A qualitative and quantitative risk assessment method in software security

Focusing on the software security risk assessment, this paper adopts the combination of the attack tree model analysis and the Bayesian Network analysis, which takes the advantage of both qualitative analysis and quantitative analysis to assess risks of software security. By the construction and pruning of the attack tree model, this method narrow down the scope of threats that are generated by software system at first. With a preliminary control of risk probability, and through the prior probability value, the conditional probability table and the Bayesian formula, this method can assess the risk probability of the software system accurately. Finally the risk assessment method makes up the deficiency of single risk assessment method, won more accurate evaluation results. It can obtain the software project risk rank more accurate and carries on the defense and the recovery to the risk partial modules.