## 4 Case Studies
### An Example of Network Security Risk Assessment
#### 4.1.6 Obtain the Risk Level of Computer Networks  
Through the last five steps, the evaluation result, which is expressed by BPA, is given. Applying PPT to the evaluation, the risk level of computer networks can be determined. The probability distribution after PPT is detailed in Table 10. According to the principle of maximum membership, the risk level of this computer network is middle high (MH).  
Besides, the approach used in the study of [25] is also applied to compare with the approach proposed in this paper. As described in Figure 3, if the maximum membership principle is used to  
\begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline  & **VL** & **L** & **ML** & **M** & **MH** & **H** & **VH** & **\(\Theta\)** \\ \hline \(\overline{m_{1}}\) & 0.0099 & 0.1000 & 0.1072 & 0.1906 & 0.2243 & 0.2248 & 0.0757 & 0.0675 \\ \(\overline{m_{2}}\) & 0.0567 & 0.0754 & 0.1165 & 0.1517 & 0.2186 & 0.1670 & 0.1493 & 0.0649 \\ \(\overline{m_{3}}\) & 0 & 0.0668 & 0.1000 & 0.1000 & 0.2668 & 0.2000 & 0.1665 & 0.1000 \\ \hline \hline \end{tabular}
\end{table}
Table 6: The weighted average of evidence of bottom criteria.  
\begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline  & **VL** & **L** & **ML** & **M** & **MH** & **H** & **VH** & **\(\Theta\)** \\ \hline \(m_{1}\) & 0.0002 & 0.0227 & 0.0281 & 0.1991 & 0.3682 & 0.3713 & 0.0102 & 0.0002 \\ \(m_{2}\) & 0.0132 & 0.0242 & 0.0699 & 0.1431 & 0.4230 & 0.1885 & 0.1369 & 0.0012 \\ \(m_{3}\) & 0 & 0.0504 & 0.0849 & 0.0849 & 0.3524 & 0.2264 & 0.1727 & 0.0283 \\ \hline \hline \end{tabular}
\end{table}
Table 7: The BPAs of bottom criteria after combination.  
\begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline  & **VL** & **L** & **ML** & **M** & **MH** & **H** & **VH** & **\(\Theta\)** \\ \hline \(\overline{m}\) & 0.0077 & 0.0261 & 0.0575 & 0.1564 & 0.3986 & 0.2521 & 0.0984 & 0.0033 \\ \(m\) & 0 & 0.0003 & 0.0026 & 0.0468 & 0.7468 & 0.1915 & 0.0121 & 0 \\ \hline \hline \end{tabular}
\end{table}
Table 9: The weighted average evidence and combination result of middle level criteria.  
\begin{table}
\begin{tabular}{l c c c c c c c c} \hline \hline  & **VL** & **L** & **ML** & **M** & **MH** & **H** & **VH** & **\(\Theta\)** \\ \hline \(\overline{m}\) & 0.0077 & 0.0261 & 0.0575 & 0.1564 & 0.3986 & 0.2521 & 0.0984 & 0.0033 \\ \(m\) & 0 & 0.0003 & 0.0026 & 0.0468 & 0.7468 & 0.1915 & 0.0121 & 0 \\ \hline \hline \end{tabular}
\end{table}
Table 8: Objective and comprehensive weights of middle level criteria.  
determine the risk level in these two approaches, they give the same assessment result, middle high. However, the approach proposed in this paper has a better performance of convergence, and the degree of evidence's support for middle high (MH) is greater. More importantly, the uncertainty of the evaluation result in the study of [25] can be obtained by Equation (13), which is 0.1336, far greater than that of this paper.  
Herein, we also compare and discuss the assessment of each middle level criterion by using these two assessment approach. The corresponding assessment results are shown in Tables 7 and 11. Using the assessment approach proposed in this paper, the uncertainty of the evaluation results of \(a_{1}\), \(a_{2}\) and \(a_{3}\) can be obtained by using Equation (13), which is 0.1107, 0.1173 and 0.1450, respectively. In the approach proposed by [PERSON] et al., the corresponding uncertainty is 0.1750, 0.1379 and 0.1953, respectively. Obviously, the use of our assessment approach can reduce the uncertainty of the assessment results. In addition, according to the evaluation data in Table 7, it can be seen that \(a_{1}\) has the highest risk level, high (H). Therefore, more attention should be paid to \(a_{1}\) to improve the overall network security.  
All the above illustrates that the approach proposed in this paper can effectively assess the security of computer networks, which is the purpose of our study.