Research Of Risk Analysis Model Based On Rewriting System

More and more attention is paid to risk analysis with the increasingly serious security problem of computer system. It is of great importance and value to study the automation of the computer risk analysis because of its complexity and need of real time. Risk analysis is now in its third phase of development characterized by model driven. Model based on term rewriting provides an algebra specification for the realization of risk analysis. But the existing risk analysis model based on term rewriting ignores the induction procedure from risk to decision, and makes it easy to propagate the potential vulnerability.This paper analyzes and develops the existing risk analysis model bases on term rewriting system. It divides the group of assets into critical and normal subset, and performs the analysis in separate procedure. This reduces the system complexity, guarantee the priority of the critical assets; it also introduces and/or attack tree into the attack scenario, cut down the system requirement of space, and provides support for both the coming graph rewriting model and decision selection algorithm. In the former rewriting model the system environment is the cause of action change, but in the improved model it is used as the state information, which denotes the system risk. The improved model ITRS-RA is shown to be terminating, and confluent under a certain condition.Based on the algebra specification of term rewriting model, this paper builds the attack scenario and performs the risk analysis in the way of graph rewriting. Also with the help of graph rewriting, a new decision selection algorithm is proposed. This algorithm takes advantage of the weighted vertex cover algorithm, finds the vertexes with different color, and puts the minimum one into the group of chosen by sequence. Practically it is shown that this decision selection algorithm makes better choice in the mean cases.Also a design of risk analysis system is proposed finally. cover algorithm...