## 4 Evaluation Technique of Database Security  
It is easy to see that with known values of the probability of an undesirable incident (threat realization) \(P_{l}=P_{l_{i}}.P_{\gamma_{\psi}}\), the amount of damage (loss) \(L_{l}\) (with the successful implementation of the threat in relation to the protected object), the degree of corresponding security measure resistance \(R_{l}\), it is possible to evaluate the database security using Equation (4). However, obtaining accurate \(P_{l_{i}}\), \(P_{\gamma_{\psi}}\), \(L_{l}\), and \(R_{l}\) values is not an easy task. This is often not possible in practice [58]. In addition, to paraphrase [PERSON] [65], as system complexity increases, analytical precision decreases [35]. Therefore, as a rule, in such cases it is advisable to resort to numerical estimates in a certain range of values, especially since each quantitative range can be associated with a certain qualitative scale, with which under certain conditions it is much easier to work. A linguistic variable can serve as a suitable structure for expressing such values, as noted above. For these reasons, first of all, in accordance with the introduced changes in the model, we will redefine the security \(B\) barriers, each of which (\(b_{l}\in B\)) will be represented as a composite linguistic variable, the components of which are linguistic variables:  
* The probability of threat occurrence (\(P_{l}\));
* The probability of exploiting the vulnerability (\(P_{\gamma}\));
* The amount of damage (\(L\)) in case of successful implementation of the threat in relation to the protected object;
* The degree of security measure resistance (\(R\)), characterized by the probability of overcoming it. At that, again, we note that these components are assessed in the context of the specific barrier that they form (the \(P_{l}=f(P_{l_{l}},P_{\gamma_{\psi}})\), \(L_{l}\), \(R_{l}\) indices are the same as the barrier index, and not the same as those of the \(b_{l}=(t_{i},\gamma_{\psi},o_{j},w_{k})\) barrier components in the basic security system--threats, vulnerabilities, objects, and security measures). We begin formalizing the corresponding components with the probability of a threat occurrence \(P_{l}\). At the same time, we note that in practice, to calculate the risk, it is often not the mathematical probability that is used, but the approximate frequency of its implementation over a certain period. To avoid confusion, the standards deliberately use the concept of _likelihood_ instead of the mathematical term _probability_. In what follows, we will use exactly this term. In view of the above, the likelihood of a threat occurrence \(P_{l}\) can be represented as a linguistic variable:  
\[\langle name,T,X,G,M\rangle \tag{5}\]  
where _name_ is the name of the linguistic variable (in our case, this is the likelihood of a threat occurrence \(P_{l}\)); \(T\) is a set of values of a linguistic variable (term-set), which are the names of fuzzy variables (\(\alpha_{\epsilon}\), where \(\epsilon=1,2,\ldots\) (\(\epsilon\in\mathbb{N}_{<n}^{*}\)), \(n\) is the maximum number of fuzzy variables), the definition domain of each of which is the set X--a universal set or universe (in this case, these are the numerical values of the probability of threat occurrence \(P_{l}\)); \(G\) is some syntactic procedure that allows you to operate with the elements of the term-set \(T\), in particular, generate new terms (values); \(M\) is a semantic procedure that makes it possible to transform each new value of a linguistic variable, obtained using the procedure \(G\), into a fuzzy variable, that is, to form a corresponding fuzzy set. In the considered case, we can restrict ourselves to the assumption of the trivial nature of \(G\) and \(M\), that is, no logical connectives and modifiers will be used.