A Quantitative Risk Assessment Model Involving Frequency and Threat Degree under Line-of-Business Services for Infrastructure of Emerging Sensor Networks.
The prospect of Line-of-Business Services (LoBSs) for infrastructure of Emerging Sensor Networks (ESNs) is exciting. Access control remains a top challenge in this scenario as the service provider's server contains a lot of valuable resources. LoBSs' users are very diverse as they may come from a wide range of locations with vastly different characteristics. Cost of joining could be low and in many cases, intruders are eligible users conducting malicious actions. As a result, user access should be adjusted dynamically. Assessing LoBSs' risk dynamically based on both frequency and threat degree of malicious operations is therefore necessary. In this paper, we proposed a Quantitative Risk Assessment Model (QRAM) involving frequency and threat degree based on value at risk. To quantify the threat degree as an elementary intrusion effort, we amend the influence coefficient of risk indexes in the network security situation assessment model. To quantify threat frequency as intrusion trace effort, we make use of multiple behavior information fusion. Under the influence of intrusion trace, we adapt the historical simulation method of value at risk to dynamically access LoBSs' risk. Simulation based on existing data is used to select appropriate parameters for QRAM. Our simulation results show that the duration influence on elementary intrusion effort is reasonable when the normalized parameter is 1000. Likewise, the time window of intrusion trace and the weight between objective risk and subjective risk can be set to 10 s and 0.5, respectively. While our focus is to develop QRAM for assessing the risk of LoBSs for infrastructure of ESNs dynamically involving frequency and threat degree, we believe it is also appropriate for other scenarios in cloud computing.
College of Information Engineering, Northwest A & F University, Yangling 712100, China. jingxu@nwsuaf.edu.cn.|Department of Computing, The Hong Kong Polytechnic University, Hong Kong 999077, China. jingxu@nwsuaf.edu.cn.
Xu
X
Jing
College of Information Engineering, Northwest A & F University, Yangling 712100, China. Heaven_hu@yeah.net.
Hanwen
H
Hu
College of Information Engineering, Northwest A & F University, Yangling 712100, China. yhj740225@nwsuaf.edu.cn.
Huijun
H
Yang
Department of Computing, The Hong Kong Polytechnic University, Hong Kong 999077, China. csallen@comp.polyu.edu.hk.
Man Ho
MH
Au
College of Information Engineering, Northwest A & F University, Yangling 712100, China. lsq_cie@nwsuaf.edu.cn.
Shuqin
S
Li
Department of Mathematics and Computer Science, Northeastern State University, Tahlequah, OK 74464, USA. dnxiong@ieee.org.
Naixue
N
Xiong
College of Computer and Information Sciences, Almuzahmiyah, King Saud University, Riyadh 11451, Saudi Arabia. cimran@ksu.edu.sa.
Muhammad
M
Imran
Department of Computer Science, Electrical and Space Engineering, Lulea University of Technology, Lulea 97187, Sweden. th.vasilakos@gmail.com.
Athanasios V
AV
Vasilakos
access control; cloud computing; intrusion effort; line-of-business services; risk assessment