Transactions on Computer Science and Technology December 2013, Volume 2, Issue 4, PP.77-83
The Study of the Optimal Method for Tibetan Information System Security Resource Allocation Nan Yang+, Guangrong Shan College of Mathematics and Computer Science, Northwest University of Nationalities, Lanzhou 730030, China †
Email: 906968817@qq.com
Abstract In order to improve the accuracy of Tibetan information system security investment, given the characteristics of Tibetan information resources, using the theory and method of complex network, from the characteristics of information resources based on the perspective of Tibetan language, established safety resource allocation model based on attacking propagation and the risk of security investment. Based on the model, simulation experiments, the result shows that the model can be used for Tibetan information system to attack the effective protection from attack propagation, to improve the accuracy and practicability of the safety investment of the system. Keywords: Complex Network; Tibetan Information Resources; Attack Propagation; Security Investment
1 Introduction Nowadays the rapid development of Internet technology, no doubt, the information resources in the network become part of the assets of the country. The Tibetan language is widely used as a national language, in the country's political status and influence has received national attention, Tibetan information resources in the network is an important part of national culture. However, along with the network popularization, the information resource system is becoming more and more complex attack. Complex network is a general abstraction and description of complex system, the complex system of individual as a node of the network, the interaction among individuals as the network edge, by a large number of nodes and edges that form a complex system called complex network[1]. However, Tibetan information system constructed that based on complex network, still can not get rid of complex network systems the most important and fundamental characteristics: Robust yet fragile. So complex network topologies and anti-attack is also a research hot spot nowadays. Global Information Security Survey results show, for the amount of complex network information system is greater than100, if want to achieve the desired anti-aggressive primary solution is security optimal allocation of resources[2][3][4]. While the strategy implementation and execution in view of the complex network of different topology stability also decides the security of information system[5][6][7].In view of this, the accuracy of safety allocation plays a very important role in the risk invulnerability of Tibetan information system for defense against the attack.
2 The risk of the optimal allocation of resources model The risk of system resource allocation,, we must discuss the extent of the potential risks of their systems. First set without regard to the spread of sexual assault, a limited number of attacks suffered by the system and remains unchanged. +
This paper is supported by “Special funds of national scientific research in Universities” and “graduate innovation project of Northwest University for nationalities”(No. ycx13162). - 77 http://www.ivypub.org/cst
In this case, protection against systemic risk safe investment model definition: Definition 1: Let the total amount of the attacks is N, the probability of successful attackers to c (system i successful attack on a single system with probability ci), overall system losses suffered after being attacked as s (System i after being attacked the loss suffered as a si), then set the overall system risk is R = Ncs, the risk of a single system for the R = Ncisi. Where c is the function with the probability of attacks -- t, the system risk vulnerability -- m and the risk of security investment -- n. For a given system, probability of attack t occurred with the attackers themselves, but can determine, with the growth of t, c is on the increase. The system the vulnerability m depends on the system vulnerability and the topological structure of network, like t, c is also with the increase in. The risk of security investment n, the probability of successful attack c decreases with the increase of n. According to the results[8], although the greater of risk security investment the more secure the system is, its safety c2 0. t 2 Definition 2: the risk of security investment n can be divided into single system investment x and overall system investment y(n(x, y)=x+y). The security of single system and the security of overall system in the whole information system network are as follows:
growth rate is gradually reduced, such as the formulas:
Ft x e x , x 0, 0 Fz y e y , y 0, 0 Ft ( x) as a function of security investment for a single system threat effect on the whole information system of network survivability; Fz ( y) as a function of security investment for the overall system threat effect on the whole information system of network survivability; α and β coefficient for risk security investment impact on the whole information system of network survivability.
For Ft ( x) and Fz ( y) need to meet the following several characteristics: 1.0 Ft 1;0 Fz 1 2.Ft (0) 1; Fz (0) 1
.. 4.
d Ft dx
0;
d Fx dy
0;
d F2
t
d x2
0;
d F2
x
d y2
0
For a given number of security investment, the greater the risk coefficient , the smaller the risk of the whole system. Because of security investment according to the overall threat to protect the whole information system, and the security investment for a single system threats, sometimes can reduce the risk of the whole information system network, Therefore, this paper holds that the overall system security investment is more effective than single system security investment, i.e . Let σ as the overall system’s attack accounted for the proportion of the total attacks(N), can get a return on investment function: T ( x, y) mtS (1 Ft ( x) Fz ( y)) (1 )mtS (1 Ft ( x)) ( x y)
In accordance with the actual situation, the investment should be less than the return, so whether security risk investment for overall or single system, its returns must have a boundary condition, T ( x, y 0) 0. y
3 The security protection with the spread of attack - 78 http://www.ivypub.org/cst
T ( x 0, y) 0 ; x
In this paper, the spread of attack can be defined as the use of effective attacks on the system, can be derived from subsequent effective attacks on the associated with the system. In considering the propagation of attack, for the system security risk can be defined as NciS, and for the whole network security risk of Tibetan information system can a
be defined as N ciS (S is the whole system’s losses). If we do not consider the propagation of attack, which does i 1
not consider the relevance between systems, then S = si. If we consider the propagation of attack, and effective attack spread only once, then S (s i
a
k
r 1; r i
s ) (k is the
ir r
probability between system i and system r which associated system is effectively attacked). Considering the above conditions, the following conclusions can be proved: A. Do not consider the safety risk assessment system transmitted attack will be too low. Proof: if kir 0, r i, k 1,2, , a
S (s i
a
k
r 1;r i
s ) si
ir r
a
a
i 1
i 1
N ci S N ci si B. The effect of overall system security risk protection combined with the effect of single system security risk protection not less than the security risk protection for single system. Proof: Without considering the situation of whole system risk investment(y=0), but consider the whole system risk investment optimal model y*∈[0, E ].So, let the whole system without considering venture capital as a special case of considering the whole system of risk investment .Because of T ( x , y ) T ( x , y 0) , propositions syndrome. Assuming the security budget is E=x+y, where x, y are not independent of each other, and all the Tibetan information systems have the same return. The di=NciS, in this case: The return for single system protection :
y0 T ( x) m t S(1 e x ) (1 )m t S x
(1)
Suppose that for each system investment is the same and can ensure the safety of the one, when T(x) is the biggest,
dT 0 dx | x x i
.
It shows that
xi
a d 1 1 a ( ln ln i ) . i 1 （1 - ）mtsi a j 1 d j
1
(2)
The return for the overall system protection combined with the single system protection: Cause E=x+y, the function is transformed into a binary function:
xEy T ( y) mtS (1 e( ) y E ) (1 )mtS (1 eE y ) E When T(y) is the biggest,
dT 0. dy | y y ' - 79 http://www.ivypub.org/cst
(3)
We can know that y
1
ln
( a ) . (1 )
(4)
According to the character of T(y) shows that y ' is maximum of T(y). Therefore, at this time xi should be the following formula: xi*
1
[E
1
ln
d ( a ) a 1 1 a ln ln i ] (1 ) i 1 (1 )mtsi a j 1 d j
(5)
(5) show that the security configuration taking into account factors to achieve the optimization of Tibetan information resources. (2) stated that how the single Tibetan information system arranges its system protection. To configure the Tibetan information resource system need to Consider two points: one is considered investment allocation for the security of a single system and the overall system; the other is that α, β on security resource allocation decision play a important role. In addition, the safety of Tibetan resource allocation decision is not only decided by the initial risk of Tibetan information system, but also decided by the twice risk which is brought of the risk’s spreading. Therefore, the overall system protection combined with the single system protection can get more protective effect on security.
4 The process of security allocation In practice, the security budget can not be unlimited, so need to focus on the larger part of the risk protection. For a single system protection, security budget is not for all the Tibetan information system in each single system protection for the system, in accordance with a high degree of importance to protection. Similarly, in the overall system and the single system protection combination of circumstances, should first meet the needs of the overall system protection, for the single system according to the important degree of protection. First of all, the single system look as nodes of overall system in complex networks, and then use the neighborhood nodes important degree algorithm[9] based on the rank of importance, finally draws the priority sequence for protection. The algorithm is as follows:
xi , i 1,2, , a; // node repeat { d ( xi , x j ); // optimal path C (i )
1 a
d ( xi , x j )
;
j 1
i ; // neighbourhood of xi xh , x j hj (i ), hj (i ); // the number of the optimal path not after the node xi k
k
S (i ) hj (i ); h
j
k
k
h
j
B(i ) hj (i ); K (i ) D(i )
S (i ) ; S (i ) B(i ) 1 a
d (x , x ) j 1
i
*
S (i ) ; S (i ) B(i )
j
} - 80 http://www.ivypub.org/cst
5 Simulation experiment In the simulation experiment, construct a environment based on complex network information system, the number of its system consistent with the typical environment, i.e. a=200; Combined with other numerical experiments and within statistical cycle experts, can give the following definition: system vulnerability m=0.9; the overall attack rate σ=0.46; The total number of attack N=89440; the security budget E=2.7 millions; influence coefficient α=0.02, β=0.01; S follow gaussian distribution N(300,1002). In the same experimental environment, comparing the model to experimental, selected for Gordon’s resource allocation model[10].(dashed line is the experimental model, solid lines is the Gordon’s resource allocation model) Protection of single system:
FIG. 1
FIG. 2
Figure 1, Figure 2 is the comparison of the model and the Gordon’s model while single system protection, the figures show, this method compared with the Gordon’s model is more optimization. In addition, we can see when investment is very low this model still can guarantee some systems are away from risk, and the way resource distribution to ensure reduce certain risks when the total number of single system in the whole system is greater. The overall system protection combined with the single system protection: - 81 http://www.ivypub.org/cst
FIG. 3
FIG. 4
Figure 3, Figure 4 are the comparison between the overall system with the single system protection based on the model and Gordon’s model under the condition of protection. The level of risk investment shows, the low risk system with the combined protection has more notable effect. The view of risk ratio, considering the propagation of the attack, the model in this paper compared with the Gordon model, can clearly let us know that it is optimized.
6 Conclusion This paper is based on the attack propagation and the risk of security investment, to achieve better security allocation of Tibetan information resource between the complex network, established safety resource allocation model of Tibetan information system. And verify the protective effect of overall system protection combined with single system protection no less than the protective effect of the single system protection alone, and the method in this paper is the optimal security resource allocation method for complex network of Tibetan information system. The proposed model as other models, based on the assumption, the reasoning and certain data, there is still the need to continue to study to solve the problem. Therefore, in the following work, I will continue verifying the effectiveness of the experimental model.
REFERENCES [1]
Zeng Jian,Zhang Yifang. “Social Synergetics[M].” Beijing:Science Press,2000.06 - 82 http://www.ivypub.org/cst
[2]
Briney A.2004 industry survey[J ].Information Security Magazine, 2004,vol28(12) : 34-46
[3]
Dlamini M T .Information security: The moving target[J ]. Computers and Security, 2009, vol28 (3) : 189-198
[4]
Hamill J, Deckro R. Evaluating information assurance strategies[J ]. Decision Support Systems, 2005, vol39(3) : 463-484.
[5]
Rivas A L , Fasina F O , Hoogesteyn A L , et al. Connecting Network Properties of Rapidly Disseminating Epizoonotics [J]. PLoS One , 2012 , vol7(6): e39778
[6]
Hasegawa T , Konno K , Nemoto K. Robustness of Correlated Networks against Propagating Attacks [J]. The European Physical Journal B,2012,vol85: 262
[7]
Li Huaxin, Gao Chao. Network Immunization Strategies in Complex Networks[J]. Journal of Jilin University (NATURAL SCIENCE EDITION) , 2013, vol51(3) : 444-452
[8]
Huang C D, hu Q,Behara R S. In Search for Optimal Lever of Information Security Investment in Risk-Averse Firms[C]//[s.n] Procceedings of the Third Annual Security Symposium: Information Security in the Knowledge Economy,Tempe,Arizona,2005.
[9]
Zhang Binwu, Zou Sen, Wang Qin. Determination method of node importance in complex networks[J]. Journal of Lanzhou University of Technology, 2013, vol39(3): 85-87
[10] GordonL A, LoebM P.The economics of information security investment[J].ACM Transactionson Information and System Security, 2002, vol5(4): 438-457
AUTHORS 1
2
research area: network database and information security.
professor, research area: network database and information
Email: 906968817@qq.com
security. Email: 58552559@qq.com
Nan Yang (1991- ) Female, Han nationality, postgraduate,
Guangrong Shan (1964- ) Male, Hui nationality, bachelor,
- 83 http://www.ivypub.org/cst