Belief-based risk analysis

Authors:
Audun Jøsang;Daniel Bradley;Svein J. Knapskog
Affiliations:
Distributed Systems Technology Centre, UQ, Australia;Securizance, Brisbane, Australia;Norwegian University of Science and Technology, Trondheim, Norway
Venue:
ACSW Frontiers '04 Proceedings of the second workshop on Australasian information security, Data Mining and Web Intelligence, and Software Internationalisation - Volume 32
Year:
2004

Citing 2
Cited 6

A logic for uncertain probabilities

International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems
The consensus operator for combining beliefs

Artificial Intelligence

Extending UML Sequence Diagrams to Model Trust-dependent Behavior With the Aim to Support Risk Analysis

Electronic Notes in Theoretical Computer Science (ENTCS)
Perceived risk assessment

Proceedings of the 4th ACM workshop on Quality of protection
Extending UML sequence diagrams to model trust-dependent behavior with the aim to support risk analysis

Science of Computer Programming
Experiences from using a UML-based method for trust analysis in an industrial project on electronic procurement

Electronic Commerce Research
An ontology- and Bayesian-based approach for determining threat probabilities

Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security
Exploring different types of trust propagation

iTrust'06 Proceedings of the 4th international conference on Trust Management

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper describes a method for risk analysis based on the approach used in CRAMM, but instead of using discrete measures for threats and vulnerabilities and look-up tables to derive levels of risk, it uses subjective beliefs about threats and vulnerabilities as input parameters, and uses the belief calculus of subjective logic to combine them. Belief calculus has the advantage that uncertainty about threat and vulnerability estimates can be taken into consideration, and thereby reflecting more realistically the nature of such estimates. As a result, the computed risk assessments will better reflect the real uncertainties associated with those risks.