## 3 Risk Assessment-Based Dynamic Access Model
### Request a Risk Assessment
#### 3.1.2 Calculation and Standardization of Attribute Evidence  
How to obtain evidence of the above properties is the basis of risk assessment. For the subject attribute, you can obtain it by accessing the request itself and the system history. For the environment attribute, you can obtain it through system monitoring. The resource attribute can be obtained through the system storage system log. It should be noted that the sensitivity of data operations is measured. Since different operations have different levels of risk, we define \(AS\) as the security sensitivity of operation \(A\). The operation's impact on system security increases with operation sensitivity. By running a query against the appropriate security sensitivity table, one can determine the security sensitivity of various actions. For instance, read, write, copy, and execute have security sensitivities of 0.2, 0.4, 0.6, and 0.8, respectively.  
To make the calculation of attribute evidence more objective, in the main attributes, the IP anomaly, the number of login failures, the historical request success rate, and the abnormal access initiation time will decay with time; that is, the longer the distance from the current time. The greater the value, the greater the impact on the request risk, which means that if the user performs more abnormal operations in a short period of time, the request is abnormal, and the possibility of damaging the security behavior of the system is greater, and the risk value is also high. This paper uses Equation (1) to calculate the four evidence values of IP anomaly, login failure, historical request success rate, and abnormal access initiation time:  
\[S_{new}=\begin{cases}S_{old}\cdot[1+\varphi(\Delta S)];&t<t_{0}\\ S_{old}\cdot\varphi(t);&t>t_{0}\end{cases} \tag{1}\]  
Among them, \(S_{new}\) represents the updated value of the evidence, \(S_{old}\) represents the value before the update, \(t_{0}\) represents the valid time of the evidence value, and \(\varphi(t)\) is the time decay function. When \(t>t_{0}\), it indicates that the evidence value is within this time interval. If there is no update, the evidence value is processed according to the time decay; when the time interval \(t\) is less than \(t_{0}\), it means that the new evidence value is obtained within the valid time, but the new evidence value cannot completely replace the old evidence value, so the use between the two is used. The increment \(\Delta S=S_{new}-S_{old}\) to update the evidence, \(\varphi(\Delta S)\) is the increment control function.  
In addition, since each piece of evidence has different meanings and different value ranges, it is necessary to standardize the data so that the values fall within the range of \([0,1]\). For the evidence that the value is a percentage, its value is already in the range of \([0,1]\), so it can be represented by a decimal, such as the IP packet loss rate, memory utilization, CPU utilization, etc. in the environment attribute; in addition, for the resource attribute Whether the data in is encrypted, its value is only two, namely 0 or 1, and no processing is required. The value of operation sensitivity is given in Table 1, and no processing is required; for other evidence, it is assumed that the obtained evidence of an attribute is \(A=(a_{1},a_{2},...,a_{n})\), and the attribute evidence after standardized processing is \(E=(e_{1},e_{2},...,e_{n})\), then the specific data standardization processing is as Equation (2).  
\begin{table}
\begin{tabular}{c c c} \hline \hline  & \(Attr(a)\) & \(AS\) \\ \hline
1 & Read & 0.2 \\
2 & Copy & 0.4 \\
3 & Write & 0.6 \\
4 & Execute & 0.8 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Operational Security Sensitivity [4].  
\[e_{i}=\left\{\begin{aligned} &\frac{a_{i}-\min(a_{i})}{\max(a_{i})-\min(a_{i })}\,;& a_{i}>0\\ &\frac{\max(a_{i})-a_{i}}{\max(a_{i})-\min(a_{i})}\,;& a_{i}<0\end{aligned}\right. \tag{2}\]  
In the above way, all evidence values can be converted into positive values between \([0,1]\).