A Method of Security Evaluation based on Fuzzy Mathematics

In order to effectively evaluate the system security, a quantitative information security evaluation method which combine analytic hierarchy process (AHP) and fuzzy comprehensive evaluation were proposed. Firstly, referring to Common Criteria (CC), we established security evaluation hierarchy model. Then, the analytic hierarchy process (AHP) method was used to calculate the security factors' weights to the evaluated system. In the end, fuzzy comprehensive evaluation method was applied to calculate the final quantitative security level. The effectiveness of this method is validated by evaluation of a practical system.