BAYES AĞI VE BULANIK ÇIKARIM SİSTEMİ TABANLI BİR BİLGİ GÜVENLİĞİ RİSK DEĞERLENDİRME MODELİ

Öz

Bu çalışmada, nitel ve / veya nicel riskleri değerlendirmek ve hesaplamak için Bayes ağı ve bulanık çıkarım sistemine dayanan yeni bir bilgi güvenliği risk değerlendirme yaklaşımı ortaya konmuştur. Önerilen model, bir yazılım şirketinin için test süreçlerini analiz etmek üzere geliştirilmiştir. Tehditler, güvenlik açıkları, riskler ve bunların bağlantılarının tanımlandığı bir Bayes ağı tasarlanmış ve her bir risk faktörü için bileşen olasılıkları hesaplanmıştır. Bilgi varlıklarının değerleri, riskleri, olasılıkları ve göreceli risk değerleri için bulanık üyelik fonksiyonları ve bulanık karar kuralları tasarlanmış ve oluşturulmuştur. Son aşamada da, risk değerlerinin etkileri, bulanık toparlama ve durulaştırma işlemleri ile hesaplanmış ve sıralanmıştır. Bu yeni model, kurumlardaki yöneticilerin daha objektif, güvenilir ve esnek bir şekilde bilgi güvenliği risk değerlendirme sonuçları elde etmelerine ve kullanmalarına olanak sağlamaktadır.

Anahtar Kelimeler

• Bilgi Güvenliği Yönetimi,Risk Değerlendirmesi,Bulanık Çıkarım Sistemi,Bayes ağları

AN INFORMATION SECURITY RISK ASSESSMENT MODEL BASED ON BAYESIAN NETWORK AND FUZZY INFERENCE SYSTEM

Öz

This study proposes a novel information security risk assessment approach based on Bayesian network and Fuzzy Inference System in order to evaluate and calculate both qualitative and / or quantitative risks. The proposed model is developed to analyse test processes for a software services company in order to evaluate the information security risks. Threats, vulnerabilities, risks, and their relations are constructed with a Bayesian network and marginal probabilities are calculated for each risk factor. Several fuzzy membership functions and fuzzy decision rules are designed and constructed for assets’ values, risks’ probabilities, and relative risk values. Finally, the impacts of risk values are calculated after the aggregation and defuzzification process. It is shown that this new model enables the business decision makers and managers to obtain more objective, reliable, and flexible information security risk assessment results.

Anahtar Kelimeler

• Information Security Management,Risk Assessment,Fuzzy Inference System,Bayesian networks

Kaynakça

1. Altuzarra, A., Moreno-Jimnez, J., and Salvador, M. (2007). "A Bayesian prioritization procedure for AHP-group decision making". European Journal of Operation Research, 18(1), pp. 367-382.
2. Ariyanti, R., Kusumadewi, S., and Paputungan, I. (2010). "Beck Depression Inventory Test Assessment Using Fuzzy Inference System", Proccedings of IEEE Intelligent Systems. Modelling and Simulation 2010 International Conference, Liverpool, UK, pp. 6-9.
3. Award, G., Suitan, E., Ahmad, N., Ithnan, N., and Beg, A. (2011). "Multi-objective model to process security risk assessment based on AHP-PSO". Modern Applied Science, 5(3), pp. 246-250.
4. Barber, D. (2011). Bayesian Reasoning and Machine Learning. Cambridge University Press, UK.
5. Bayraktarlı, Y., Ulfkjaer, J., Yazgan, U., and Faber, M. (2005). "On the Application of Bayesian Probabilistic Networks for Earthquake Risk Management", Proceedings of 9th International Conference on Structural Safety and Reliability (ICOSSAR 05), Rome, Italy, pp. 20-23.
6. Çiçekli, U. G. and Karaçizmeli, A. (2013). "Bulanık Analitik Hiyerarşi Süreci ile Başarılı Öğrenci Seçimi: Ege Üniversitesi İktisadi ve İdari Bilimler Fakültesi Örneği". Ege Stratejik Araştırmalar Dergisi, 4(1), pp.71-94.
7. Beken S. and Eminağaoğlu M. (2018). “Information Security Risk Assessment using Bayesian Network and Fuzzy Inference System: A Case Study”, ICATCES2018, Proceedings of International Conference on Advanced Technologies, Computer Engineering and Science, May 11-13, 2018, Safranbolu, Turkey, pp: 1-8.
8. Chin, K., Tang, D., Yang, J., Wong, S., and Wang, H. (2009). "Assessing New Product Development Project Risk By Bayesian Network With a Systematic Probability Generation Methodology". Expert Systems with Applications, 36(6), pp. 9879-9890.

9. Committee on National Security Systems. (2010). National Information Assurance (IA) Glossary. Committee on National Security Systems.
10. Denys, P. (2006). "Efficiency of Risk Assessment Methods", Proceedings of IEEE Modern Problems of Radio Engineering, Telecommunications and Computer Science, Lviv, Ukraine, pp. 353-354.
11. Foroughi, F. (2008). "Information Security Risk Assessment by Using Bayesian Learning Technique", Proceedings of the World Congress on Engineering, London, UK, Vol. 1. pp. 133-137.
12. Frigault, M., Wang, L., Singhal, A., and Jajodia, S. (2008). "Measuring Network Security Using Dynamic Bayesian Network", Proceedings of the 4th ACM Workshop on Quality of Protection, Alexandria, USA, pp. 23-30.
13. Fu, S. and Xiao, Y. (2012). "Strengthening The Research for Information Security Risk Assessment", International Conference on Biological and Biomedical Science Advanced in Biomedical Engineering. Vol 9, pp. 386-392.
14. GeNIe Modeler, BayesFusion, LLC, https://www.bayesfusion.com/genie/, Erişim: 20.10.2018.
15. Insight Consulting, Siemens. (2005). "The Logic Behind CRAMM's Assessment of Measures of Risk and Determination of Appropriate Countermeasures". Technical report.
16. ISO/IEC 27001. (2013). Information Security Management Systems. Information Technology, Security Techniques, Geneve, Switzerland.
17. ISO/IEC 27005. (2011). Information Security Risk Management. Geneva, Switzerland.
18. Karabacak, B. and Soğukpınar, I. (2005). "ISRAM: Information Security Risk Analysis Method". Computers & Security, 24(2), pp. 147-159
19. Landoll, D. (2006). The Security Risk Assessment Handbook. Auerbach Publications
20. Lee, M. (2014). "Information Security Risk Analysis Methods and Research Trends: AHP and Fuzzy Comprehensive Method". International Journal of Computer Science & Information Technology. 6(1), pp. 29-45.
21. Mc Neill, F. M. and Thro, E. (1994). Fuzzy Logic: A Practical Approach. Morgan Kaufmann Publications.
22. MATLAB, The MathWorks, Inc., https://www.mathworks.com/products/matlab.html, Erişim: 22.10.2018.
23. NIST National Institute of Standards and Technology. (2011). "Guide for Conducting Risk Assessments". Special Publication 800-30 rev.1, USA.
24. Omar, A. and Herrera, R. (2002). "Graphical Risk Analysis (GRA): A Methodology to Aid In Modeling Systems For Information Security Risk Analysis", pp.1-12.
25. Pitman J. (2006). Combinatorial Stochastic Processes. University of California, Berkeley, USA.
26. Ross, T. J. (2004). Fuzzy Logic with Engineering Applications, 2nd edition. John Wiley & Sons Ltd.
27. Takçı, H., Akyüz, T., Uğur, A., Karabağ, R., Soğukpınar and Soğukpınar, İ. (2010). "Bilgi Güvenliği Yönetiminde Risk Değerlendirmesi İçin Bir Model". Türkiye Bilişim Vakfı Bilgisayar Bilimleri ve Mühendisliği Dergisi, 3(1), pp. 47-52
28. Wang, J., Fan, K., Mo, W., and Xu, D. (2016). "A Method for Information Security Risk Assessment Based on the Dynamic Bayesian Network", IEEE International Conference on Networking and Network Applications, Hakodate, Japan, pp. 279-283.
29. Yong, Q., Long, X., and Qianmu, L. (2008). "Information Security Risk Assessment Method Based on CORAS Frame", IEEE International Conference on Computer Science and Software Engineering, Hubei, China, Vol. 3, pp. 571-574.
30. Yuhan, H., Xiaoyan, C., Linqiao, D., Songsong, Z., Min, W., and Yanxiong, H. (2013). "The Reclamation Soil Suitability Study of the Highway Dumping Site Based on Fuzzy Comprehensive Evaluation Method". Nature Environment and Pollution Technology, 12(1), pp. 51-56.
31. Zhao, D. M., Wang, J. H., Wu, J., and Ma, J. F. (2005). "Using fuzzy logic and entropy theory to risk assessment of the information security", Proceedings of IEEE International Conference on Machine Learning and Cybernetics, Guangzhou, China, pp. 2448-2453.