基于概率组合方法的网络安全系统性风险评估：拓扑、异质与相依

网络安全系统性风险评估在网络安全风险管理中扮演着关键角色。本项目拟开展一般确定性拓扑结构下系统性风险评估的研究，并聚焦于已有相关研究中忽略的两个关键因素：节点类型异质和节点风险相关性。为此，我们提出了一个概率组合化风险传播模型：多类型k-跳模型。在该模型下，主要研究网络节点集群（同类型节点集合）风险精确评估、节点集群风险相依性评估（定性和定量）、大规模网络节点集群风险近似评估（如确定性网络拓扑结构下边渗流阈值解析和模块网络风险近似）以及上述模型和理论在故障传播系统可靠性与网络安全保险定价问题中的应用。以期通过上述研究，进一步完善网络安全系统性风险评估理论和方法并形成新的研究点。

Systematic risk assessment of cybersecurity plays a key role in cybersecurity risk management. This project intends to carry out a systematic risk assessment study under a general determinate topology and focus on two key factors that have been ignored in related existing research: heterogeneity of node types and dependence of node risks. To this end, we propose a probabilistic combination model: a multi-type k-hop risk propagation model. Under this model, we study the precise assessments of joint risks of node clusters (sets of different types of nodes) and both the qualitative and quantitative dependence of risks among clusters and the approximate assessment of large-scale networks. The applications of our model and theory in the reliability of fault propagation system and the pricing of cyber security insurance are investigated as well. It is hoped that through the above studies, the theory and methods of systematic risk assessment could be further improved and new research topics could be formed.