# A Security Situation Assessment Model of Information System for Smart Mobile Devices

Authors: Lixia Xie; Liping Yan; Xugao Zhang; Hongyu Yang
Journal: Wireless Communications and Mobile Computing
 (2020)

---

## Abstract

The accuracy of the existing security situation assessment model of information system for smart mobile devices is affected by expert evaluation preferences. This paper proposes an information system security situation assessment model for smart mobile devices, which is based on the modified interval matrix-entropy weight-based cloud (MIMEC). According to the security situation assessment index system, the interval judgment matrix reflecting the relative importance of different indexes is modified to improve the objectivity of the index layer weight vector. Then, the entropy weight-based cloud is used to quantify the criterion layer and the target layer security situation index, and the security level of the system is graded. The evaluation experiment on the departure control system for smart mobile devices not only verify the validity of this model but also demonstrate that this model has higher stability and reliability than other models.


---

## Body

## 1. Introduction

Security situation assessment refers to the process of predicting the security situation of the system based on the perception and acquisition of security elements in a certain time and space, and the integrated analysis of the acquired data information [1]. The security situation assessment model is necessary for information system administrators of smart mobile devices to obtain the dynamic security situation of the system, determine system abnormal events, and make reasonable decisions.Fu et al. [2] proposed a comprehensive evaluation model for information system security risk based on the entropy weight coefficient method. The entropy weight coefficient method was used to determine the index weight vector and reduce the subjective influence of experts. Luo et al. [3] proposed a risk assessment model based on the gray comprehensive measure, but the evaluation model lacks management dimension indexes. Xi et al. [4] proposed an improved quantitative evaluation model of the network security situation and optimized the network security situation quantitative value by game method, but the information source is single. Shu et al. [5] proposed a network security risk assessment model based on network security vulnerabilities to assess network security risks. However, the model requires a large amount of data, the risk baseline determination is influenced by experts, and the algorithm complexity is high. Hemanidhi et al. [6] calculated the total network risk value by weighting the quantified results of network risk under different vulnerability detection tools, but the distribution of risk value weight for different detection tools is not reasonable. Eom et al. [7] proposed a risk quantification formula based on threat frequency, asset exposure, and asset protection level, but the determination of threat frequency is influenced by subjective factors. Rimsha et al. [8] proposed an information security risk assessment method based on the adjacency matrix. However, a higher-order adjacency matrix will increase the deviation between the risk value and the actual security situation. Cheng [9] proposed a streaming algorithm to identify user click requests and reconstructed user-browser interactions by leveraging the Spark Streaming framework. Rui [10] proposed a two-stage approach by combining multiobjective optimization (MOO) with integrated decision-making (IDM) to address the problem of combined heat and power economic emission dispatch (CHPEED).Those indicate that the existing information system security situation assessment indexes only focus on the technical level without considering the human factors. Moreover, the security situation evaluation is greatly influenced by the subjectivity of experts, and the quantified results cannot accurately reflect the information system security situation.Motivated by those above, in this paper, we propose an information system security situation assessment model (ISSSAM) for smart mobile devices, which is based on the modified interval matrix-entropy weight-based cloud (MIMEC).


### 1.1. Contribution

The main contributions of this paper are listed as follows:(1)
A practical ISSSAM model. To accurately assess the information system security situation for smart mobile devices, an ISSSAM model is built with consideration of the modified interval matrix module and entropy weight-based cloud(2)
A novel modified algorithm. A modified interval matrix module is proposed to improve the objectivity of the weight vector. Firstly, the interval judgment matrix given by experts is modified to improve its consistency degree. Secondly, the deterministic matrix with the best consistency degree is searched in the modified interval judgment matrix. Finally, the best weight vector is obtained based on the best deterministic matrix(3)
The experimental results of the departure control system (DCS) case, prove the effectiveness of our model. Furthermore, compared with other methods, the results demonstrate that our model is closer to the practical security situation and improves the reliability and stability of information system security situation assessment


### 1.2. Organization

The rest of this paper is organized as follows. Section2 presents the security situation assessment model. Section 3 recommends multisource data normalization. In Section 4, the modified interval matrix module is proposed. Section 5 reviews the entropy weight-based cloud module. In Section 6, the experimental comparisons are carried out, and the results are analyzed. Finally, Section 7 gives the conclusions. In addition, the list of notations is shown in Table 1.Table 1
Notations and abbreviations.
SymbolDescriptionsmNumber of commentβQualitative index commentVeExpert valueμModified factorXQuantitative index−AInterval judgment matrix−aijInterval numberCRConsistency ratioRIAverage random consistency indexγInterval matrix consistency degreeQNumber of random matrixespNumber of satisfactory consistency matrixUUniverseCSMembership degreeExExpectation valueEnEntropyHeHyper entropy


## 1.1. Contribution

The main contributions of this paper are listed as follows:(1)
A practical ISSSAM model. To accurately assess the information system security situation for smart mobile devices, an ISSSAM model is built with consideration of the modified interval matrix module and entropy weight-based cloud(2)
A novel modified algorithm. A modified interval matrix module is proposed to improve the objectivity of the weight vector. Firstly, the interval judgment matrix given by experts is modified to improve its consistency degree. Secondly, the deterministic matrix with the best consistency degree is searched in the modified interval judgment matrix. Finally, the best weight vector is obtained based on the best deterministic matrix(3)
The experimental results of the departure control system (DCS) case, prove the effectiveness of our model. Furthermore, compared with other methods, the results demonstrate that our model is closer to the practical security situation and improves the reliability and stability of information system security situation assessment


## 1.2. Organization

The rest of this paper is organized as follows. Section2 presents the security situation assessment model. Section 3 recommends multisource data normalization. In Section 4, the modified interval matrix module is proposed. Section 5 reviews the entropy weight-based cloud module. In Section 6, the experimental comparisons are carried out, and the results are analyzed. Finally, Section 7 gives the conclusions. In addition, the list of notations is shown in Table 1.Table 1
Notations and abbreviations.
SymbolDescriptionsmNumber of commentβQualitative index commentVeExpert valueμModified factorXQuantitative index−AInterval judgment matrix−aijInterval numberCRConsistency ratioRIAverage random consistency indexγInterval matrix consistency degreeQNumber of random matrixespNumber of satisfactory consistency matrixUUniverseCSMembership degreeExExpectation valueEnEntropyHeHyper entropy


## 2. Security Situation Assessment Model

In this paper, a MIMEC based security situation assessment model of information system for smart mobile devices is established (see Figure1).Figure 1
Security situation assessment model.The assessment process is designed as follows: firstly, based on the analytic hierarchy process (AHP), a three-layer index system for security situation assessment of an information system for smart mobile devices is established. Define that there are 5 evaluation dimensions (see Figure2), where they are physical dimension (I1), host system dimension (I2), network dimension (I3), data dimension (I4), and manager dimension (I5).Figure 2
Evaluation index system.Secondly, there are various ways for us to obtain data as the basis for experts’ scoring and determine qualitative indexes and quantitative indexes, such as questionnaire survey, physical environment assessment, viewing host configuration, and obtaining system vulnerabilities through intrusion detection system.Thirdly, the security situation is quantified by the modified interval matrix module and the entropy weight-based cloud module. The interval judgment matrix is given by experts, and the modified interval matrix module is used to obtain the best deterministic judgment matrix. Then, the index layer is constructed according to the experts’ evaluation results. Combined with the index layer weight vector, the criterion layer based cloud model is constructed, and the entropy weight coefficient of the criterion layer cloud model is calculated. At last, the situation value of an information system for smart mobile devices is obtained by the situation value operator.Finally, according to the “Information security technology—classification guide for classified protection of information systems security” [11] and the comprehensive security situation value of an information system for smart mobile devices, the security situation level is determined.


## 3. Multisource Data Normalization

Since the heterogeneity of multisource data makes it difficult for experts to evaluate, this paper proposes a normalized method for qualitative and quantitative indexes as follows.


### 3.1. Normalization of Qualitative Indexes

Define that there arem qualitative index comment classifications, which are β1,β2,⋯,βm. βi~βji,j∈1,2,⋯,m represents that the comment βi is better than comment βj, then β1~β2~⋯~βmi,j∈1,2,⋯,m. Meanwhile, define that θ is the index which reflects the score of comment and θ~N (0,1). Suppose that the ti is corresponding to comment βi which reflects the expert score and ti is the quantile of N0,1, then(1)Pθ<ti=imi=1,2,⋯,m−1Define that the expert score isVe and Ve=μti, where μ is the modified factor (this paper takes μ=100).


### 3.2. Normalization of Quantitative Indexes

Define that the quantitative interval of the indexX is [Xa,Xb], the normalization process for the quantitative indexes of different dimensions is as follows:(1)
Positive index(2)X1=x−XaXb−Xa,Xb>Xa(2)
Reverse index(3)X2=Xb−xXb−Xa,Xb>Xa


## 3.1. Normalization of Qualitative Indexes

Define that there arem qualitative index comment classifications, which are β1,β2,⋯,βm. βi~βji,j∈1,2,⋯,m represents that the comment βi is better than comment βj, then β1~β2~⋯~βmi,j∈1,2,⋯,m. Meanwhile, define that θ is the index which reflects the score of comment and θ~N (0,1). Suppose that the ti is corresponding to comment βi which reflects the expert score and ti is the quantile of N0,1, then(1)Pθ<ti=imi=1,2,⋯,m−1Define that the expert score isVe and Ve=μti, where μ is the modified factor (this paper takes μ=100).


## 3.2. Normalization of Quantitative Indexes

Define that the quantitative interval of the indexX is [Xa,Xb], the normalization process for the quantitative indexes of different dimensions is as follows:(1)
Positive index(2)X1=x−XaXb−Xa,Xb>Xa(2)
Reverse index(3)X2=Xb−xXb−Xa,Xb>Xa


## 4. Modified Interval Matrix Module

The assessment of the security situation needs to determine the relative importance of each index, and its mathematical representation is the weight vector. In this paper, the interval judgment matrix given by experts is modified to improve the degree of consistency, and the deterministic matrix with the best consistency is searched in the modified interval judgment matrix to determine the best weight vector. This method not only preserves the subjectivity of expert evaluation but also improves the objective degree of the weight vector.


### 4.1. Related Definitions

Interval judgment matrix: define that the subscript set ofn elements is J=1,2,⋯,n,and the relative importance between element i and element j is aij. Then, the interval judgment matrix can be represent as −A=−aijn×n, i,j∈1,2,⋯,n, and the interval number −aij is aijL,aijU, −aji=1/aijU,1/aijL, aijL≤aijU. This paper takes 1-9 scale judgment matrix [12].Random matrix: define that matrixA=aijn×n, i,j∈1,2,⋯,n, where aij∈aijL,aijU. Random number aij is generated from aijL,aijU according to the probability of uniform distribution.Satisfactory consistency: define that the consistency ratio of judgment matrixA is CRA=λmaxA−n/n−1RI. When CR≤0.1, we consider the matrix A has satisfactory consistency, where λmaxA is the maximum eigenvalue of matrix A, RI is the average random consistency index (see Table 2).Table 2
Average random consistency index values.
Order123456789RI000.520.891.121.261.361.411.46Interval matrix consistency degree: define thatγ is the interval matrix consistency degree. If Q random matrixes are generated from interval matrix −A and there are p matrixes has satisfactory consistency, then γ=p/Q.


### 4.2. Modified Interval Matrix Design

The modified interval matrix module is shown in Figure3.Figure 3
Design of modified interval matrix.The modified interval matrix module is divided into three submodules. They are interval matrix consistency degree judgment submodule (Interval_matrix_identify), interval matrix element adjustment submodule (Interval_matrix_adopt), and best deterministic matrix acquisition submodule (Best_interval_matrix).The workflow design of the modified interval matrix module is as follows.Step 1.
Calculate the consistency degree value (consis_value) of a given interval matrix.Step 2.
If consis_value > threshold, then turn to Step3; else adjust the interval number elements, and turn to Step 1.Step 3.
Calculate the Best_interval_matrix based on the modified matrix.Step 4.
Calculate the weight vector based on Best_interval_matrix.The processing method and process of each sub-module are explained in detail below.


#### 4.2.1. Interval Matrix Consistency Degree Judgment Submodule

The interval judgment matrix given by the expert generatesQ random matrices according to the uniform distribution probability and sequentially calculates the consistency ratio CRkk=1,2,⋯,Q of the generated random matrix. Let the number of random matrices with a satisfactory degree of consistency be p, then the degree of consistency of the interval matrices is γ=p/Q. The larger γ, the better the consistency of the interval matrix; the smaller γ, the worse the consistency of the interval matrix. This paper takes Q=100.


#### 4.2.2. Interval Matrix Element Adjustment Submodule

When the consistency degreeγ is less than a certain threshold, some elements in the interval matrix need to be adjusted. The specific process is designed as follows.Step 1.
Get subinterval matrix−Ahn−1 by deleting the elements of the hth row and hth column in the interval matrix, and compute γh of Ahn−1.Step 2.
Ifγh1 and γh2 of the subinterval matrix −Ah1n−1 and −Ah2n−1>γh of other matrices, adjust the interval elements ah1h2L,ah1h2U,ah2h1L,ah2h1U.Step 3.
Turn to the Interval_matrix_identify submodule, and calculateγ of the adjusted interval judgment matrix.After deleting the elements of thehth row and hth column in the interval matrix, the deleted elements are isolated to remain elements. If the consistency degree of this interval matrix improved greatly, it is indicated that the deleted elements have a negative impact to the original matrix. So, we need to invite experts to adjust corresponding elements to improve the consistency degree [13].


#### 4.2.3. The Best Deterministic Matrix Acquisition Submodule

This submodule consists of two processes: interval matrix convergence and best deterministic matrix calculation. The specific process is designed as follows:(1)
Interval matrix convergenceStep 1.
GenerateR deterministic matrices according to the uniform distribution probability based on the adjusted interval judgment matrix.Step 2.
CalculateCRii=1,2,⋯,R of the R deterministic matrices, respectively.Step 3.
Get thetth matrix cluster (Cluster_matrix_t) by obtaining first ω consistency ratios of R deterministic matrices.Step 4.
Integrate the new interval matrix by using the same position elements of different matrices in matrix clusters.Step 5.
Obtain the upper and lower limits of each interval elements in the new interval judgment matrix. Wheni=j, aij=1; when i≠j, aijL=minaij1L,aij2L,⋯,aijωL, aijU=maxaij1U,aij2U,⋯,aijωU, and −aji=1/aijU,1/aijL.Step 6.
Repeat Step1~5 until the sum of ∣aijU−aijL∣i,j∈1,2,⋯,n (the lengths of the interval matrix) is not more than 10% of the sum of the lengths of the original interval matrix.In Step1, the proportion of each determined number of the randomly generated deterministic matrix in the left half interval of each interval element of the original interval matrix is α, and 0.5−η<α<0.5+η (This paper takes η=0.05).(2)
Best deterministic matrix calculation(4)v=w∗v+c∗rand∗pbest−present,(5)present=present+v,where v is the speed of optimization, w is used to adjust the speed of optimization, c is the cognitive factor and usually c=2, rand is the random number between (0, 1), pbest is the current the element in the deterministic matrix with the smallest consistency ratio, and present represents the element in the current deterministic matrix.Step 1.
Input the converged interval matrix (Input_matrix).Step 2.
Initialize a deterministic matrixM0, the elements of the deterministic matrix are: aij,i,j∈1,2,⋯,n. When i=j, aij=1; when 1<j≤n,1≤i<j, aij=aijL+aijU/2; when 1<i≤n,1≤j<i,aij=1/aji.Step 3.
CalculateCR0 as the initial consistency ratio.Step 4.
Generate deterministic matrixMii=1,2,⋯,k randomly from Input_matrix.Step 5.
Calculate its consistency ratioCRi, and compare it with CR0.Step 6.
IfCRi<CR0, CR0=CRi, M0=Mi; else, keep CR0 and M0 unchanged.Step 7.
Adjust each element in each deterministic matrix according to equations (4) and (5):vmax=minaijU−aijLi≠j,i,j∈1,2,⋯,n, where aijL,aijU are the upper and lower limits of each element of the converged interval matrix. If v>vmax, then take v=vmax; if v<−vmax, take v=−vmax. If present∈aijL,aijU, present does not need to be adjusted; if present <aijL, then take present=aijL; if present>aijU, take present=aijU. The initial value of v is taken as 0, pbest0 corresponds to each element in the initial deterministic matrix M0 in Step 2, and present0 corresponds to each element in the deterministic matrix randomly generated in Step 2 for the first time.Step 8.
Repeat Step2~7 for k times.On this basis, the eigenvector method can be used to calculate the best weight vector.


## 4.1. Related Definitions

Interval judgment matrix: define that the subscript set ofn elements is J=1,2,⋯,n,and the relative importance between element i and element j is aij. Then, the interval judgment matrix can be represent as −A=−aijn×n, i,j∈1,2,⋯,n, and the interval number −aij is aijL,aijU, −aji=1/aijU,1/aijL, aijL≤aijU. This paper takes 1-9 scale judgment matrix [12].Random matrix: define that matrixA=aijn×n, i,j∈1,2,⋯,n, where aij∈aijL,aijU. Random number aij is generated from aijL,aijU according to the probability of uniform distribution.Satisfactory consistency: define that the consistency ratio of judgment matrixA is CRA=λmaxA−n/n−1RI. When CR≤0.1, we consider the matrix A has satisfactory consistency, where λmaxA is the maximum eigenvalue of matrix A, RI is the average random consistency index (see Table 2).Table 2
Average random consistency index values.
Order123456789RI000.520.891.121.261.361.411.46Interval matrix consistency degree: define thatγ is the interval matrix consistency degree. If Q random matrixes are generated from interval matrix −A and there are p matrixes has satisfactory consistency, then γ=p/Q.


## 4.2. Modified Interval Matrix Design

The modified interval matrix module is shown in Figure3.Figure 3
Design of modified interval matrix.The modified interval matrix module is divided into three submodules. They are interval matrix consistency degree judgment submodule (Interval_matrix_identify), interval matrix element adjustment submodule (Interval_matrix_adopt), and best deterministic matrix acquisition submodule (Best_interval_matrix).The workflow design of the modified interval matrix module is as follows.Step 1.
Calculate the consistency degree value (consis_value) of a given interval matrix.Step 2.
If consis_value > threshold, then turn to Step3; else adjust the interval number elements, and turn to Step 1.Step 3.
Calculate the Best_interval_matrix based on the modified matrix.Step 4.
Calculate the weight vector based on Best_interval_matrix.The processing method and process of each sub-module are explained in detail below.


### 4.2.1. Interval Matrix Consistency Degree Judgment Submodule

The interval judgment matrix given by the expert generatesQ random matrices according to the uniform distribution probability and sequentially calculates the consistency ratio CRkk=1,2,⋯,Q of the generated random matrix. Let the number of random matrices with a satisfactory degree of consistency be p, then the degree of consistency of the interval matrices is γ=p/Q. The larger γ, the better the consistency of the interval matrix; the smaller γ, the worse the consistency of the interval matrix. This paper takes Q=100.


### 4.2.2. Interval Matrix Element Adjustment Submodule

When the consistency degreeγ is less than a certain threshold, some elements in the interval matrix need to be adjusted. The specific process is designed as follows.Step 1.
Get subinterval matrix−Ahn−1 by deleting the elements of the hth row and hth column in the interval matrix, and compute γh of Ahn−1.Step 2.
Ifγh1 and γh2 of the subinterval matrix −Ah1n−1 and −Ah2n−1>γh of other matrices, adjust the interval elements ah1h2L,ah1h2U,ah2h1L,ah2h1U.Step 3.
Turn to the Interval_matrix_identify submodule, and calculateγ of the adjusted interval judgment matrix.After deleting the elements of thehth row and hth column in the interval matrix, the deleted elements are isolated to remain elements. If the consistency degree of this interval matrix improved greatly, it is indicated that the deleted elements have a negative impact to the original matrix. So, we need to invite experts to adjust corresponding elements to improve the consistency degree [13].


### 4.2.3. The Best Deterministic Matrix Acquisition Submodule

This submodule consists of two processes: interval matrix convergence and best deterministic matrix calculation. The specific process is designed as follows:(1)
Interval matrix convergenceStep 1.
GenerateR deterministic matrices according to the uniform distribution probability based on the adjusted interval judgment matrix.Step 2.
CalculateCRii=1,2,⋯,R of the R deterministic matrices, respectively.Step 3.
Get thetth matrix cluster (Cluster_matrix_t) by obtaining first ω consistency ratios of R deterministic matrices.Step 4.
Integrate the new interval matrix by using the same position elements of different matrices in matrix clusters.Step 5.
Obtain the upper and lower limits of each interval elements in the new interval judgment matrix. Wheni=j, aij=1; when i≠j, aijL=minaij1L,aij2L,⋯,aijωL, aijU=maxaij1U,aij2U,⋯,aijωU, and −aji=1/aijU,1/aijL.Step 6.
Repeat Step1~5 until the sum of ∣aijU−aijL∣i,j∈1,2,⋯,n (the lengths of the interval matrix) is not more than 10% of the sum of the lengths of the original interval matrix.In Step1, the proportion of each determined number of the randomly generated deterministic matrix in the left half interval of each interval element of the original interval matrix is α, and 0.5−η<α<0.5+η (This paper takes η=0.05).(2)
Best deterministic matrix calculation(4)v=w∗v+c∗rand∗pbest−present,(5)present=present+v,where v is the speed of optimization, w is used to adjust the speed of optimization, c is the cognitive factor and usually c=2, rand is the random number between (0, 1), pbest is the current the element in the deterministic matrix with the smallest consistency ratio, and present represents the element in the current deterministic matrix.Step 1.
Input the converged interval matrix (Input_matrix).Step 2.
Initialize a deterministic matrixM0, the elements of the deterministic matrix are: aij,i,j∈1,2,⋯,n. When i=j, aij=1; when 1<j≤n,1≤i<j, aij=aijL+aijU/2; when 1<i≤n,1≤j<i,aij=1/aji.Step 3.
CalculateCR0 as the initial consistency ratio.Step 4.
Generate deterministic matrixMii=1,2,⋯,k randomly from Input_matrix.Step 5.
Calculate its consistency ratioCRi, and compare it with CR0.Step 6.
IfCRi<CR0, CR0=CRi, M0=Mi; else, keep CR0 and M0 unchanged.Step 7.
Adjust each element in each deterministic matrix according to equations (4) and (5):vmax=minaijU−aijLi≠j,i,j∈1,2,⋯,n, where aijL,aijU are the upper and lower limits of each element of the converged interval matrix. If v>vmax, then take v=vmax; if v<−vmax, take v=−vmax. If present∈aijL,aijU, present does not need to be adjusted; if present <aijL, then take present=aijL; if present>aijU, take present=aijU. The initial value of v is taken as 0, pbest0 corresponds to each element in the initial deterministic matrix M0 in Step 2, and present0 corresponds to each element in the deterministic matrix randomly generated in Step 2 for the first time.Step 8.
Repeat Step2~7 for k times.On this basis, the eigenvector method can be used to calculate the best weight vector.


## 4.2.1. Interval Matrix Consistency Degree Judgment Submodule

The interval judgment matrix given by the expert generatesQ random matrices according to the uniform distribution probability and sequentially calculates the consistency ratio CRkk=1,2,⋯,Q of the generated random matrix. Let the number of random matrices with a satisfactory degree of consistency be p, then the degree of consistency of the interval matrices is γ=p/Q. The larger γ, the better the consistency of the interval matrix; the smaller γ, the worse the consistency of the interval matrix. This paper takes Q=100.


## 4.2.2. Interval Matrix Element Adjustment Submodule

When the consistency degreeγ is less than a certain threshold, some elements in the interval matrix need to be adjusted. The specific process is designed as follows.Step 1.
Get subinterval matrix−Ahn−1 by deleting the elements of the hth row and hth column in the interval matrix, and compute γh of Ahn−1.Step 2.
Ifγh1 and γh2 of the subinterval matrix −Ah1n−1 and −Ah2n−1>γh of other matrices, adjust the interval elements ah1h2L,ah1h2U,ah2h1L,ah2h1U.Step 3.
Turn to the Interval_matrix_identify submodule, and calculateγ of the adjusted interval judgment matrix.After deleting the elements of thehth row and hth column in the interval matrix, the deleted elements are isolated to remain elements. If the consistency degree of this interval matrix improved greatly, it is indicated that the deleted elements have a negative impact to the original matrix. So, we need to invite experts to adjust corresponding elements to improve the consistency degree [13].


## 4.2.3. The Best Deterministic Matrix Acquisition Submodule

This submodule consists of two processes: interval matrix convergence and best deterministic matrix calculation. The specific process is designed as follows:(1)
Interval matrix convergenceStep 1.
GenerateR deterministic matrices according to the uniform distribution probability based on the adjusted interval judgment matrix.Step 2.
CalculateCRii=1,2,⋯,R of the R deterministic matrices, respectively.Step 3.
Get thetth matrix cluster (Cluster_matrix_t) by obtaining first ω consistency ratios of R deterministic matrices.Step 4.
Integrate the new interval matrix by using the same position elements of different matrices in matrix clusters.Step 5.
Obtain the upper and lower limits of each interval elements in the new interval judgment matrix. Wheni=j, aij=1; when i≠j, aijL=minaij1L,aij2L,⋯,aijωL, aijU=maxaij1U,aij2U,⋯,aijωU, and −aji=1/aijU,1/aijL.Step 6.
Repeat Step1~5 until the sum of ∣aijU−aijL∣i,j∈1,2,⋯,n (the lengths of the interval matrix) is not more than 10% of the sum of the lengths of the original interval matrix.In Step1, the proportion of each determined number of the randomly generated deterministic matrix in the left half interval of each interval element of the original interval matrix is α, and 0.5−η<α<0.5+η (This paper takes η=0.05).(2)
Best deterministic matrix calculation(4)v=w∗v+c∗rand∗pbest−present,(5)present=present+v,where v is the speed of optimization, w is used to adjust the speed of optimization, c is the cognitive factor and usually c=2, rand is the random number between (0, 1), pbest is the current the element in the deterministic matrix with the smallest consistency ratio, and present represents the element in the current deterministic matrix.Step 1.
Input the converged interval matrix (Input_matrix).Step 2.
Initialize a deterministic matrixM0, the elements of the deterministic matrix are: aij,i,j∈1,2,⋯,n. When i=j, aij=1; when 1<j≤n,1≤i<j, aij=aijL+aijU/2; when 1<i≤n,1≤j<i,aij=1/aji.Step 3.
CalculateCR0 as the initial consistency ratio.Step 4.
Generate deterministic matrixMii=1,2,⋯,k randomly from Input_matrix.Step 5.
Calculate its consistency ratioCRi, and compare it with CR0.Step 6.
IfCRi<CR0, CR0=CRi, M0=Mi; else, keep CR0 and M0 unchanged.Step 7.
Adjust each element in each deterministic matrix according to equations (4) and (5):vmax=minaijU−aijLi≠j,i,j∈1,2,⋯,n, where aijL,aijU are the upper and lower limits of each element of the converged interval matrix. If v>vmax, then take v=vmax; if v<−vmax, take v=−vmax. If present∈aijL,aijU, present does not need to be adjusted; if present <aijL, then take present=aijL; if present>aijU, take present=aijU. The initial value of v is taken as 0, pbest0 corresponds to each element in the initial deterministic matrix M0 in Step 2, and present0 corresponds to each element in the deterministic matrix randomly generated in Step 2 for the first time.Step 8.
Repeat Step2~7 for k times.On this basis, the eigenvector method can be used to calculate the best weight vector.


## 5. Entropy Weight-Based Cloud Module

### 5.1. Related Definitions

Membership cloud [14]: define that U is a certain universe, where U=x and S is language value corresponding to accuracy number x. x is a random number with a stable tendency for membership degree CSX, and the distribution of membership degree on the universe is called membership cloud.The digital characteristics of the cloud: the description of cloud rely on 3 parameters. They are expectation valueEx, entropy En, hyper entropy He, where Ex reflects a concept corresponds to the central value of a universe, En reflects the fuzziness of the concept and En reflects the degree of cloud droplet dispersion.Entropy [2]: entropy measures the uncertainty of the system. Define that the system may stay in n different states and the probability of each state occurs is pii=1,2,⋯,n, then the entropy of the system is(6)E=−∑i=1npilnpiwhere 0≤pi≤1 and p1+⋯+pn=1. When pi=1/n, Emax=lnn. Then, when the system has only one state n=1 and Emin=0, the system is determined. With the increase of n, the number of possible states gets higher, then the entropy gets bigger. And the dispersion of the system becomes bigger, and it can provide less information. Thus, the less important this system is relative to other systems.


### 5.2. Expert Evaluation of Membership Cloud

For the evaluation of a certain index,n experts are invited to conduct the evaluation of a certain index, and the evaluation results are converted into a percentage form according to Section 3. The membership clouds represent the evaluation results of the n experts. First, the three digital features (Ex,En,He) of the cloud model are calculated by the reverse cloud generator. Then, the expert evaluation results are restored by the forward cloud generator. Finally, if the cloud drops are too discrete, it indicates that the expert evaluation opinions differ greatly, then we can apply for reevaluation.(1)
Reverse cloud generator(7)Ex=Ex1+Ex2+⋯+Exnn,En=maxEx1,Ex2,⋯,Exn−minEx1,Ex2,⋯,Exnn,S2=1n∑i=1nxi−Ex2,He=S2−En2,where Exi indicates the percentage result of the ith expert evaluation and n indicates the number of experts. The digital features of the membership cloud (Ex,En,He) are calculated by the above equations.(2)
Forward cloud generatorStep 1.
Enn=RandnEn,He, which takes En as the expectation and produces a normally distributed random number Enn with He as the standard deviation.Step 2.
xi=RandnEx,Enn, which takes Ex as the expectation and generates a normally distributed random number xi with Enn as a standard deviation.Step 3.
ξi=exp−xi−Ex2/2Enn2, the degree of membership is calculated according to the equation, and the pair (xi,ξi) represents a cloud drop distributed over the universe U.Step 4.
Step1 through Step 3 is performed cyclically until enough cloud drops are generated to restore the expert evaluation results in the form of a cloud model.


### 5.3. Membership Cloud Gravity Center

The result of the expert evaluation off indexes subordinate to the criterion layer can be represented by f-dimensional membership clouds. The f-dimensional comprehensive membership cloud of the dimension can be formed by a membership cloud gravity center. This paper uses the vector g to represent the gravity center vector of this cloud which is(8)g=g1,g2,⋯,gf.where gi=Exi·wii=1,2,⋯,f, Exi represents the expected value of the ith membership cloud, and wi represents the weight corresponding to the index which is calculated by the modified interval matrix module.Assuming that the initial state of the system is ideal, the initial cloud center of gravity vector of thef-dimensional integrated membership cloud is(9)g0=g10,g20,⋯,gf0.The cloud gravity center vector representing the current expert evaluation result is(10)g′=g1′,g2′,⋯,gf′.Then, normalize the changes in the gravity center vector of thef-dimensional integrated cloud is(11)giG=gi′−gi0gi0,gi′≤gi0gi′−gi0gi′,gi′>gi0where i=1,2,⋯,f.Calculate the weighted deviationδ from the weight vector W=w1,w2,⋯,wf:(12)δ=∑i=1fgiG∗wi.Enterδ into the evaluation cloud model to get the support level of this dimension index for different comments in the criterion layer [15]. The evaluation cloud model is shown in Figure 4.Figure 4
Evaluation cloud model.In the process of quantifying the situation from the index layer to the criterion layer, the cloud gravity center evaluation method can be used to calculate the weighted deviation and obtain the safety situation value of the different dimension indexes in the criterion layer, and the process of quantifying the situation from the criterion layer to the target layer. In the traditional method [16], the dimension indexes of the default criterion layer are usually the same relative importance, but the relative importance of different indexes in the criterion layer is not distinguished. This has certain limitations on the quantitative value of the comprehensive security situation of the information system.First, at a certain moment, the relative importance of the physical dimension, host dimension, network dimension, data dimension, and manager dimension of different information systems is different. The reason is that some information systems and external network channels are less or even isolation, the main factor affecting the security of the system type is behavior adjustment management [17], and some information systems often face threats such as vulnerabilities and malicious attacks, so it is necessary to focus on the protection of their host and network dimension indexes. Second, for the same information system, the main influencing factors affecting its security situation will change with time. This is due to the update of information system software and hardware. The change of managers will cause the weight vector of the criterion layer to change, which will affect the system the total security assessment value.Given the above problems, based on the cloud gravity center-weighted deviation of each index in the known criterion layer, by reviewing the comments of the activated comments in the cloud model and the support of each comment, the dimension indexes of the criterion layer are determined relative to each comment. The support matrixP is as shown in Table 3.Table 3
Support matrix.
Criteria layerWorseBadAverageGoodExcellentX1P11P12P13P14P15X2P21P22P23P24P25X3P31P32P33P34P35X4P41P42P43P44P45X5P51P52P53P54P55X1, X2, X3, X4, and X5 in Table 3 correspond to the 5 dimensions of the criterion layer, respectively, and pij indicates the degree of support of the ith index to the jth comment (i,j∈1,2,3,4,5).Calculate the absolute entropy of each dimension index by using equation (13):(13)Hi=−∑j=1npijlnpij,when pi1=pi2=⋯=pin, there is Hmax=lnn. Calculate the relative entropy value of each dimension index by using equation (13)(14)μi=−1lnn∑j=1npijlnpij.The weight of the corresponding index is expressed by (1-μi), which is normalized:(15)τi=1n−∑i=1nui1−ui,where τi∈0,1 and τ1+⋯+τn=1, τi is the entropy weight coefficient of the subordinate cloud corresponding to Xi.The weight vector corresponding to each comment in the given evaluation cloud model is set asU=uworse,ubad,uaverage,ugood,uexcellent=1/15,2/15,1/5,4/15,1/3 [2, 18].The information system comprehensive security situation value operator is equation (16):(16)V=1−τ∗P∗UT.This paper determines the security situation level according to [2, 14], as shown in Table 4. The system security situation level can be determined by combining the V value.Table 4
Security situation level.
V[0,0.2](0.2,0.4](0.4,0.6](0.6,0.8](0.8,1]LevelWorseBadAverageGoodExcellent


### 5.4. Analysis of Algorithm Complexity

In the proposed model, there are two modules. First, we modified the interval matrix to get the best deterministic matrix and obtained the best weight vector. This process traverses all interval matrix elements at least twice. The complexity of this process isOn2. After we get the best weight vector, we need to evaluate each index according to the entropy weight-based cloud. The complexity of the whole process is On. Finally, we calculate the situation security value through equation (16). Therefore, we can obtain the complexity of the whole model as follows.(17)Ω=On2+On


## 5.1. Related Definitions

Membership cloud [14]: define that U is a certain universe, where U=x and S is language value corresponding to accuracy number x. x is a random number with a stable tendency for membership degree CSX, and the distribution of membership degree on the universe is called membership cloud.The digital characteristics of the cloud: the description of cloud rely on 3 parameters. They are expectation valueEx, entropy En, hyper entropy He, where Ex reflects a concept corresponds to the central value of a universe, En reflects the fuzziness of the concept and En reflects the degree of cloud droplet dispersion.Entropy [2]: entropy measures the uncertainty of the system. Define that the system may stay in n different states and the probability of each state occurs is pii=1,2,⋯,n, then the entropy of the system is(6)E=−∑i=1npilnpiwhere 0≤pi≤1 and p1+⋯+pn=1. When pi=1/n, Emax=lnn. Then, when the system has only one state n=1 and Emin=0, the system is determined. With the increase of n, the number of possible states gets higher, then the entropy gets bigger. And the dispersion of the system becomes bigger, and it can provide less information. Thus, the less important this system is relative to other systems.


## 5.2. Expert Evaluation of Membership Cloud

For the evaluation of a certain index,n experts are invited to conduct the evaluation of a certain index, and the evaluation results are converted into a percentage form according to Section 3. The membership clouds represent the evaluation results of the n experts. First, the three digital features (Ex,En,He) of the cloud model are calculated by the reverse cloud generator. Then, the expert evaluation results are restored by the forward cloud generator. Finally, if the cloud drops are too discrete, it indicates that the expert evaluation opinions differ greatly, then we can apply for reevaluation.(1)
Reverse cloud generator(7)Ex=Ex1+Ex2+⋯+Exnn,En=maxEx1,Ex2,⋯,Exn−minEx1,Ex2,⋯,Exnn,S2=1n∑i=1nxi−Ex2,He=S2−En2,where Exi indicates the percentage result of the ith expert evaluation and n indicates the number of experts. The digital features of the membership cloud (Ex,En,He) are calculated by the above equations.(2)
Forward cloud generatorStep 1.
Enn=RandnEn,He, which takes En as the expectation and produces a normally distributed random number Enn with He as the standard deviation.Step 2.
xi=RandnEx,Enn, which takes Ex as the expectation and generates a normally distributed random number xi with Enn as a standard deviation.Step 3.
ξi=exp−xi−Ex2/2Enn2, the degree of membership is calculated according to the equation, and the pair (xi,ξi) represents a cloud drop distributed over the universe U.Step 4.
Step1 through Step 3 is performed cyclically until enough cloud drops are generated to restore the expert evaluation results in the form of a cloud model.


## 5.3. Membership Cloud Gravity Center

The result of the expert evaluation off indexes subordinate to the criterion layer can be represented by f-dimensional membership clouds. The f-dimensional comprehensive membership cloud of the dimension can be formed by a membership cloud gravity center. This paper uses the vector g to represent the gravity center vector of this cloud which is(8)g=g1,g2,⋯,gf.where gi=Exi·wii=1,2,⋯,f, Exi represents the expected value of the ith membership cloud, and wi represents the weight corresponding to the index which is calculated by the modified interval matrix module.Assuming that the initial state of the system is ideal, the initial cloud center of gravity vector of thef-dimensional integrated membership cloud is(9)g0=g10,g20,⋯,gf0.The cloud gravity center vector representing the current expert evaluation result is(10)g′=g1′,g2′,⋯,gf′.Then, normalize the changes in the gravity center vector of thef-dimensional integrated cloud is(11)giG=gi′−gi0gi0,gi′≤gi0gi′−gi0gi′,gi′>gi0where i=1,2,⋯,f.Calculate the weighted deviationδ from the weight vector W=w1,w2,⋯,wf:(12)δ=∑i=1fgiG∗wi.Enterδ into the evaluation cloud model to get the support level of this dimension index for different comments in the criterion layer [15]. The evaluation cloud model is shown in Figure 4.Figure 4
Evaluation cloud model.In the process of quantifying the situation from the index layer to the criterion layer, the cloud gravity center evaluation method can be used to calculate the weighted deviation and obtain the safety situation value of the different dimension indexes in the criterion layer, and the process of quantifying the situation from the criterion layer to the target layer. In the traditional method [16], the dimension indexes of the default criterion layer are usually the same relative importance, but the relative importance of different indexes in the criterion layer is not distinguished. This has certain limitations on the quantitative value of the comprehensive security situation of the information system.First, at a certain moment, the relative importance of the physical dimension, host dimension, network dimension, data dimension, and manager dimension of different information systems is different. The reason is that some information systems and external network channels are less or even isolation, the main factor affecting the security of the system type is behavior adjustment management [17], and some information systems often face threats such as vulnerabilities and malicious attacks, so it is necessary to focus on the protection of their host and network dimension indexes. Second, for the same information system, the main influencing factors affecting its security situation will change with time. This is due to the update of information system software and hardware. The change of managers will cause the weight vector of the criterion layer to change, which will affect the system the total security assessment value.Given the above problems, based on the cloud gravity center-weighted deviation of each index in the known criterion layer, by reviewing the comments of the activated comments in the cloud model and the support of each comment, the dimension indexes of the criterion layer are determined relative to each comment. The support matrixP is as shown in Table 3.Table 3
Support matrix.
Criteria layerWorseBadAverageGoodExcellentX1P11P12P13P14P15X2P21P22P23P24P25X3P31P32P33P34P35X4P41P42P43P44P45X5P51P52P53P54P55X1, X2, X3, X4, and X5 in Table 3 correspond to the 5 dimensions of the criterion layer, respectively, and pij indicates the degree of support of the ith index to the jth comment (i,j∈1,2,3,4,5).Calculate the absolute entropy of each dimension index by using equation (13):(13)Hi=−∑j=1npijlnpij,when pi1=pi2=⋯=pin, there is Hmax=lnn. Calculate the relative entropy value of each dimension index by using equation (13)(14)μi=−1lnn∑j=1npijlnpij.The weight of the corresponding index is expressed by (1-μi), which is normalized:(15)τi=1n−∑i=1nui1−ui,where τi∈0,1 and τ1+⋯+τn=1, τi is the entropy weight coefficient of the subordinate cloud corresponding to Xi.The weight vector corresponding to each comment in the given evaluation cloud model is set asU=uworse,ubad,uaverage,ugood,uexcellent=1/15,2/15,1/5,4/15,1/3 [2, 18].The information system comprehensive security situation value operator is equation (16):(16)V=1−τ∗P∗UT.This paper determines the security situation level according to [2, 14], as shown in Table 4. The system security situation level can be determined by combining the V value.Table 4
Security situation level.
V[0,0.2](0.2,0.4](0.4,0.6](0.6,0.8](0.8,1]LevelWorseBadAverageGoodExcellent


## 5.4. Analysis of Algorithm Complexity

In the proposed model, there are two modules. First, we modified the interval matrix to get the best deterministic matrix and obtained the best weight vector. This process traverses all interval matrix elements at least twice. The complexity of this process isOn2. After we get the best weight vector, we need to evaluate each index according to the entropy weight-based cloud. The complexity of the whole process is On. Finally, we calculate the situation security value through equation (16). Therefore, we can obtain the complexity of the whole model as follows.(17)Ω=On2+On


## 6. Results and Discussion

The model proposed in this paper is applied to the departure control system for smart mobile devices. The system security situation assessment is conducted every Tuesday, from October 1 to December 23, 2018, for a total of 12 times. The following experiment uses the evaluation of the network dimension of the system criterion layer on October 9, 2018, as an example to illustrate the application process of the evaluation model.


### 6.1. Normalization of Multisource Data

For the four subindexes of the network dimensionI3I31,I32,I33,I34=networktopology,networkaccesscontrol,securityaudit,networktraffic, 10 experts are invited to evaluate each sub-index. Take “identification” (in Figure 2) for example, when password guessing [19] or two-factor authentication schemes [20, 21] are implemented, the security situation will reach a serious state which needs the information system manager give emergency reaction to keep the system stay a good state. And experts will give a score between 80 and 100, which represents the situation is bad. Then according to Section 3, the evaluation of qualitative and quantitative indexes was unified into the score under the percentage system, and the scores of the subindexes are shown in Table 5.Table 5
Experts’ evaluation percentage.
ExpertiI31I32I33I341978690962928992933949094954898794945928693946958992957908595968888891949988890951096879195


### 6.2. Determine Index Weights

The interval judgment matrix is given by experts on the relative importance of the four subindexes:(18)A0=13,43,53,51/4,1/311/2,12,51/5,1/31,211/3,11/5,1/31/5,1/21,31.According to the method in Section4, firstly judge the consistency degree of the interval matrix, and take the consistency degree threshold value to be 0.6 to obtain γ=0.76>0.6 [13], which shows that the consistency degree of the interval matrix meets the requirements, and no further interaction with the experts is needed. This matrix is used as the best interval matrix in Section 4.2.3. Then, the interval matrix is converged, and R=100, ω=10. After 7 iterations, the convergence interval matrix is(19)A1=13.210,3.4633.653,4.0004.202,4.4170.289,0.31210.934,0.9532.029,2.0400.250,0.2741.049,1.07010.894,0.9050.226,0.2380.490,0.4931.104,1.1191.Based on this matrix, the optimization process based on the adjusted deterministic matrix is obtained under the condition of the number of optimization timesk=1000, and the best deterministic matrix is(20)Abest=13.3006793.8749244.2617780.30035110.9429912.0326110.2591021.05709710.8993720.2337990.4901481.1099491.The consistency ratio isCR=0.022591<0.1. This matrix has satisfactory consistency. The weight vector obtained is w=0.555665,0.178134,0.144072,0.122129.


### 6.3. Situation Quantification and Grading

The experts’ evaluation results are restored by the cloud, as shown in Figure5. Since the cloud droplets of each cloud model are more concentrated, it indicates that the experts’ evaluation comments are more consistent, so there is no need to request experts’ reevaluation.Figure 5
Reduction of four indexes’ evaluation.The expected value vectors of the four subindexes of network dimension based on the graph and the weight corresponding to each expected value obtained based on Section6.2 are shown in Table 6.Table 6
Expected values and weights of each index.
IndexI3iI31I32I33I34Expected valueE392.9687.5092.2294.72Weightw3i0.555 6650.178 1340.144 0720.122 129According to equations (11) and (12), the weighted deviation degree is δ=−0.079134, and the security situation value of the network dimension is 0.920 866. Inputting δ into the evaluation cloud model indicates that the network dimension is in “excellent” state, as shown in Figure 6.Figure 6
Evaluation cloud activation.For the normal curve fitting of the evaluation cloud model, the support degree of the comment “good” is 0.122 04, the support degree of the comment “excellent” is 0.636 88. The remaining support degree1−0.12204−0.63688=0.24108 is allocated by the reciprocal ratio of the distance between the dimension and the expected value of the other three inactive reviews. The network dimension comment support vector p31,p32,p33,p34,p35=0.05286,0.07256,0.11566,0.12204,0.63688.The evaluation support vector for the other four-dimensional indexes of the criterion layer is the same as the calculation process of the network dimension and will not be described here.The obtained security level value vector of each dimension of the criterion layer is (0.677 2,0.731 4,0.920 9,0.522 5,0.643 4), and the comment support matrixP is shown in Table 7.Table 7
Comment support.
Criteria layerWorseBadAverageGoodExcellentX10.045 930.072 190.104 120.682 610.095 54X20.000 670.001 020.201 110.975 380.001 82X30.052 860.072 560.115 660.122 040.636 88X40.002 940.056 400.964 180.024 020.032 19X50.074 710.122 190.227 290.441 000.134 80According to equations (13)–(15), the criterion layer index entropy weight coefficient vector can be calculated as: τ=0.143,0.380,0.121,0.307,0.049. The comprehensive security situation value of this system is 0.752. Combined with Table 4, the security situation of the information system is in an “excellent” state, which is consistent with the actual situation.The security situation assessment method in this paper, the entropy weight coefficient method [2], the improved Hidden Markov Model [4], and the AHP method [12] are applied to the evaluation of this system. The criterion layer security situation and total security situation are evaluated, as shown in Figures 7 and 8.Figure 7
Criterion layer security situation.Figure 8
Total security situation.As can be seen from Figures7 and 8, the fluctuation of the situation assessment value of the model in this paper is obviously smaller than that obtained by the entropy weight coefficient method [2], the improved Hidden Markov Model [4], and the AHP method [12]. There are two reasons: first, the model in this paper improves the objective degree of the weight vector by modifying the interval matrix and overcomes the shortcoming of the strong subjectivity of the traditional AHP method. At the same time, by judging the dispersion degree of the subordinate cloud droplets of the experts’ evaluation results, abnormal index values can be found and reevaluation. Compared with the entropy weight coefficient method, unreasonable index weighting can be avoided. Therefore, the quantitative result of the model in this paper is more appropriate to the actual system security situation, which improves the reliability of this information system security situation assessment model.Second, due to the difference of experts’ ability, it is difficult to judge the relative importance of each dimension index in the criterion layer uniformly. Based on multisource data normalization, the entropy weight coefficient of each cloud model corresponding to the criterion layer index is used to avoid weighting directly for the criterion layer index. Therefore, the total situation value of the actual system can avoid large fluctuation and improve the stability of information system security situation assessment.


## 6.1. Normalization of Multisource Data

For the four subindexes of the network dimensionI3I31,I32,I33,I34=networktopology,networkaccesscontrol,securityaudit,networktraffic, 10 experts are invited to evaluate each sub-index. Take “identification” (in Figure 2) for example, when password guessing [19] or two-factor authentication schemes [20, 21] are implemented, the security situation will reach a serious state which needs the information system manager give emergency reaction to keep the system stay a good state. And experts will give a score between 80 and 100, which represents the situation is bad. Then according to Section 3, the evaluation of qualitative and quantitative indexes was unified into the score under the percentage system, and the scores of the subindexes are shown in Table 5.Table 5
Experts’ evaluation percentage.
ExpertiI31I32I33I341978690962928992933949094954898794945928693946958992957908595968888891949988890951096879195


## 6.2. Determine Index Weights

The interval judgment matrix is given by experts on the relative importance of the four subindexes:(18)A0=13,43,53,51/4,1/311/2,12,51/5,1/31,211/3,11/5,1/31/5,1/21,31.According to the method in Section4, firstly judge the consistency degree of the interval matrix, and take the consistency degree threshold value to be 0.6 to obtain γ=0.76>0.6 [13], which shows that the consistency degree of the interval matrix meets the requirements, and no further interaction with the experts is needed. This matrix is used as the best interval matrix in Section 4.2.3. Then, the interval matrix is converged, and R=100, ω=10. After 7 iterations, the convergence interval matrix is(19)A1=13.210,3.4633.653,4.0004.202,4.4170.289,0.31210.934,0.9532.029,2.0400.250,0.2741.049,1.07010.894,0.9050.226,0.2380.490,0.4931.104,1.1191.Based on this matrix, the optimization process based on the adjusted deterministic matrix is obtained under the condition of the number of optimization timesk=1000, and the best deterministic matrix is(20)Abest=13.3006793.8749244.2617780.30035110.9429912.0326110.2591021.05709710.8993720.2337990.4901481.1099491.The consistency ratio isCR=0.022591<0.1. This matrix has satisfactory consistency. The weight vector obtained is w=0.555665,0.178134,0.144072,0.122129.


## 6.3. Situation Quantification and Grading

The experts’ evaluation results are restored by the cloud, as shown in Figure5. Since the cloud droplets of each cloud model are more concentrated, it indicates that the experts’ evaluation comments are more consistent, so there is no need to request experts’ reevaluation.Figure 5
Reduction of four indexes’ evaluation.The expected value vectors of the four subindexes of network dimension based on the graph and the weight corresponding to each expected value obtained based on Section6.2 are shown in Table 6.Table 6
Expected values and weights of each index.
IndexI3iI31I32I33I34Expected valueE392.9687.5092.2294.72Weightw3i0.555 6650.178 1340.144 0720.122 129According to equations (11) and (12), the weighted deviation degree is δ=−0.079134, and the security situation value of the network dimension is 0.920 866. Inputting δ into the evaluation cloud model indicates that the network dimension is in “excellent” state, as shown in Figure 6.Figure 6
Evaluation cloud activation.For the normal curve fitting of the evaluation cloud model, the support degree of the comment “good” is 0.122 04, the support degree of the comment “excellent” is 0.636 88. The remaining support degree1−0.12204−0.63688=0.24108 is allocated by the reciprocal ratio of the distance between the dimension and the expected value of the other three inactive reviews. The network dimension comment support vector p31,p32,p33,p34,p35=0.05286,0.07256,0.11566,0.12204,0.63688.The evaluation support vector for the other four-dimensional indexes of the criterion layer is the same as the calculation process of the network dimension and will not be described here.The obtained security level value vector of each dimension of the criterion layer is (0.677 2,0.731 4,0.920 9,0.522 5,0.643 4), and the comment support matrixP is shown in Table 7.Table 7
Comment support.
Criteria layerWorseBadAverageGoodExcellentX10.045 930.072 190.104 120.682 610.095 54X20.000 670.001 020.201 110.975 380.001 82X30.052 860.072 560.115 660.122 040.636 88X40.002 940.056 400.964 180.024 020.032 19X50.074 710.122 190.227 290.441 000.134 80According to equations (13)–(15), the criterion layer index entropy weight coefficient vector can be calculated as: τ=0.143,0.380,0.121,0.307,0.049. The comprehensive security situation value of this system is 0.752. Combined with Table 4, the security situation of the information system is in an “excellent” state, which is consistent with the actual situation.The security situation assessment method in this paper, the entropy weight coefficient method [2], the improved Hidden Markov Model [4], and the AHP method [12] are applied to the evaluation of this system. The criterion layer security situation and total security situation are evaluated, as shown in Figures 7 and 8.Figure 7
Criterion layer security situation.Figure 8
Total security situation.As can be seen from Figures7 and 8, the fluctuation of the situation assessment value of the model in this paper is obviously smaller than that obtained by the entropy weight coefficient method [2], the improved Hidden Markov Model [4], and the AHP method [12]. There are two reasons: first, the model in this paper improves the objective degree of the weight vector by modifying the interval matrix and overcomes the shortcoming of the strong subjectivity of the traditional AHP method. At the same time, by judging the dispersion degree of the subordinate cloud droplets of the experts’ evaluation results, abnormal index values can be found and reevaluation. Compared with the entropy weight coefficient method, unreasonable index weighting can be avoided. Therefore, the quantitative result of the model in this paper is more appropriate to the actual system security situation, which improves the reliability of this information system security situation assessment model.Second, due to the difference of experts’ ability, it is difficult to judge the relative importance of each dimension index in the criterion layer uniformly. Based on multisource data normalization, the entropy weight coefficient of each cloud model corresponding to the criterion layer index is used to avoid weighting directly for the criterion layer index. Therefore, the total situation value of the actual system can avoid large fluctuation and improve the stability of information system security situation assessment.


## 7. Conclusions

This paper proposes a MIMEC-based security situation assessment model of information system for smart mobile devices. This model modifies the interval judgment matrix, finds the best deterministic matrix to determine the index layer weight vector, and combines the entropy weight membership cloud to quantify and grading the security situation. Through the experiment on the departure control system for smart mobile devices, we found that the existing information system is always in a serious situation, which means the information system manager is supposed to take some measures to protect the system. We believe that our findings and our model can extend the models used in previous work and correct shortcomings of previous models. And compared the evaluation results with other methods, it shows that our model has good reliability and stability.Our future work will focus on this study to assess extensive information system situation security for smart mobile devices. In addition, more realistic assessment methods such as Pythagorean Fuzzy Subsets [22], and Intuitionistic Fuzzy Petri Nets [23] will be used to improve the accuracy of the proposed model.



---

*Source: 8886516-2020-10-08.xml*