Evaluation of the Dynamic Cybersecurity Risk Using the Entropy Weight Method

Abstract

The risk assessment of any network or security systems has a high level of uncertainties because usually probability and statistics were used to evaluate the security of different cybersecurity systems. In this book chapter, we will use Shannon entropy to represent the uncertainty of information utilised to calculate systems risk and entropy weight method since the weight of the object index is normally used and points to the significant components of the index. We evaluate the risk of security systems in terms of different vulnerabilities and protections existing in each host. A new methodology was developed to present an attack graph with a dynamic cost metric based on a Dynamic Vulnerability Scoring System (DVSS), and also a novel methodology to estimate and represent the cost-centric approach for each host’s states was followed up.

A framework is carried out on a test network, using Shannon entropy with the Nessus scanner to detect known vulnerabilities, to implement these results and to build and represent the dynamic cost-centric attack graph. We used the results to represent possible risks as a matrix. At the next stage, the proposed risk’s matrix was normalised to calculate the entropy and the entropy weight. Finally, the weight and the path will be used to evaluate and calculate the total risk in the system and suggest to the system administrator a clear guidance on the vulnerable security entities. We try to develop a novel approach to suggest the cybersecurity approach that is suitable for the majority of cyber systems by introducing the term security entities.