Risk words suggestion for information security audit by Bayesian inference

摘要

We present risk word suggestion for enabling an auditor to identify potential risks based on words of identified risks in an audit report. Once the auditor describes the identified risks in the report, words related to the potential risks are inferred with words in the description of the identified risks, and suggested to the auditor. For the word inference, we assume that words of potential risks and identified risks are related to each other, and by applying Bayesian inference we reveal the relation between the words. In our evaluation experiments with real five cases, Bayesian inference can suggest the words for identifying potential risks. Furthermore, two auditors can accurately identify potential risks by the suggested words.