Software security assessment method of complex software system based on supply chain

Abstract

The invention provides a software security evaluation method of a complex software system based on a supply chain. The method comprises the following steps of: acquiring a plurality of security elements affecting the security of a complex software system; obtaining scores for each security element based on historical expert experience data and / or observation data; mapping the rating of each security factor to the basic belief assignment (BBA) data in the D-S evidence theory by a belief conversion function, and fusing the BBA of all the security factors at the decision level to obtain the global BBA result data of the complex software system, and judging the security of the complex software system according to the global BBA result data. The method can accurately and flexibly evaluate the security of the complex software system, eliminate the unreliable security evaluation, and clearly embody the evaluation of the security of the software system.

Description

technical field [0001] The invention relates to the field of software system security assessment, in particular to a software security assessment method for complex software systems based on supply chains. Background technique [0002] Cyberspace has become the fifth space of national sovereignty after land, sea, air, and space, and its security faces huge challenges. With the continuous development of information technology, as an important element in cyberspace, the complexity of software systems is increasing, and its security assessment is becoming more and more complicated. [0003] Currently, supply chain-based software security assessment schemes have been extensively studied. The procedures for auditing supply chain management mainly include: [0004] First, check the articles of association, documents, etc. of the enterprise to confirm whether the enterprise has formulated supply chain management policies, whether it has established management procedures and other...

AI Technical Summary

Problems solved by technology

[0011] 2. In the process of evaluating software elements, experts usually evaluate them in natural language, and the evaluation results are somewhat ambiguous. How to properly evaluate and characterize software elements is a challenge;

[0012] 3. For the evaluations of multiple experts, there may be inconsistencies between the evaluations, how to properly handle the contradictions between the evaluations, and eliminate unreliable evaluations without giving an appropriate plan

Images