Research On Evaluation Of Vulnerability Severity Based On Rough Sets Theory And Attributes Reduction

The network information technology has been spread rapidly, which makes the network security problems become the focus of attention. The vulnerability is one of the main fuses of security incidents. However, vulnerability is unable to be eliminated at the source. So it is necessary to research on vulnerability. Vulnerability severity assessment is not only an important part of vulnerability research, but also the basis of vulnerability management and the repair work.On the basis of the current vulnerability severity assessment methods, this paper research on the problems that the current methods are too reliant on prior knowledge in selecting vulnerability attributes, attributes weight calculation is unpersuasive and comprehensive severity assessment. This paper around the following points:(1) We summarize and analyze the current widely used vulnerability severity assessment methods after describing the details about the development of vulnerability research.(2) Selecting vulnerabilities attributes is objective. Most current assessment methods depend too much on prior knowledge, which can result in a consequence that the attributes selection is too subjective and lack the persuasiveness. A new method based on the discriminate matrix and the dependency of attributes towards vulnerability attributes reduction is proposed, on the basis of rough sets data reduction. The method which is based on vulnerability data can objectively select vulnerability attributes by reduction calculation, no longer depending on prior knowledge to select vulnerability assessment attributes.(3) Vulnerability severity assessment method (RAR). On the basis of vulnerability reduction method to select attributes, this paper not only describes the concrete process of the calculation of attributes weights, but also obtain the qualitative and quantitative results of vulnerability through the comprehensive assessment algorithm. In order to verify the accuracy and effectiveness of the vulnerability severity assessment method, we perform an evaluation experiment and compare the method proposed in this paper with the authoritative assessment methods.(4) Designing and implementing vulnerability assessment system. According to the vulnerability assessment method, we design and implement a vulnerability assessment system to realize the value of RAR method.