基于信息流的资产识别及其重要性评估方法研究

摘要

Information assets recognition and its importance assessment is a key step in information security assessments. This paper proposes a method based on information flow to give a solution. Firstly, we use Petri Nets theory to analyze the business process, it is beneifcial for us to recognize assets' nodes and transform all information assets into a directed graph. Secondly, combined with classiifed protection of information system, an algorithm called FrequencyRank is put forward to calculate the value of each node in the directed graph, the value of each node represents its importance in the graph. Experiments show that the solution in this paper can accurately get the importance of each node, and also it is consistent with the actual situation.%信息资产识别及其重要性评估是信息安全风险评估过程中的一个重要环节。文章基于信息流来对以信息处理和信息传递为主的业务流程系统进行资产识别和重要性评估研究。文中首先利用Petri网来分析以信息为处理对象的业务流程系统，识别业务流程中所涉及的信息资产，通过信息传递将不同的信息资产连接起来，这样信息资产就被转化为一个相互连接的有向网络图，然后文章提出FrequencyRank算法并结合信息安全等级保护的内容来对有向网络图中所包含的信息资产节点的重要性进行评估。实验结果表明：文章提出的方案能够准确的计算出信息资产重要性，符合实际的情况。