J]. Systems Engineering-Theory & Practice, 2007, 27(5):101-105.
[14]	蔡萌, 杜海峰, 任义科, 等. 一种基于点和边差异性的网络结构熵[J]. 物理学报, 2011, 60(11):157-165.
	CAI Meng, DU Haifeng, REN Yike, et al. A New Network Structure Entropy Based Node Differenceand Edge Difference[J]. Acta Physica Sinica, 2011, 60(11):157-165.
[15]	XIE J, GAO J, GAO Z, et al. Modeling and Analysis of Linkage Fluctuation for Industrial Process Based on Complex Network Theory[C]//Proceedings of the 2016 Annual Reliability and Maintainability Symposium (RAMS).Piscataway:IEEE, 2016:1-7.
[16]	VARELA-VACA Á J, PARODY L, GASCA R M, et al. Automatic Verification and Diagnosis of Security Risk Assessments in Business Process Models[J]. IEEE Access, 2019, 7:26448-26465. doi: 10.1109/Access.6287639

参数	R_C₁	R_C₂	R_C₃	R_C₄	R_C₅	R_I₁	R_I₂	R_I₃	R_I₄	R_I₅	R_A₁	R_A₂	R_A₃	R_A₄	R_A₅
服务	1	1	1	2	25	1	1	1	3	24	1	1	1	1	26
数据	1	1	2	3	22	1	4	2	1	22	1	1	1	2	25
设备	2	2	1	4	21	1	1	2	5	21	1	1	2	4	22
人员	1	2	4	5	18	2	2	3	3	20	2	2	4	5	17

时间/min	发生中断业务
0	无
5	B₇
10	B₇、B₈
15	B₆、B₈、B₉
20	B₆、B₈
25	B₈、B₉
30	B₄、B₉
35	B₄
40	无