# Comprehensive Assessment of Mobile Service Privacy Security Based on FAHP and D–S Theory

Authors: Ming Yang; Tilei Gao; Rong Jiang; Li Jia; Di Yang
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

As an indispensable medium for people’s daily life and communication, mobile applications provide users with a variety of services. In order to enjoy these services, users inevitably need to provide personal privacy information or authorization to application providers in the process of use. In the case of insufficient privacy security evaluation, even if users use the applications verified by the application market, their privacy security will be threatened because of their weak awareness of privacy protection. Therefore, in order to ensure the privacy security of users, this paper establishes a mobile service assessment attribute model including 3 risk categories and 11 risk indicators. Based on this model, this paper proposes a service risk weight assessment method based on FAHP (fuzzy analytical hierarchy process), defines the risk level and its trust degree from two aspects of risk frequency and risk loss, and puts forward a reasonable fusion method for different assessment results of risk level based on D–S (Dempster–Shafer) theory, so as to realize the multidimensional and multilayer assessment of mobile service risk. Finally, the case analysis shows that the method proposed in this paper is reasonable and feasible and has important value for improving the security of mobile services and managing users’ privacy information.


---

## Body

## 1. Introduction

According to global mobile market report of market research firm Newzoo [1], the number of global smartphone users has reached 3.9 billion. According to the survey of China Mobile Internet development report [2], the total number of mobile users in China has reached 1.289 billion, and the number of mobile applications has reached 3.45 million. Thus, it can be seen that, with the development of communication technology, mobile application has become an indispensable product for public life and has an extremely large user group all over the world.However, with the gradual expansion of the application market, the problem of user privacy security is becoming more and more serious. At this stage, although many mobile application markets have carried out relevant security detection on their applications, these applications that have passed the detection still have potential threats to users’ privacy security. According to the 2020 annual observation report on Internet mobile application privacy in China [3], more than 82.72% of the 3.3 million applications in China have vulnerability risk. These malicious applications mainly have a variety of malicious behaviors on mobile users, such as privacy data collection, malicious fee deduction, traffic resource consumption, system damage, and advertising push, which pose a great threat to the personal information and property security of mobile users. These privacy security problems not only come from technical vulnerabilities but also are affected by the service provider’s operating environment, actual application scenarios, and terminal equipment risks.Therefore, it is still not enough to ensure the privacy security of users in the use process only through the security detection of the application market. In order to ensure the privacy and security of users, in addition to solving technical problems, it is also necessary to sort out relevant risk indicators, establish a special assessment system, and provide users with comprehensive assessment results through evaluation, so as to help users reasonably select and use relevant services. In order to achieve this goal, aiming at multiple risk indicators of mobile service privacy risk, this paper establishes a risk attribute model based on FAHP (fuzzy analytical hierarchy process). FAHP is a method which is suitable to deal with multiobjective decision-making problems. The establishment of a hierarchical model based on FAHP can not only provide support for the assessment of privacy risk but also provide users with the weight comparison results of relevant risk indicators. On this basis, in order to solve the problem of conflict information in the assessment process and provide users with intuitive assessment results, this paper further assesses the level of risk combined with D–S (Dempster–Shafer) theory. D–S theory is an uncertain reasoning method, which is suitable to deal with multi-information problems. It can reasonably solve the conflict information in the assessment process and effectively fuse the information. As mentioned above, the combination of FAHP and D–S theory can provide support for risk assessment and ensure the comprehensiveness and objectivity of assessment results. Therefore, this paper integrates the two theories into the assessment of mobile service privacy risk, establishes a mobile service privacy risk attribute model including 3 risk categories and 11 risk indicators, assesses the risk weight and risk level, and finally realizes the multilevel and multi-dimensional assessment of mobile service privacy risk.This paper can divided into the following parts: in Section1, this paper introduces the research background and content; in Section 2, this paper summarizes the relevant attributes and assessment methods of mobile service privacy risk and points out the problems existing in the current research; in Section 3, this paper establishes the privacy risk attribute model based on FAHP and puts forward the evaluation method of risk weight; in Section 4, this paper proposes a privacy risk assessment method based on the D–S theory; in Section 5, based on the research results in Sections 3 and 4, this paper proposes a comprehensive evaluation method of mobile service privacy risk; in Section 6, the proposed method is applied to a specific case for analysis and compared with other assessment methods; in Section 7, the authors summarize the research work of this paper and points out the future research direction.


## 2. Related Research

Mobile applications provide a variety of services for public travel, shopping, communication, and financial management. To enjoy these services, users need to provide personal privacy information or authorization to service providers. Through the research on mobile application recommendation service, Wang et al. [4] pointed out that how to protect users’ privacy while ensuring high-precision recommendation has become the main challenge for the development of mobile commerce. Li et al. [5] pointed out that the factors affecting the privacy security of mobile services include access control, protocol and authentication, integrity verification, and encryption privacy protection and pointed out that a special privacy risk assessment system should be established. In order to evaluate the privacy risk of mobile services, different scholars have explored the evaluation of user privacy security from different angles. Naga et al. [6] have established a risk assessment model for Android applications, which can determine the risk and its level according to the requested permission set. Liu et al. [7] established a special tool to analyze the privacy information that may be collected by Android mobile advertising. Shrivastava and Kumar [8] have established special rules to identify the untrusted permissions and intentions of Android applications. Lo et al. [9] provide a user privacy analysis framework for Android platform to detect user privacy risks, so as to help users manage their privacy reasonably. Yüksel et al. [10] established a fuzzy risk reasoning system, which can score the risk for the functions of Android applications and provide risk analysis results for users before the installation of applications. Dehling et al. [11] assessed the “medical” and “health and fitness” applications on IOS and Android and evaluated the impact on information security and privacy according to the potential damage of information leakage, the potential damage of information loss, and the potential value of information to third parties. Chang et al. [12] realized the effective assessment of mobile applications privacy risk by setting a special data set. Belani et al. [13, 14] analyzed the “intention” of mobile applications and its impact on user privacy and proposed effective verification methods to help users reasonably select and install secure applications. These methods have carried out the assessment of user privacy security from different aspects based on technology, authority, intention or function, but they have not established a complete assessment system to comprehensively assess the privacy risk of mobile services.Shirazi and Iqbal [15] took the community cloud in mobile commerce as the research object and pointed out that users’ privacy security is affected by data encryption, intrusion detection, identity management, security perception, privacy protocol, and other factors. Ashibani and Mahmoud [16] pointed out that ensures the security of mobile applications need to pay more attention to the impact of relevant technologies, such as identity authentication, access control, data encryption, attack detection mechanism, user authentication and authorization. Gutierrez et al. [17] pointed out that advertisements in mobile application platforms are invasive to users’ privacy and may forcibly obtain users’ location and other information, posing a threat to users’ privacy and security. Lee et al. [18] pointed out that location-based services are an important cause of user privacy information disclosure.In addition to the above risk factors, scholars also analyzed the channels causing user privacy disclosure. Schyff et al. [19] pointed out that the main reason for the disclosure of Facebook application privacy information is due to the application’s monitoring and access to data. Bal et al. [20] pointed out that improving privacy risk communication on terminal devices can improve users’ privacy security. Yang et al. [21] pointed out that there are great risks in the process of network transmission of users’ privacy information. It can be seen that mobile services have potential privacy security risks in applications, network transmission, and terminal devices.For how to effectively evaluate privacy risk, Laleh et al. [22] put forward a new concept for risk measurement, that is, the greater the deviation between users’ actual behavior and “normal behavior,” the greater the risk. De and Métayer [23] discussed the concept of privacy risk from two aspects: damage and risk source of privacy risk and gave the corresponding privacy scoring mechanism to help users manage their privacy settings. Xiang [24] built a risk index system of personal privacy information disclosure of mobile commerce consumers and evaluated the risk of consumer privacy disclosure through the fuzzy comprehensive assessment method. Shi et al. [25], Zhang [26], and Yang [27] used the information entropy method to measure and assess the privacy risk according to the uncertainty of information. Ali-Eldin et al. [28] proposed a privacy risk assessment model, which can provide effective privacy risk avoidance and mitigation measures for open data. Cayirci [29] developed a prototype using machine learning to automatically analyze the risks of representative cloud service providers from the Cloud Security Alliance Security. In general, the privacy security of mobile services exists in different channels and is affected by many uncertain risk factors. To improve users’ privacy security, we need to focus on the relevant risk factors and their loss impact, assess the privacy risk of mobile services from many aspects, and provide users with intuitive assessment results. The above assessment method solves the problem of privacy risk measurement, but it cannot effectively solve the problem of “conflict information” in the assessment process, nor comprehensively consider the assessment conclusions of different experts.Therefore, in order to realize the comprehensive and effective assessment of mobile services, this paper intends to establish a multidimensional and multilevel assessment model combined with FAHP method and solve the problem of “conflict information” combined with fuzzy consistency matrix. On the other hand, this paper will describe the risk level combined with fuzzy theory and effectively integrate the assessment results of different experts according to D–S theory. Finally, through the combination of FAHP and D–S theory, this paper realizes the effective measurement and assessment of mobile service privacy risk and provides users with intuitive assessment results.


## 3. Mobile Service Privacy Risk Weight Assessment Based on FAHP

It is known that the publishing, management, and authorization of mobile services is a continuous interactive process, as shown in Figure1.Figure 1
Interactive environment of mobile services.The user’s privacy information is accessed and used repeatedly in this interaction process, which is affected by various uncertain risk factors, resulting in users facing the risk of privacy information disclosure in every link of this interactive process. According to the interaction process shown in Figure1, in order to assess the different dimensions of mobile services, this paper divides the privacy risk of mobile services into three risk categories. The meanings of these three risk categories are as follows:(1)
Platform riskβ1 refers to the privacy risk from platform operation management and functional services(2)
Network riskβ2 refers to the privacy risk in the process of network transmission(3)
Terminal riskβ3 refers to the privacy risk from user terminal equipment or terminal use scenarios


### 3.1. Mobile Service Privacy Risk Attribute Model Based on FAHP

Next, around the above three risk categories, this paper combines a total of 11 relevant risk factors through literature query and expert interview. The meaning of each risk factorCi is shown in Table 1 (i=1,2,…,11).Table 1
Mobile service privacy risk indicators.
IndicatorsMeaningExampleC1Privacy disclosure risk caused by the behavior of internal malicious employeesSell user informationC2Privacy disclosure risk caused by the defects of the software itselfVirus threatC3Risk of privacy information theft by mobile advertisingCollect user preferences; track user locationC4Privacy disclosure risk caused by improper operation or service shutdown of platform providersPlatform failure; service shutdownC5Privacy disclosure risk caused by server identity authentication and access rights vulnerabilitiesUnauthorized login; data isolation defectC6During the transmission of private information, privacy disclosure risk caused by the vulnerability of encryption mechanismInsecure hotspot transmission and Bluetooth connectionC7Privacy information disclosure caused by data loss of service providersMail loss; storage device lossC8Privacy disclosure risk caused by loopholes in the operating system of terminal equipmentTrojan horse attackC9Privacy disclosure risk caused by user rights management errors during useWrong authorizationC10Privacy disclosure risk caused by third-party application attacks during useThird party applications steal informationC11Privacy disclosure risk caused by improper key management during useKey loss; password setting is simpleAfter defining the above risk categories and risk indicators, this paper will assess the weight of mobile service privacy risk combined with the FAHP method. FAHP is known to be a qualitative and quantitative method, which is suitable for dealing with multiobjective decision-making problems.To adopt the FAHP method, we first need to clarify the goal of decision-making and build its hierarchical model around the goal. When the hierarchical model is established, it is necessary to judge the weight of the elements on each layer relative to the elements on its upper layer, so as to realize the layer by layer assessment for the decision-making objectives. Therefore, considering that mobile service privacy risk is also a complex thing with multiple indicators, this paper establishes an attribute model of mobile service privacy risk combined with the FAHP method, so as to realize the multilevel and multidimensional assessment of mobile service privacy risk, as shown in Figure2.Figure 2
Risk attribute model of mobile service privacy based on FAHP.The model is divided into three dimensions (i.e., three risk categories) and three layers. The meaning of each layer in the model is as follows:(1)
Target layer: this layer is the target of the whole assessment, that is, the assessment of mobile service privacy security(2)
Scheme layer: this layer contains three risk categoriesβj to be assessed, j=1,2,3(3)
Indicator layer: this layer is composed of relevant indicators affecting the privacy security of mobile service, including 11 indicatorsCi,i=1,2,…,11The model is established to provide corresponding weight values for subsequent privacy risk level assessment. These weights include the assessment weight of each risk categoryβj relative to the whole service and the assessment weight of each indicator Ci relative to different risk categories βj. After calculating these weight values, combined with the subsequent risk level assessment, we can effectively realize the comprehensive assessment of mobile services from different angles and levels.


### 3.2. Risk Weight Assessment Based on Fuzzy Consistent Matrix

According to the method of AHP, when assessing the weight of the above risk categoriesβj and risk indicators Ci, it is necessary to compare the factor weights of each layer in the model shown in Figure 2 and build its weight judgment matrix relative to the factors of previous layer. It is assumed that there are N factors to be evaluated in the assessment process. If these factors are compared in pairs, a total of NN−1/2 judgments are required. When the value of N is large, the expert needs to make more judgments, which is easy to cause inconsistency in the established judgment matrix. In addition, once the established judgment matrix is inconsistent, experts need to adjust the judgment until the matrix passes the consistency test.So, if the traditional AHP method is used to assess the model shown in Figure2, the assessment process will become particularly complex and difficult, and the accuracy of the final results will be affected. In order to solve this problem, this paper will use fuzzy consistency matrix to judge the weight. On the one hand, the fuzzy consistency matrix inherits the traditional AHP pairwise comparison method, which can reduce the impact of human subjective factors on the assessment results to a certain extent. On the other hand, it can effectively solve the inconsistency in the assessment process [30].


#### 3.2.1. The Construction of Fuzzy Consistency Matrix

According to the definition of fuzzy consistency matrix [30], the weight ratio μCi,Cj between factor ui and factor uj has the following meanings:(1)
μui,uj=0.5 means that ui and uj is equally important(2)
0≤μui,uj<0.5 means that uj is more important than ui, and the smaller the value of μui,uj, the more important uj is than ui(3)
0.5<μui,uj≤1 means that ui is more important than uj, and the larger the value of μui,uj, the more important ui is than ujBased on the above definition, this paper simplifies the construction of fuzzy consistency matrix into 3 steps, which are described as follows:Step 1: construct the fuzzy judgment matrix between each factor:Rijn∗n=μui,u1…μui,un………μun,u1…μun,un.The matrixRijn∗n is a fuzzy matrix and does not have complete consistency.Step 2: convert the established fuzzy matrixRijn∗n into a fuzzy consistency matrix according to the conversion formula:(1)μ¯ui,uj=∑l=1nμui,ul∑l=1nμui,ul+μuj,ul.Here,μ¯ui,uj represents the weight ratio between the two factors after transformation; thus, the new fuzzy consistency matrix is as follows:(2)R¯ijn∗n=μ¯ui,u1…μ¯ui,un………μ¯un,u1…μ¯un,un.Different from the ordinary judgment matrix, the fuzzy consistency matrixR¯ijn∗n has complete consistency.Step 3: when the fuzzy consistency matrixR¯ijn∗n is obtained, the assessment weight of each factor can be calculated as follows.(3)wi=2∑j=1nμ¯ui,uj−1nn−1,i=1,2,…,n,wi represents the assessment weight value of factor i in the matrix. According to the principle of FAHP’s pairwise comparison method [31], wi has certain objectivity. The greater the value of wi, the greater the influence weight of this factor on the assessment target.


#### 3.2.2. The Fuzzy Consistency Matrix of Mobile Service Privacy Risk

Around the research goal of this paper, the model shown in Figure2 is substituted into the steps in Section 3.2.1 for assessment. By constructing the following fuzzy consistency matrix layer by layer, the assessment weight of each risk category βj relative to the whole service and the assessment weight of each indicator Ci relative to different risk categories βj all can be calculated, respectively:(1)
Weight judgment matrix of layer 2 relative to layer 1The weight judgment matrix of layer 2 relative to layer 1 refers to the risk weight judgment matrix of each risk categoryβj relative to whole mobile service. By establishing the matrix, the assessment weight Wβj of each risk category βj relative to the whole privacy risk can be calculated. The greater the value of Wβj, the greater the impact of risk category βj on the privacy risk of the whole mobile service.(2)
Weight judgment matrix of layer 3 relative to layer 2The weight judgment matrix of layer 3 relative to layer 2 includes three matrices, which are each indicatorCi relative to risk category β1, and each indicator Ci is relative to the risk category β2, and the weight judgment matrix of each indicator Ci relative to the risk category β3. Similarly, by establishing these three matrices, we can calculate the assessment weight WCi,βj of indicator Ci relative to risk category βj. The greater the value of WCi,βj, the greater the impact of indicator Ci on risk category βj.After calculating the assessment weight ofWCi,βj and Wβj through the above method, combined with the risk level of each risk indicator Ci at the bottom of the model shown in Figure 2, the multilevel and multidimensional assessment of mobile service risk can be realized from bottom to top. Therefore, next, this paper will continue to focus on the assessment of mobile service risk level.


## 3.1. Mobile Service Privacy Risk Attribute Model Based on FAHP

Next, around the above three risk categories, this paper combines a total of 11 relevant risk factors through literature query and expert interview. The meaning of each risk factorCi is shown in Table 1 (i=1,2,…,11).Table 1
Mobile service privacy risk indicators.
IndicatorsMeaningExampleC1Privacy disclosure risk caused by the behavior of internal malicious employeesSell user informationC2Privacy disclosure risk caused by the defects of the software itselfVirus threatC3Risk of privacy information theft by mobile advertisingCollect user preferences; track user locationC4Privacy disclosure risk caused by improper operation or service shutdown of platform providersPlatform failure; service shutdownC5Privacy disclosure risk caused by server identity authentication and access rights vulnerabilitiesUnauthorized login; data isolation defectC6During the transmission of private information, privacy disclosure risk caused by the vulnerability of encryption mechanismInsecure hotspot transmission and Bluetooth connectionC7Privacy information disclosure caused by data loss of service providersMail loss; storage device lossC8Privacy disclosure risk caused by loopholes in the operating system of terminal equipmentTrojan horse attackC9Privacy disclosure risk caused by user rights management errors during useWrong authorizationC10Privacy disclosure risk caused by third-party application attacks during useThird party applications steal informationC11Privacy disclosure risk caused by improper key management during useKey loss; password setting is simpleAfter defining the above risk categories and risk indicators, this paper will assess the weight of mobile service privacy risk combined with the FAHP method. FAHP is known to be a qualitative and quantitative method, which is suitable for dealing with multiobjective decision-making problems.To adopt the FAHP method, we first need to clarify the goal of decision-making and build its hierarchical model around the goal. When the hierarchical model is established, it is necessary to judge the weight of the elements on each layer relative to the elements on its upper layer, so as to realize the layer by layer assessment for the decision-making objectives. Therefore, considering that mobile service privacy risk is also a complex thing with multiple indicators, this paper establishes an attribute model of mobile service privacy risk combined with the FAHP method, so as to realize the multilevel and multidimensional assessment of mobile service privacy risk, as shown in Figure2.Figure 2
Risk attribute model of mobile service privacy based on FAHP.The model is divided into three dimensions (i.e., three risk categories) and three layers. The meaning of each layer in the model is as follows:(1)
Target layer: this layer is the target of the whole assessment, that is, the assessment of mobile service privacy security(2)
Scheme layer: this layer contains three risk categoriesβj to be assessed, j=1,2,3(3)
Indicator layer: this layer is composed of relevant indicators affecting the privacy security of mobile service, including 11 indicatorsCi,i=1,2,…,11The model is established to provide corresponding weight values for subsequent privacy risk level assessment. These weights include the assessment weight of each risk categoryβj relative to the whole service and the assessment weight of each indicator Ci relative to different risk categories βj. After calculating these weight values, combined with the subsequent risk level assessment, we can effectively realize the comprehensive assessment of mobile services from different angles and levels.


## 3.2. Risk Weight Assessment Based on Fuzzy Consistent Matrix

According to the method of AHP, when assessing the weight of the above risk categoriesβj and risk indicators Ci, it is necessary to compare the factor weights of each layer in the model shown in Figure 2 and build its weight judgment matrix relative to the factors of previous layer. It is assumed that there are N factors to be evaluated in the assessment process. If these factors are compared in pairs, a total of NN−1/2 judgments are required. When the value of N is large, the expert needs to make more judgments, which is easy to cause inconsistency in the established judgment matrix. In addition, once the established judgment matrix is inconsistent, experts need to adjust the judgment until the matrix passes the consistency test.So, if the traditional AHP method is used to assess the model shown in Figure2, the assessment process will become particularly complex and difficult, and the accuracy of the final results will be affected. In order to solve this problem, this paper will use fuzzy consistency matrix to judge the weight. On the one hand, the fuzzy consistency matrix inherits the traditional AHP pairwise comparison method, which can reduce the impact of human subjective factors on the assessment results to a certain extent. On the other hand, it can effectively solve the inconsistency in the assessment process [30].


### 3.2.1. The Construction of Fuzzy Consistency Matrix

According to the definition of fuzzy consistency matrix [30], the weight ratio μCi,Cj between factor ui and factor uj has the following meanings:(1)
μui,uj=0.5 means that ui and uj is equally important(2)
0≤μui,uj<0.5 means that uj is more important than ui, and the smaller the value of μui,uj, the more important uj is than ui(3)
0.5<μui,uj≤1 means that ui is more important than uj, and the larger the value of μui,uj, the more important ui is than ujBased on the above definition, this paper simplifies the construction of fuzzy consistency matrix into 3 steps, which are described as follows:Step 1: construct the fuzzy judgment matrix between each factor:Rijn∗n=μui,u1…μui,un………μun,u1…μun,un.The matrixRijn∗n is a fuzzy matrix and does not have complete consistency.Step 2: convert the established fuzzy matrixRijn∗n into a fuzzy consistency matrix according to the conversion formula:(1)μ¯ui,uj=∑l=1nμui,ul∑l=1nμui,ul+μuj,ul.Here,μ¯ui,uj represents the weight ratio between the two factors after transformation; thus, the new fuzzy consistency matrix is as follows:(2)R¯ijn∗n=μ¯ui,u1…μ¯ui,un………μ¯un,u1…μ¯un,un.Different from the ordinary judgment matrix, the fuzzy consistency matrixR¯ijn∗n has complete consistency.Step 3: when the fuzzy consistency matrixR¯ijn∗n is obtained, the assessment weight of each factor can be calculated as follows.(3)wi=2∑j=1nμ¯ui,uj−1nn−1,i=1,2,…,n,wi represents the assessment weight value of factor i in the matrix. According to the principle of FAHP’s pairwise comparison method [31], wi has certain objectivity. The greater the value of wi, the greater the influence weight of this factor on the assessment target.


### 3.2.2. The Fuzzy Consistency Matrix of Mobile Service Privacy Risk

Around the research goal of this paper, the model shown in Figure2 is substituted into the steps in Section 3.2.1 for assessment. By constructing the following fuzzy consistency matrix layer by layer, the assessment weight of each risk category βj relative to the whole service and the assessment weight of each indicator Ci relative to different risk categories βj all can be calculated, respectively:(1)
Weight judgment matrix of layer 2 relative to layer 1The weight judgment matrix of layer 2 relative to layer 1 refers to the risk weight judgment matrix of each risk categoryβj relative to whole mobile service. By establishing the matrix, the assessment weight Wβj of each risk category βj relative to the whole privacy risk can be calculated. The greater the value of Wβj, the greater the impact of risk category βj on the privacy risk of the whole mobile service.(2)
Weight judgment matrix of layer 3 relative to layer 2The weight judgment matrix of layer 3 relative to layer 2 includes three matrices, which are each indicatorCi relative to risk category β1, and each indicator Ci is relative to the risk category β2, and the weight judgment matrix of each indicator Ci relative to the risk category β3. Similarly, by establishing these three matrices, we can calculate the assessment weight WCi,βj of indicator Ci relative to risk category βj. The greater the value of WCi,βj, the greater the impact of indicator Ci on risk category βj.After calculating the assessment weight ofWCi,βj and Wβj through the above method, combined with the risk level of each risk indicator Ci at the bottom of the model shown in Figure 2, the multilevel and multidimensional assessment of mobile service risk can be realized from bottom to top. Therefore, next, this paper will continue to focus on the assessment of mobile service risk level.


## 3.2.1. The Construction of Fuzzy Consistency Matrix

According to the definition of fuzzy consistency matrix [30], the weight ratio μCi,Cj between factor ui and factor uj has the following meanings:(1)
μui,uj=0.5 means that ui and uj is equally important(2)
0≤μui,uj<0.5 means that uj is more important than ui, and the smaller the value of μui,uj, the more important uj is than ui(3)
0.5<μui,uj≤1 means that ui is more important than uj, and the larger the value of μui,uj, the more important ui is than ujBased on the above definition, this paper simplifies the construction of fuzzy consistency matrix into 3 steps, which are described as follows:Step 1: construct the fuzzy judgment matrix between each factor:Rijn∗n=μui,u1…μui,un………μun,u1…μun,un.The matrixRijn∗n is a fuzzy matrix and does not have complete consistency.Step 2: convert the established fuzzy matrixRijn∗n into a fuzzy consistency matrix according to the conversion formula:(1)μ¯ui,uj=∑l=1nμui,ul∑l=1nμui,ul+μuj,ul.Here,μ¯ui,uj represents the weight ratio between the two factors after transformation; thus, the new fuzzy consistency matrix is as follows:(2)R¯ijn∗n=μ¯ui,u1…μ¯ui,un………μ¯un,u1…μ¯un,un.Different from the ordinary judgment matrix, the fuzzy consistency matrixR¯ijn∗n has complete consistency.Step 3: when the fuzzy consistency matrixR¯ijn∗n is obtained, the assessment weight of each factor can be calculated as follows.(3)wi=2∑j=1nμ¯ui,uj−1nn−1,i=1,2,…,n,wi represents the assessment weight value of factor i in the matrix. According to the principle of FAHP’s pairwise comparison method [31], wi has certain objectivity. The greater the value of wi, the greater the influence weight of this factor on the assessment target.


## 3.2.2. The Fuzzy Consistency Matrix of Mobile Service Privacy Risk

Around the research goal of this paper, the model shown in Figure2 is substituted into the steps in Section 3.2.1 for assessment. By constructing the following fuzzy consistency matrix layer by layer, the assessment weight of each risk category βj relative to the whole service and the assessment weight of each indicator Ci relative to different risk categories βj all can be calculated, respectively:(1)
Weight judgment matrix of layer 2 relative to layer 1The weight judgment matrix of layer 2 relative to layer 1 refers to the risk weight judgment matrix of each risk categoryβj relative to whole mobile service. By establishing the matrix, the assessment weight Wβj of each risk category βj relative to the whole privacy risk can be calculated. The greater the value of Wβj, the greater the impact of risk category βj on the privacy risk of the whole mobile service.(2)
Weight judgment matrix of layer 3 relative to layer 2The weight judgment matrix of layer 3 relative to layer 2 includes three matrices, which are each indicatorCi relative to risk category β1, and each indicator Ci is relative to the risk category β2, and the weight judgment matrix of each indicator Ci relative to the risk category β3. Similarly, by establishing these three matrices, we can calculate the assessment weight WCi,βj of indicator Ci relative to risk category βj. The greater the value of WCi,βj, the greater the impact of indicator Ci on risk category βj.After calculating the assessment weight ofWCi,βj and Wβj through the above method, combined with the risk level of each risk indicator Ci at the bottom of the model shown in Figure 2, the multilevel and multidimensional assessment of mobile service risk can be realized from bottom to top. Therefore, next, this paper will continue to focus on the assessment of mobile service risk level.


## 4. The Measurement of Privacy Risk Level of Mobile Services

The privacy risk weight assessment of mobile services based on FAHP can only assess the degree of risk importance. To provide detailed assessment data for the selection and use of mobile services, we need to further assess the level of risk.


### 4.1. Definition of Privacy Risk Level of Mobile Services

Privacy risk is an abstract concept. In order to measure its level effectively, this paper preliminarily sets its risk level from two aspects: risk frequency and risk loss, as shown in Table2.Table 2
Definition of privacy risk level of mobile services.
Risk frequency levelMeaning1This risk rarely occurs and is extremely rare2This risk occurs occasionally and in rare cases3This risk is a common risk and often occurs4This risk is almost inevitableRisk loss levelMeaning1This risk will hardly pose a threat to the privacy and security of users2This risk will lead to the disclosure of users’ basic information, such as interests, hobbies, and location information3This risk will cause the disclosure of important information of users, such as identity information, contact information, and health information4This risk will lead to the disclosure of all users’ privacy information, including key information, and financial information


### 4.2. Risk Level Assessment Based on Fuzzy Theory and D–S Theory

Although Table2 defines the risk level from the perspectives of risk occurrence frequency and loss severity, due to the abstract characteristics of risk itself, it is still difficult for experts to clearly define its level in the actual assessment process.In addition, in the assessment process, due to the influence of human factors, different experts will have some differences on the definition of risk level, which brings difficulties to the assessment process. To solve the above two problems, this paper proposes to redescribe the risk level combined with fuzzy theory [32] and fuse the assessment results of different experts with D–S theory.D–S evidence theory is an uncertain reasoning method, which is often used in the field of information fusion. It can effectively deal with the problem of information conflict in the fusion process and can give a reasonable fusion result through calculation. In the fusion process, when there are multiple valid data, according to D–S theory, the first thing to do is to treat the collected data as valid evidence and then give each evidence with a trust degree. When each evidence has a trust degree, they can be fused through relevant formulas.Therefore, in order to effectively integrate the risk level assessment results of each expert, according to D–S theory, this paper regards the assessment results of each expert as effective evidence and assesses the privacy risk level of mobile services. The process is as follows.Firstly, in order to ensure the accuracy of the assessment results, based on the risk level shown in Table2, this paper introduces the concept of trust degree mA, which is used to describe the level of privacy risk, 0≤mA≤1. A is a fuzzy set, which represents any possible set of the risk indicator level, including 1,2,3,4,1,2,2,3,3,4, and ∑A≠∅mA=1. As shown in Table 3, the greater the value of mA, the greater the possibility that the risk indicator level belongs to set A.Table 3
Frequency level of risk indicatorCi based on fuzzy theory.
Risk frequency levelAssessment 1Assessment 2Assessment 3Arbitrary setAm1A1m2A2m3A310001-200020002-30.20.20.3300.103-40.80.70.74000Table3 contains the assessment data of three experts on risk indicator Ci, namely, assessment 1, assessment 2, and assessment 3. The three experts gave different trust degrees m1A1, m2A2, and m3A3 for the occurrence frequency level of risk indicator Ci. In order to obtain an accurate assessment result, the assessment data of three experts need to be fused according to D–S theory [33].(4)mA=m1⊕m2⊕⋯⊕mnA=1k∑A1∩​A2∩​…∩​An=Am1A1m2A2⋯mnAn.Here,k is the normalization factor, and it has two calculation methods. The purpose of the two calculation methods is the same, and the results are the same, but the calculation methods are different, as shown in formulas (5) and (6).(5)k=1−∑A1∩​A2∩​…∩​An=∅m1A1m2A2⋯mnAn,(6)k=∑A1∩​A2∩​…∩​An≠∅m1A1m2A2⋯mnAn.As shown in Table3, to fuse the assessment results of different experts, there are many possible sets to be analyzed, which bring difficulties to the calculation process. In order to simplify the calculation process, according to the basic idea of D–S approximate calculation, this paper proposes to use Bayes approximation method [34] to simplify set A in Table 3, and its calculation is shown in as follows:(7)mA¯=∑A¯⊆AmA∑A⊆ΘmA∗N.Here,A¯ is the simplified set of A, Θ represents the complete set, and N is the total number of factors contained in A. As described above, the data in Table 3 can be substituted into formula (7) for calculation, and the calculation process is as follows:(8)m1¯=m1+m1,2m1+m1,2∗2+m2+m2,3∗2+m3+m3,4∗2+m4,m2¯=m1,2+m2+m2,3m1+m1,2∗2+m2+m2,3∗2+m3+m3,4∗2+m4,m3¯=m2,3+m3+m3,4m1+m1,2∗2+m2+m2,3∗2+m3+m3,4∗2+m4,m4¯=m3,4+m4m1+m1,2∗2+m2+m2,3∗2+m3+m3,4∗2+m4.Finally, the simplified setA¯ can be obtained, as shown in Table 4.Table 4
Frequency level of risk indicatorCi after Bayes approximation.
Risk frequency levelAssessment 1Assessment 2Assessment 3Arbitrary setA¯m1A¯1m2A¯2m3A¯310.00000.00000.000020.10000.10530.150030.50000.52630.500040.40000.36840.3500When the data in Table4 are obtained, the normalization factor k can be obtained more quickly by substituting the data in Table 4 into formula (6) compared with formula (5). Therefore, the trust degree mA¯ after fusion can be calculated by formulas (4) and (6), and the results are shown in Table 5.Table 5
The assessment results ofA¯ after D–S fusion.
Arbitrary setA¯mA¯10.000020.008530.712340.2792In Table5, m3>m4>m2>m1 shows that the occurrence frequency level of Ci is most likely to belong to level 3, and the possibility of belonging to level 1 is the lowest. According to the same method, according to the same method, the trust degree of the loss level about Ci can be obtained.To sum up, combined with fuzzy theory this paper describes the privacy risk level of indicatorCi from the perspectives of risk occurrence frequency and risk loss and puts forward an effective fusion method of expert assessment results combined with D–S theory.


## 4.1. Definition of Privacy Risk Level of Mobile Services

Privacy risk is an abstract concept. In order to measure its level effectively, this paper preliminarily sets its risk level from two aspects: risk frequency and risk loss, as shown in Table2.Table 2
Definition of privacy risk level of mobile services.
Risk frequency levelMeaning1This risk rarely occurs and is extremely rare2This risk occurs occasionally and in rare cases3This risk is a common risk and often occurs4This risk is almost inevitableRisk loss levelMeaning1This risk will hardly pose a threat to the privacy and security of users2This risk will lead to the disclosure of users’ basic information, such as interests, hobbies, and location information3This risk will cause the disclosure of important information of users, such as identity information, contact information, and health information4This risk will lead to the disclosure of all users’ privacy information, including key information, and financial information


## 4.2. Risk Level Assessment Based on Fuzzy Theory and D–S Theory

Although Table2 defines the risk level from the perspectives of risk occurrence frequency and loss severity, due to the abstract characteristics of risk itself, it is still difficult for experts to clearly define its level in the actual assessment process.In addition, in the assessment process, due to the influence of human factors, different experts will have some differences on the definition of risk level, which brings difficulties to the assessment process. To solve the above two problems, this paper proposes to redescribe the risk level combined with fuzzy theory [32] and fuse the assessment results of different experts with D–S theory.D–S evidence theory is an uncertain reasoning method, which is often used in the field of information fusion. It can effectively deal with the problem of information conflict in the fusion process and can give a reasonable fusion result through calculation. In the fusion process, when there are multiple valid data, according to D–S theory, the first thing to do is to treat the collected data as valid evidence and then give each evidence with a trust degree. When each evidence has a trust degree, they can be fused through relevant formulas.Therefore, in order to effectively integrate the risk level assessment results of each expert, according to D–S theory, this paper regards the assessment results of each expert as effective evidence and assesses the privacy risk level of mobile services. The process is as follows.Firstly, in order to ensure the accuracy of the assessment results, based on the risk level shown in Table2, this paper introduces the concept of trust degree mA, which is used to describe the level of privacy risk, 0≤mA≤1. A is a fuzzy set, which represents any possible set of the risk indicator level, including 1,2,3,4,1,2,2,3,3,4, and ∑A≠∅mA=1. As shown in Table 3, the greater the value of mA, the greater the possibility that the risk indicator level belongs to set A.Table 3
Frequency level of risk indicatorCi based on fuzzy theory.
Risk frequency levelAssessment 1Assessment 2Assessment 3Arbitrary setAm1A1m2A2m3A310001-200020002-30.20.20.3300.103-40.80.70.74000Table3 contains the assessment data of three experts on risk indicator Ci, namely, assessment 1, assessment 2, and assessment 3. The three experts gave different trust degrees m1A1, m2A2, and m3A3 for the occurrence frequency level of risk indicator Ci. In order to obtain an accurate assessment result, the assessment data of three experts need to be fused according to D–S theory [33].(4)mA=m1⊕m2⊕⋯⊕mnA=1k∑A1∩​A2∩​…∩​An=Am1A1m2A2⋯mnAn.Here,k is the normalization factor, and it has two calculation methods. The purpose of the two calculation methods is the same, and the results are the same, but the calculation methods are different, as shown in formulas (5) and (6).(5)k=1−∑A1∩​A2∩​…∩​An=∅m1A1m2A2⋯mnAn,(6)k=∑A1∩​A2∩​…∩​An≠∅m1A1m2A2⋯mnAn.As shown in Table3, to fuse the assessment results of different experts, there are many possible sets to be analyzed, which bring difficulties to the calculation process. In order to simplify the calculation process, according to the basic idea of D–S approximate calculation, this paper proposes to use Bayes approximation method [34] to simplify set A in Table 3, and its calculation is shown in as follows:(7)mA¯=∑A¯⊆AmA∑A⊆ΘmA∗N.Here,A¯ is the simplified set of A, Θ represents the complete set, and N is the total number of factors contained in A. As described above, the data in Table 3 can be substituted into formula (7) for calculation, and the calculation process is as follows:(8)m1¯=m1+m1,2m1+m1,2∗2+m2+m2,3∗2+m3+m3,4∗2+m4,m2¯=m1,2+m2+m2,3m1+m1,2∗2+m2+m2,3∗2+m3+m3,4∗2+m4,m3¯=m2,3+m3+m3,4m1+m1,2∗2+m2+m2,3∗2+m3+m3,4∗2+m4,m4¯=m3,4+m4m1+m1,2∗2+m2+m2,3∗2+m3+m3,4∗2+m4.Finally, the simplified setA¯ can be obtained, as shown in Table 4.Table 4
Frequency level of risk indicatorCi after Bayes approximation.
Risk frequency levelAssessment 1Assessment 2Assessment 3Arbitrary setA¯m1A¯1m2A¯2m3A¯310.00000.00000.000020.10000.10530.150030.50000.52630.500040.40000.36840.3500When the data in Table4 are obtained, the normalization factor k can be obtained more quickly by substituting the data in Table 4 into formula (6) compared with formula (5). Therefore, the trust degree mA¯ after fusion can be calculated by formulas (4) and (6), and the results are shown in Table 5.Table 5
The assessment results ofA¯ after D–S fusion.
Arbitrary setA¯mA¯10.000020.008530.712340.2792In Table5, m3>m4>m2>m1 shows that the occurrence frequency level of Ci is most likely to belong to level 3, and the possibility of belonging to level 1 is the lowest. According to the same method, according to the same method, the trust degree of the loss level about Ci can be obtained.To sum up, combined with fuzzy theory this paper describes the privacy risk level of indicatorCi from the perspectives of risk occurrence frequency and risk loss and puts forward an effective fusion method of expert assessment results combined with D–S theory.


## 5. Comprehensive Assessment of Mobile Services Privacy Risk

### 5.1. Process of the Comprehensive Assessment

Through the previous research, this paper proposes an effective risk weight assessment method based on FAHP model and fuzzy consistency matrix and proposes an effective privacy risk level assessment method based on D–S theory. By combining the above two theories, this paper realizes the comprehensive assessment of mobile service privacy risk. The process is shown in Figure3.Figure 3
Comprehensive assessment of mobile service privacy risk.As shown in Figure3, the whole process is based on the attribute model of privacy risk. When the risk frequency fuzzy level fCi and risk loss fuzzy level lCi are obtained, combined with the weight assignment method proposed in Section 3, the whole mobile service can be assessed layer by layer from bottom to top.


#### 5.1.1. Assessment on Layer 3

First, calculate the privacy risk level of indicatorsCi in layer3, and its calculation formula is as follows.(9)levCi=fCi∗lCi.Here,fCi represents the risk frequency level of indicator Ci, and lCi represents the risk loss level of indicator Ci. According to the definition of risk matrix method, the privacy risk level levCi of indicator Ci can be obtained by multiplying fCi and lCi, as shown in Table 6.Table 6
Privacy risk classification matrix of mobile services.
Risk frequency levelLoss severity level123444/II8/III12/IV16/IV33/I6/II9/III12/IV22/I4/I6/II8/III11/I2/I3/I4/IIIn Table6, I,II,III,IV, respectively, represent the privacy risk level of mobile services. Level I indicates that the indicator or service is secure, and there is almost no privacy security problem; Level II indicates that the indicator or service is relatively secure, and there are certain privacy security problems, which may cause the disclosure of users’ basic information, such as location information and interest preferences; Level III indicates that the indicator or service is unsafe and there are major privacy security problems, which will cause the disclosure of important information of users, such as identity information, contact information, and health information; Level IV indicates that the indicator or service is extremely dangerous and has a very large privacy security problem, which will lead to the disclosure of users’ key privacy information, such as financial information and key information.


#### 5.1.2. Assessment on Layer 2

According to the risk attribute model shown in Figure2, when fCi and lCi of the risk indicator in layer 3 are calculated, combined with the assessment weight WCi,βj in Section 3.2, the privacy risk level levβj of risk categories can be calculated, as follows.(10)levβj=fβj∗lβj=∑i=111fCi∗WCi,βj∗∑i=111lCi∗WCi,βj.


#### 5.1.3. Assessment on Layer 1

According to the risk attribute model shown in Figure2, after calculating the fβj and lβj of risk categories in layer 2, combined with the assessment weight Wβj, the privacy risk level of the whole service can be calculated, as follows.(11)lev=∑j=13fβj∗Wβj∗∑j=13lβj∗Wβj.In formula (11), lev represents the privacy risk level of the entire mobile service.


### 5.2. Representation of the Assessment Result Based on Fuzzy Theory

In order to more objectively describe the privacy risk level of mobile services, combined with fuzzy theory, this paper redescribes the privacy risk level, as shown in Figure4.Figure 4
Risk level description based on fuzzy theory.In Figure4, the privacy risk level is represented as a triangular value [35], lev=levlower,levmax,levupper. Among them, levlower represents the lower limit of risk level about a factor or service, levupper represents the upper limit of risk level about a factor or service, and levmax represents the maximum trust risk level of a factor or service. As mentioned above, the following formulas can be obtained by changing formulas (9)–(11) based on fuzzy theory.(12)levupperCi=fupperCi∗lupperCi,levlowerCi=flowerCi∗llowerCi,levmaxCi=fmaxCi∗lmaxCi.In formula (12), fmaxCi is the maximum trust risk frequency level of indicator Ci, fupperCi is the maximum risk frequency level of indicator Ci, flowerCi is the minimum risk frequency level of indicator Ci. lmaxCi is the maximum trust risk loss level of indicator Ci, lupperCi is the maximum risk loss level of indicator Ci, and llowerCi is the minimum risk loss level of indicator Ci.(13)levupperβj=fupperβj∗lupperβj=∑i=111fmaxCi∗WCi,βj∗∑i=111lmaxCi∗WCi,βj,levlowerβj=flowerβj∗llowerβj=∑i=111flowerCi∗WCi,βj∗∑i=111llowerCi∗WCi,βj,levmaxβj=fmaxβj∗lmaxβj=∑i=111fmaxCi∗WCi,βj∗∑i=111lmaxCi∗WCi,βj.In formula (13), fmaxβj is the maximum trust risk frequency level of risk category βj, fupperβj is the maximum risk frequency level of risk category βj, and flowerβj is the minimum risk frequency level of risk category βj. lmaxβj is the maximum trust risk loss level of risk category βj, lupperβj is the maximum risk loss level of risk category βj, and llowerβj is the minimum risk loss level of risk category βj.(14)levupperCi=∑j=13fupperβj∗Wβj∗∑j=13lupperβj∗Wβj,levmaxCi=∑j=13fmaxβj∗Wβj∗∑j=13lmaxβj∗Wβj,levlowerCi=∑j=13flowerβj∗Wβj∗∑j=13llowerβj∗Wβj.Using the above triangular fuzzy value to represent the level of privacy risk, which is more objective than the method of “using only one fixed value to represent the risk level.”


## 5.1. Process of the Comprehensive Assessment

Through the previous research, this paper proposes an effective risk weight assessment method based on FAHP model and fuzzy consistency matrix and proposes an effective privacy risk level assessment method based on D–S theory. By combining the above two theories, this paper realizes the comprehensive assessment of mobile service privacy risk. The process is shown in Figure3.Figure 3
Comprehensive assessment of mobile service privacy risk.As shown in Figure3, the whole process is based on the attribute model of privacy risk. When the risk frequency fuzzy level fCi and risk loss fuzzy level lCi are obtained, combined with the weight assignment method proposed in Section 3, the whole mobile service can be assessed layer by layer from bottom to top.


### 5.1.1. Assessment on Layer 3

First, calculate the privacy risk level of indicatorsCi in layer3, and its calculation formula is as follows.(9)levCi=fCi∗lCi.Here,fCi represents the risk frequency level of indicator Ci, and lCi represents the risk loss level of indicator Ci. According to the definition of risk matrix method, the privacy risk level levCi of indicator Ci can be obtained by multiplying fCi and lCi, as shown in Table 6.Table 6
Privacy risk classification matrix of mobile services.
Risk frequency levelLoss severity level123444/II8/III12/IV16/IV33/I6/II9/III12/IV22/I4/I6/II8/III11/I2/I3/I4/IIIn Table6, I,II,III,IV, respectively, represent the privacy risk level of mobile services. Level I indicates that the indicator or service is secure, and there is almost no privacy security problem; Level II indicates that the indicator or service is relatively secure, and there are certain privacy security problems, which may cause the disclosure of users’ basic information, such as location information and interest preferences; Level III indicates that the indicator or service is unsafe and there are major privacy security problems, which will cause the disclosure of important information of users, such as identity information, contact information, and health information; Level IV indicates that the indicator or service is extremely dangerous and has a very large privacy security problem, which will lead to the disclosure of users’ key privacy information, such as financial information and key information.


### 5.1.2. Assessment on Layer 2

According to the risk attribute model shown in Figure2, when fCi and lCi of the risk indicator in layer 3 are calculated, combined with the assessment weight WCi,βj in Section 3.2, the privacy risk level levβj of risk categories can be calculated, as follows.(10)levβj=fβj∗lβj=∑i=111fCi∗WCi,βj∗∑i=111lCi∗WCi,βj.


### 5.1.3. Assessment on Layer 1

According to the risk attribute model shown in Figure2, after calculating the fβj and lβj of risk categories in layer 2, combined with the assessment weight Wβj, the privacy risk level of the whole service can be calculated, as follows.(11)lev=∑j=13fβj∗Wβj∗∑j=13lβj∗Wβj.In formula (11), lev represents the privacy risk level of the entire mobile service.


## 5.1.1. Assessment on Layer 3

First, calculate the privacy risk level of indicatorsCi in layer3, and its calculation formula is as follows.(9)levCi=fCi∗lCi.Here,fCi represents the risk frequency level of indicator Ci, and lCi represents the risk loss level of indicator Ci. According to the definition of risk matrix method, the privacy risk level levCi of indicator Ci can be obtained by multiplying fCi and lCi, as shown in Table 6.Table 6
Privacy risk classification matrix of mobile services.
Risk frequency levelLoss severity level123444/II8/III12/IV16/IV33/I6/II9/III12/IV22/I4/I6/II8/III11/I2/I3/I4/IIIn Table6, I,II,III,IV, respectively, represent the privacy risk level of mobile services. Level I indicates that the indicator or service is secure, and there is almost no privacy security problem; Level II indicates that the indicator or service is relatively secure, and there are certain privacy security problems, which may cause the disclosure of users’ basic information, such as location information and interest preferences; Level III indicates that the indicator or service is unsafe and there are major privacy security problems, which will cause the disclosure of important information of users, such as identity information, contact information, and health information; Level IV indicates that the indicator or service is extremely dangerous and has a very large privacy security problem, which will lead to the disclosure of users’ key privacy information, such as financial information and key information.


## 5.1.2. Assessment on Layer 2

According to the risk attribute model shown in Figure2, when fCi and lCi of the risk indicator in layer 3 are calculated, combined with the assessment weight WCi,βj in Section 3.2, the privacy risk level levβj of risk categories can be calculated, as follows.(10)levβj=fβj∗lβj=∑i=111fCi∗WCi,βj∗∑i=111lCi∗WCi,βj.


## 5.1.3. Assessment on Layer 1

According to the risk attribute model shown in Figure2, after calculating the fβj and lβj of risk categories in layer 2, combined with the assessment weight Wβj, the privacy risk level of the whole service can be calculated, as follows.(11)lev=∑j=13fβj∗Wβj∗∑j=13lβj∗Wβj.In formula (11), lev represents the privacy risk level of the entire mobile service.


## 5.2. Representation of the Assessment Result Based on Fuzzy Theory

In order to more objectively describe the privacy risk level of mobile services, combined with fuzzy theory, this paper redescribes the privacy risk level, as shown in Figure4.Figure 4
Risk level description based on fuzzy theory.In Figure4, the privacy risk level is represented as a triangular value [35], lev=levlower,levmax,levupper. Among them, levlower represents the lower limit of risk level about a factor or service, levupper represents the upper limit of risk level about a factor or service, and levmax represents the maximum trust risk level of a factor or service. As mentioned above, the following formulas can be obtained by changing formulas (9)–(11) based on fuzzy theory.(12)levupperCi=fupperCi∗lupperCi,levlowerCi=flowerCi∗llowerCi,levmaxCi=fmaxCi∗lmaxCi.In formula (12), fmaxCi is the maximum trust risk frequency level of indicator Ci, fupperCi is the maximum risk frequency level of indicator Ci, flowerCi is the minimum risk frequency level of indicator Ci. lmaxCi is the maximum trust risk loss level of indicator Ci, lupperCi is the maximum risk loss level of indicator Ci, and llowerCi is the minimum risk loss level of indicator Ci.(13)levupperβj=fupperβj∗lupperβj=∑i=111fmaxCi∗WCi,βj∗∑i=111lmaxCi∗WCi,βj,levlowerβj=flowerβj∗llowerβj=∑i=111flowerCi∗WCi,βj∗∑i=111llowerCi∗WCi,βj,levmaxβj=fmaxβj∗lmaxβj=∑i=111fmaxCi∗WCi,βj∗∑i=111lmaxCi∗WCi,βj.In formula (13), fmaxβj is the maximum trust risk frequency level of risk category βj, fupperβj is the maximum risk frequency level of risk category βj, and flowerβj is the minimum risk frequency level of risk category βj. lmaxβj is the maximum trust risk loss level of risk category βj, lupperβj is the maximum risk loss level of risk category βj, and llowerβj is the minimum risk loss level of risk category βj.(14)levupperCi=∑j=13fupperβj∗Wβj∗∑j=13lupperβj∗Wβj,levmaxCi=∑j=13fmaxβj∗Wβj∗∑j=13lmaxβj∗Wβj,levlowerCi=∑j=13flowerβj∗Wβj∗∑j=13llowerβj∗Wβj.Using the above triangular fuzzy value to represent the level of privacy risk, which is more objective than the method of “using only one fixed value to represent the risk level.”


## 6. Case Analysis

In order to verify the feasibility of the proposed method, this paper assesses two mobile service providers, respectively. The first is a mobile application service provider focusing on takeout and group purchase, and the second is a mobile application service provider focusing on financial investment and wealth management. Through investigation, around the risk attribute model in Figure2, this paper summarizes the privacy risk characteristics of the two mobile services, as shown in Table 7.Table 7
Privacy risk characteristics of the two services.
Company ACompany BInternal employee threatsThere have been many disciplinary violations by internal employeesThe internal employees of the service provider only master the basic information of users, and there are no reports of discipline violations by employeesSoftware defectIt can pass the detection of relevant security detection tools without obvious technical loopholesIt can pass the detection of relevant security detection tools without obvious technical loopholesMobile advertising attackContains a large number of personalized recommendation advertisementsContains a small amount of financial recommendation advertisingPlatform operation riskThe platform has been in stable operation for 10 years, and the service shutdown will not pose a serious privacy threat to usersThe platform has been operating stably for more than 20 years, and the service shutdown will pose a serious threat to user privacyAuthentication and access vulnerabilitiesNo real name authentication is required to use this service. You can directly authorize login with mobile phone verification code or third-party application.Using this service requires real name authentication and bank card binding authentication, and the service has strict access controlEncrypted transmission vulnerabilityThe user’s privacy information is encrypted and anonymized, and the user’s contact information, address, and other information will be exposed during the transactionThe user information is encrypted, and the user information will not be exposed during the transactionData lossThere are reports of user data loss. In the process of transaction, user data may be lost.There are special transaction records and notary institutions, and there is almost no possibility of user data loss using this serviceTerminal operating system vulnerabilityThe application has low requirements for terminal configuration, and the terminal hardware used in the test has no obvious vulnerabilitiesThe application has high requirements for terminal configuration, and the terminal hardware used in the test has no obvious vulnerabilitiesAuthority operation riskIt includes access to location, phone, camera, address book, storage and motion dataIncluding access to location, phone, camera, and storageThird party application attackThere is information association and authorization cooperation with third-party applicationsThere is no association with third-party applicationsKey management riskThere is a simple payment password, which can be modified with the mobile phone verification codeThe password security level is high, and there are strict key management measures


### 6.1. Analysis Process

#### 6.1.1. Risk Assessment Weight Calculation

Firstly, based on the model in Figure2, using the method proposed in Section 3, this paper establishes the relevant fuzzy consistency matrix layer by layer and calculates the correlation matrix according to formula (3) and obtains the assessment weight of each indicator and risk category, as shown in Table 8.Table 8
The assessment weight of risk indicators and risk classes.
β1β2β3Wβj0.3770.2800.343WCi,β1WCi,β2WCi,β3C10.1010.0800.071C20.1140.1030.086C30.1120.0890.100C40.1020.0750.061C50.1050.1110.092C60.0990.1120.091C70.0910.1080.078C80.0470.0750.101C90.0720.0740.108C100.0870.0980.104C110.0700.0750.106


#### 6.1.2. Risk Level Assessment

After calculating the assessment weight of each risk indicator and risk category, this paper convened three experts in the field to assess the risk level of each risk indicator according to the method shown in Section4.2. The risk level assessment distribution results of each risk indicator of Company 1 are shown in Tables 9 and 10.Table 9
Assessment distribution results of risk indicator frequency level of Company1.
Am1A1m2A2m3A3m1A1m2A2m3A3m1A1m2A2m3A3C1C2C310000.10.100001-20.30.30.30.60.50.600020.20.10.10.10.20.200.10.12-30.50.60.60.20.20.20.10.30.230000000.10.10.13-40000000.60.40.540000000.20.10.1C4C5C610.80.80.80000.30.30.41-20.20.10.10.10.10.10.30.30.3200.10.10.10.10.10.30.20.22-30S000.60.50.40.10.20.130000.200.20003-400000.30.20004000000000C7C8C910.10.10.10.10.10.10001-20.20.20.20.50.60.30.50.30.220.30.20.30000.1002-30.40.40.30.30.20.40.40.50.6300.10.1000.100.10.13-40000.10.10.100.10.14000000000C10C1110000001-20.30.30.20.40.10.2200000.10.12-30.40.50.80.40.50.630.1000.1003-40.20.200.10.30.14000000Table 10
Assessment distribution results of risk indicator loss level of Company1.
m1A1m2A2m3A3m1A1m2A2m3A3m1A1m2A2m3A3C1C2C310000000.10.20.11-20000.40.20.30.80.80.82000.10.10.20.10.100.12-30.80.90.70.50.40.5000300.10.100.10.10003-40.200.100.100004000000000C4C5C610000000.10.30.21-20000.20.30.10.70.60.520000.10.10.10.1002-30.20.20.40.60.50.50.10.10.230.20.20.2000.20003-40.50.50.30.10.10.1000.140.10.10.1000000C7C8C910.30.10.10.30.100001-20.50.60.20.50.20.4000.1200.10.300.10.10002-30.20.20.30.20.50.50.60.70.53000.100.100.10.103-40000000.20.20.440000000.100C10C1110000001-20.40.50.60002000.10002-30.50.50.30.20.20.230000003-40.1000.40.40.340000.40.40.5According to the method proposed in Section4 of this paper, the data of Tables 9 and 10 are simplified by Bayes approximation, and then the simplified results are fused in combination with D–S theory. The fused results are shown in Tables 11 and 12.Table 11
Risk indicator frequency level of Company 1 after fusion.
A¯mA¯C1C2C3C4C5C610.02240.23550.00000.99020.00120.459920.82850.75700.01570.00980.39580.536530.14910.00750.67020.00000.60310.003640.00000.00000.31410.00000.00000.0000C7C8C9C10C1110.03950.24380.03360.01860.009420.84330.65020.71590.57730.592230.11710.10450.25060.40410.394840.00000.00150.00000.00000.0035Table 12
Risk indicator loss level of Company1 after fusion.
A¯mA¯C1C2C3C4C5C610.00000.02600.55560.00000.00660.531620.39020.77920.44440.01800.62310.465230.60980.19480.00000.82000.36920.003240.00000.00000.00000.16200.00110.0000C7C8C9C10C1110.24420.13410.00000.10810.000020.73260.78210.23200.81080.011430.02330.08380.74590.08110.257140.00000.00000.02210.00000.7314


#### 6.1.3. Comparative Analysis of Assessment Results Layer by Layer

According to the method in this paper, through substituting the above results into formulas (12)–(14), the mobile service privacy risk assessment results of Company 1 can be calculated. Similarly, this paper also assesses the mobile service of Company 2. Finally, this paper compares the privacy risk assessment results of the two companies layer by layer.(1) Risk Level Comparison in the 3rd Layer. According to the result expression method in Section 5.2, the risk level of each indicator in layer 3 is expressed as levCi=levlowerCi,levmaxCi,levupperCi, and the fuzzy risk level of each indicator is shown in Figures 5 and 6.Figure 5
Privacy risk level of each indicator of Company 1’s mobile service.Figure 6
Privacy risk level of each indicator of Company2’s mobile service.Referring to the classification definition in Table6, levupperCi≥8 indicates that the upper risk level limit of Company 1’s all indicators is above level 8, which means that these indicators are all IIIrd level risk indicators.Among them,levmaxC11=8, indicating that indicator C11 is a more dangerous privacy risk factor in the process of use, which poses the greatest threat to the privacy security of Company1’s mobile services, and it is also a risk factor that users need to pay attention to most in risk management. Except for indicator C11, other risk indicators levmaxCi<8, which means they belong to II level risk indicators, indicating that these factors are unlikely to cause privacy risk in the long-term use process.In addition,levmaxC6=2 indicates that this service has relatively high security in encrypted transmission.In Figure6, only levupperC3<8, indicating that only the maximum risk level of C3 is lower than level III, which means that the services of Company2 have no major privacy risk threat in terms of “mobile advertising attack.”levmaxC9=9 and levmaxC11=8, indicating that these two indicators are dangerous privacy risk factors in the use of company 2’s service, and users need to pay more attention to these two risk factors in the use process. Combining the meanings of C9 and C11, it shows that users need to strengthen the security in “permission operation” and “key management” when using this financial service.In addition,levmaxC3=levmaxC10=2, indicating that this service has high security in terms of “mobile advertising attack” and “third-party application attack.”(2) Risk Level Comparison in the 2nd Layer. Similarly, if the risk level of each risk class in layer 2 is expressed as levβj=levlowerβj,levmaxβj,levupperβj, the fuzzy risk level of each risk class is shown in Figure 7.Figure 7
Privacy risk levels of each risk category of the two companies.As shown in Figure7, there is little difference in the privacy risk levels of the two mobile services in different risk categories. levmaxβj<5 means that all risk categories of the two companies belong to II level risk category, which means that the mobile services of the two companies are in a relatively safe state in most cases. In comparison, the lowest level of Company 2’s all risk categories, levmaxβj>2, indicating that the privacy risk of Company 2 is relatively high.(3) Risk Level Comparison in the 1st Layer. Similarly, if the risk level of the entire service is expressed as lev=levlower,levmax,levupper, the fuzzy risk level of the entire mobile services of the two companies is shown in Table 13.Table 13
Privacy risk level comparison of the entire mobile services between the two companies.
Company1Company2levlowerlevmaxlevupperlevlowerlevmaxlevupper1.4694.70610.4762.1294.8299.609Frequency level of each risk categoryFrequency level of each risk categoryβ1β2β3β1β2β3flower1.1121.0891.100flower1.0721.0741.108fmax2.1152.1252.132fmax1.7361.7461.770fupper3.2473.1633.247fupper2.6622.6722.662Loss level of each risk classLoss level of each risk classβ1β2β3β1β2β3llower1.3441.3031.347llower1.9881.9331.957lmax2.2032.1762.262lmax2.7712.7322.764lupper3.2373.2463.268lupper3.5863.6013.630As shown in Table13, the subordinate range of Company 1’s privacy risk level is 1.469,10.476, while the subordinate range of Company 2’s privacy risk level is 2.129,9.609. Among them, the subordinate range of Company 1’s privacy risk level is relatively large, indicating that the fluctuation range of Company 1’s privacy risk level is relatively large. However, on the whole, the two services’ privacy risk level levmax<5, indicating that the two services are at a relatively safe risk level in the long-term use process.From the above case analysis, it can be seen that the method proposed in this paper is effective and feasible and can provide users with detailed and comprehensive risk assessment results. Based on these assessment results, users can conduct risk analysis from different angles according to their own needs, so as to reasonably manage their own privacy information.


### 6.2. Method Comparison

In order to illustrate the effectiveness and characteristics of the methods proposed in this paper, we carry out the following discussion and comparison.The methods proposed in this paper are mainly used to assess the privacy security of mobile services. Compared with trust computing, they are also a method for security assessment and analysis. During the assessment, for the purpose of security assessment, the two methods all need to sort out the measurement indicators affecting system security and their related attributes and then adopt corresponding methods to assess these indicators. These corresponding methods include AHP [36–38], information entropy [39–41], and trust chain [42–44]. In these methods, trust chain is a method which is mainly used to detect whether the system is attacked or damaged. This method can effectively protect the security of the system. However, this method mainly assesses the vulnerabilities in software and hardware and does not assess other factors such as management risk, man-made operation risk, and application environment risk. In addition, using this method requires the establishment of a special trust chain, and the cost of assessment is high.Therefore, as a risk assessment method, in order to illustrate the characteristics of the method proposed in this paper, it should be compared with other common risk assessment methods, such as risk assessment method based on AHP [45–47], risk assessment method based on risk matrix [48, 49], and risk assessment method based on information entropy [26, 49–52]. They are all mature risk assessment methods, which have been widely used and can provide users with effective risk assessment results.This paper compares the proposed method with the above methods around the following aspects.(i)
Cost: it refers to the cost required for assessment, including the difficulty of expert assessment, task quantity, and computational complexity. The higher the cost, the greater the calculation cost.(ii)
Objectivity: it refers to whether the assessment results can objectively reflect the privacy risk of mobile services. The higher the objectivity, the more accurate the assessment results can describe the privacy risk of the service.(iii)
Completeness: it refers to the comprehensiveness of the privacy risk assessment results. The more privacy risk assessment results this method can provide to users, the more comprehensive the method is.(iv)
Decision support: it refers to whether the assessment results can effectively help users manage privacy information reasonably. The higher the reference value of the assessment results, the higher the decision support.(v)
Difficulty of data acquisition: it refers to the difficulty of obtaining input data.(vi)
Scalability: it refers to the scalability of this method when dealing with new problems.(vii)
Time complexity and space complexity: it refers to the time complexity and space complexity required by this method.As shown in Table14, this paper first compares the methods around the four aspects of cost, objectivity, completeness, and decision support.Table 14
Comparison between this paper’s method and other methods in different aspects.
MethodThe cost required for assessmentMethods to improve objectivityAHPTimes of establishing judgment matrix ≫ 4Pairwise comparison method of weightThis paperTimes of establishing judgment matrix = 4; need to assess the risk level of 11 risk indicatorsPairwise comparison method of weight;Fusion method of expert results based on D–S;Risk level description based on fuzzy theory.Risk matrixNeed to assess the risk level of 11 risk indicatorsOnly uses a fixed value to describe the risk levelInformation entropyNeed to measure the uncertainty of 11 risk indicators and calculate their entropy weightEntropy weight methodComprehensiveness of the assessmentAvailable assessment resultsAHPAnalysis with 3 categories and 3 layersRisk weightThis paperRisk frequency and risk loss analysis from 3 categories and 3 layersRisk weight, risk frequency level, and risk loss levelRisk matrixRisk frequency and risk loss analysisRisk frequency level and risk loss levelInformation entropyUncertainty analysis and entropy weight analysis of riskRisk weight and risk uncertainty


#### 6.2.1. Cost Comparison

(1)
AHP: the judgment matrix established in the assessment process of this method is not completely consistent. In order to meet the requirements of consistency, the judgment matrix usually needs to be adjusted many times.(2)
This paper’s method: like AHP, this method needs to establish a special judgment matrix in the assessment process. But when establishing the judgment matrix, this paper proposes to use fuzzy consistency matrix to ensure the consistency of assessment results, which can effectively reduce the difficulty of expert assessment.(3)
Risk matrix: it is only necessary to make a simple level assessment on each risk factor from risk occurrence frequency and risk loss, and its calculation process is very simple.(4)
Information entropy: this method needs to establish a special model and calculate it in combination with the information entropy formula, but it does not need to calculate multiple times like the FAHP method.


#### 6.2.2. Objectivity Comparison

(1)
AHP: the method of pairwise comparison is adopted in the assessment process, which reduces the impact of human subjective preference on the assessment results. Its assessment results are relatively objective.(2)
This paper method: in the process of weight assessment, this method inherits the advantages of AHP pairwise comparison method. In the subsequent risk level assessment process, this method combines D–S theory to solve the conflict between experts and combines fuzzy theory to describe the level of privacy risk objectively.(3)
Risk matrix: this method only uses a fixed value to describe the risk level, which is too subjective to reflect the real risk level.(4)
Information entropy: this method effectively describes the risk from the perspective of uncertainty, but it cannot effectively solve the problem of “conflict information” in the assessment process. The assessment results are relatively objective.


#### 6.2.3. Comprehensiveness Comparison

(1)
AHP: this method can provide users with multidimensional and multilevel risk assessment results based on the risk attribute model(2)
This paper’s method: this method can also provide users with multidimensional and multilevel risk assessment results and can provide users with the risk level assessment results of risk frequency and risk loss(3)
Risk matrix: this method can only assess each risk factor independently(4)
Information entropy: this method establishes a special risk assessment system, which can also provide users with multilevel assessment results


#### 6.2.4. Comparison on the Degree of Decision Support

(1)
AHP: this method can only calculate the impact weight of each risk factor relative to privacy security, but it lacks the measurement of the level of risk.(2)
This paper’s method: it assesses the privacy risk from two aspects—risk frequency and risk loss—and defines the fuzzy triangle number of privacy risk level, including the maximum trust risk level, the maximum risk level, and the minimum risk level. Users can clearly understand each risk and the impact of different risk categories.(3)
Risk matrix: this method can provide users with the assessment results of risk occurrence frequency and risk loss and help users understand the differences of various factors from the above two aspects.(4)
Information entropy: this method describes the level of risk through the degree of uncertainty, which can provide users with the ranking of relevant risk factors, but it does not describe risk frequency and risk loss in detail.


#### 6.2.5. Comparison on Difficulty of Data Acquisition

(1)
AHP: it is necessary to obtain the relative weight of each risk indicator and the relative weight of each risk category(2)
This paper’s method: it is necessary to obtain the relative weight of each risk indicator, the relative weight of each risk category, the risk frequency level and risk loss level of each indicator(3)
Risk matrix: it is necessary to obtain the risk frequency level and risk loss level of each indicator(4)
Information entropy: it needs to sort out the uncertain factors affecting each risk indicator or risk category


#### 6.2.6. Comparison on Scalability

Taking the service evaluated in this paper as a reference. When it is necessary to carry out more security assessment about this service from more aspects, the scalability comparison of each method is as follows:(1)
AHP: using this method, new risk classes and risk indicators need to be added to the established risk attribute model, which will not affect the risk assessment method.(2)
This paper’s method: like the AHP method, only the risk attribute model needs to be extended(3)
Risk matrix: using this method, although the corresponding risk indicators can be added, it cannot meet the new needs of security assessment(4)
Information entropy: using this method, with the increase of risk indicators, the uncertainty of the whole service will be greatly affected, and its assessment model will also be greatly affected and even need to be reestablishedThe above discussion shows that when there are new risk problems or new safety assessment requirements, AHP method and this paper method have good expansibility. In contrast, the method-based information entropy and the method based risk matrix have poor scalability.To sum up, useHigh=3,Medium=2,Low=1 to describe the characteristics of the above methods, respectively, and the comparison results is shown in Figure 8.Figure 8
Comparison of characteristics between this method and other methods.In Figure8, the value 3 indicates that the method has a higher score than other methods in some respects. The value 2 indicates that the method has a moderate score in some respects, and the value 1 indicates that the method has the lowest score in some respects.


#### 6.2.7. Comparison on Time Complexity and Space Complexity

In addition to the comparison of the above 6 aspects, this paper also carries out the comparative analysis of time complexity and space complexity. Suppose the privacy security of a mobile service is affected byn risk indicators. Taking this mobile service as the assessment object, the time complexity and space complexity of each method are shown in Table 15.(1)
This paper: the method proposed in this paper needsnn−1/2 weight judgments and 2n risk level assessments. The total spaces for storing risk frequency level, risk loss level and risk level are 3 n, and the space for storing risk assessment weight is n.(2)
AHP: using the AHP method, in the best case, onlynn−1/2 weight judgments are required. However, in order to pass the consistency test, it is almost necessary to expand nn−1∗logn/2 weight judgments. The required storage space is the same as the method in this paper.(3)
Risk matrix: both in the average and best cases, we only need to setn parameters and conduct 1 assessment for the risk frequency level and risk loss level of n indicators. When there is a conflict between expert assessments, it is necessary to reevaluate the risk level continuously. At this time, the time complexity is logn. In terms of spatial complexity, 3 n spaces are required to store risk frequency level, risk loss level, and risk level.(4)
Information entropy: using this method requiresn assessments for the uncertainty of n indicators. n spaces are required to store the uncertainty level of each indicator.Table 15
Time complexity and space complexity of each method.
MethodT(n)S(n)Average caseBest caseWorst caseMethod of this paperOn2On2On2OnMethod based on AHPOn2lognOn2On2lognOnMethod-based risk matrixO1O1OlognOnMethod-based information entropyOnOnOnOnIn general, this paper introduces FAHP and D–S theory into mobile service privacy risk assessment and proposes a comprehensive assessment method combining risk weight and risk level. This method proposed in this paper inherits the advantages of AHP method and has good scalability. Based on the AHP hierarchical model, this paper uses the fuzzy consistency matrix to solve the consistency problem of judgment matrix in AHP and improves the efficiency of the method. Through comprehensive assessment of risk weight and risk level, the proposed method improves the objectivity, the degree of decision support, and comprehensiveness about the assessment results. However, in order to improve the comprehensiveness of the assessment results, the method proposed in this paper will also increase the difficulty of obtaining the input data, and its time complexity and space complexity will increase accordingly.


## 6.1. Analysis Process

### 6.1.1. Risk Assessment Weight Calculation

Firstly, based on the model in Figure2, using the method proposed in Section 3, this paper establishes the relevant fuzzy consistency matrix layer by layer and calculates the correlation matrix according to formula (3) and obtains the assessment weight of each indicator and risk category, as shown in Table 8.Table 8
The assessment weight of risk indicators and risk classes.
β1β2β3Wβj0.3770.2800.343WCi,β1WCi,β2WCi,β3C10.1010.0800.071C20.1140.1030.086C30.1120.0890.100C40.1020.0750.061C50.1050.1110.092C60.0990.1120.091C70.0910.1080.078C80.0470.0750.101C90.0720.0740.108C100.0870.0980.104C110.0700.0750.106


### 6.1.2. Risk Level Assessment

After calculating the assessment weight of each risk indicator and risk category, this paper convened three experts in the field to assess the risk level of each risk indicator according to the method shown in Section4.2. The risk level assessment distribution results of each risk indicator of Company 1 are shown in Tables 9 and 10.Table 9
Assessment distribution results of risk indicator frequency level of Company1.
Am1A1m2A2m3A3m1A1m2A2m3A3m1A1m2A2m3A3C1C2C310000.10.100001-20.30.30.30.60.50.600020.20.10.10.10.20.200.10.12-30.50.60.60.20.20.20.10.30.230000000.10.10.13-40000000.60.40.540000000.20.10.1C4C5C610.80.80.80000.30.30.41-20.20.10.10.10.10.10.30.30.3200.10.10.10.10.10.30.20.22-30S000.60.50.40.10.20.130000.200.20003-400000.30.20004000000000C7C8C910.10.10.10.10.10.10001-20.20.20.20.50.60.30.50.30.220.30.20.30000.1002-30.40.40.30.30.20.40.40.50.6300.10.1000.100.10.13-40000.10.10.100.10.14000000000C10C1110000001-20.30.30.20.40.10.2200000.10.12-30.40.50.80.40.50.630.1000.1003-40.20.200.10.30.14000000Table 10
Assessment distribution results of risk indicator loss level of Company1.
m1A1m2A2m3A3m1A1m2A2m3A3m1A1m2A2m3A3C1C2C310000000.10.20.11-20000.40.20.30.80.80.82000.10.10.20.10.100.12-30.80.90.70.50.40.5000300.10.100.10.10003-40.200.100.100004000000000C4C5C610000000.10.30.21-20000.20.30.10.70.60.520000.10.10.10.1002-30.20.20.40.60.50.50.10.10.230.20.20.2000.20003-40.50.50.30.10.10.1000.140.10.10.1000000C7C8C910.30.10.10.30.100001-20.50.60.20.50.20.4000.1200.10.300.10.10002-30.20.20.30.20.50.50.60.70.53000.100.100.10.103-40000000.20.20.440000000.100C10C1110000001-20.40.50.60002000.10002-30.50.50.30.20.20.230000003-40.1000.40.40.340000.40.40.5According to the method proposed in Section4 of this paper, the data of Tables 9 and 10 are simplified by Bayes approximation, and then the simplified results are fused in combination with D–S theory. The fused results are shown in Tables 11 and 12.Table 11
Risk indicator frequency level of Company 1 after fusion.
A¯mA¯C1C2C3C4C5C610.02240.23550.00000.99020.00120.459920.82850.75700.01570.00980.39580.536530.14910.00750.67020.00000.60310.003640.00000.00000.31410.00000.00000.0000C7C8C9C10C1110.03950.24380.03360.01860.009420.84330.65020.71590.57730.592230.11710.10450.25060.40410.394840.00000.00150.00000.00000.0035Table 12
Risk indicator loss level of Company1 after fusion.
A¯mA¯C1C2C3C4C5C610.00000.02600.55560.00000.00660.531620.39020.77920.44440.01800.62310.465230.60980.19480.00000.82000.36920.003240.00000.00000.00000.16200.00110.0000C7C8C9C10C1110.24420.13410.00000.10810.000020.73260.78210.23200.81080.011430.02330.08380.74590.08110.257140.00000.00000.02210.00000.7314


### 6.1.3. Comparative Analysis of Assessment Results Layer by Layer

According to the method in this paper, through substituting the above results into formulas (12)–(14), the mobile service privacy risk assessment results of Company 1 can be calculated. Similarly, this paper also assesses the mobile service of Company 2. Finally, this paper compares the privacy risk assessment results of the two companies layer by layer.(1) Risk Level Comparison in the 3rd Layer. According to the result expression method in Section 5.2, the risk level of each indicator in layer 3 is expressed as levCi=levlowerCi,levmaxCi,levupperCi, and the fuzzy risk level of each indicator is shown in Figures 5 and 6.Figure 5
Privacy risk level of each indicator of Company 1’s mobile service.Figure 6
Privacy risk level of each indicator of Company2’s mobile service.Referring to the classification definition in Table6, levupperCi≥8 indicates that the upper risk level limit of Company 1’s all indicators is above level 8, which means that these indicators are all IIIrd level risk indicators.Among them,levmaxC11=8, indicating that indicator C11 is a more dangerous privacy risk factor in the process of use, which poses the greatest threat to the privacy security of Company1’s mobile services, and it is also a risk factor that users need to pay attention to most in risk management. Except for indicator C11, other risk indicators levmaxCi<8, which means they belong to II level risk indicators, indicating that these factors are unlikely to cause privacy risk in the long-term use process.In addition,levmaxC6=2 indicates that this service has relatively high security in encrypted transmission.In Figure6, only levupperC3<8, indicating that only the maximum risk level of C3 is lower than level III, which means that the services of Company2 have no major privacy risk threat in terms of “mobile advertising attack.”levmaxC9=9 and levmaxC11=8, indicating that these two indicators are dangerous privacy risk factors in the use of company 2’s service, and users need to pay more attention to these two risk factors in the use process. Combining the meanings of C9 and C11, it shows that users need to strengthen the security in “permission operation” and “key management” when using this financial service.In addition,levmaxC3=levmaxC10=2, indicating that this service has high security in terms of “mobile advertising attack” and “third-party application attack.”(2) Risk Level Comparison in the 2nd Layer. Similarly, if the risk level of each risk class in layer 2 is expressed as levβj=levlowerβj,levmaxβj,levupperβj, the fuzzy risk level of each risk class is shown in Figure 7.Figure 7
Privacy risk levels of each risk category of the two companies.As shown in Figure7, there is little difference in the privacy risk levels of the two mobile services in different risk categories. levmaxβj<5 means that all risk categories of the two companies belong to II level risk category, which means that the mobile services of the two companies are in a relatively safe state in most cases. In comparison, the lowest level of Company 2’s all risk categories, levmaxβj>2, indicating that the privacy risk of Company 2 is relatively high.(3) Risk Level Comparison in the 1st Layer. Similarly, if the risk level of the entire service is expressed as lev=levlower,levmax,levupper, the fuzzy risk level of the entire mobile services of the two companies is shown in Table 13.Table 13
Privacy risk level comparison of the entire mobile services between the two companies.
Company1Company2levlowerlevmaxlevupperlevlowerlevmaxlevupper1.4694.70610.4762.1294.8299.609Frequency level of each risk categoryFrequency level of each risk categoryβ1β2β3β1β2β3flower1.1121.0891.100flower1.0721.0741.108fmax2.1152.1252.132fmax1.7361.7461.770fupper3.2473.1633.247fupper2.6622.6722.662Loss level of each risk classLoss level of each risk classβ1β2β3β1β2β3llower1.3441.3031.347llower1.9881.9331.957lmax2.2032.1762.262lmax2.7712.7322.764lupper3.2373.2463.268lupper3.5863.6013.630As shown in Table13, the subordinate range of Company 1’s privacy risk level is 1.469,10.476, while the subordinate range of Company 2’s privacy risk level is 2.129,9.609. Among them, the subordinate range of Company 1’s privacy risk level is relatively large, indicating that the fluctuation range of Company 1’s privacy risk level is relatively large. However, on the whole, the two services’ privacy risk level levmax<5, indicating that the two services are at a relatively safe risk level in the long-term use process.From the above case analysis, it can be seen that the method proposed in this paper is effective and feasible and can provide users with detailed and comprehensive risk assessment results. Based on these assessment results, users can conduct risk analysis from different angles according to their own needs, so as to reasonably manage their own privacy information.


## 6.1.1. Risk Assessment Weight Calculation

Firstly, based on the model in Figure2, using the method proposed in Section 3, this paper establishes the relevant fuzzy consistency matrix layer by layer and calculates the correlation matrix according to formula (3) and obtains the assessment weight of each indicator and risk category, as shown in Table 8.Table 8
The assessment weight of risk indicators and risk classes.
β1β2β3Wβj0.3770.2800.343WCi,β1WCi,β2WCi,β3C10.1010.0800.071C20.1140.1030.086C30.1120.0890.100C40.1020.0750.061C50.1050.1110.092C60.0990.1120.091C70.0910.1080.078C80.0470.0750.101C90.0720.0740.108C100.0870.0980.104C110.0700.0750.106


## 6.1.2. Risk Level Assessment

After calculating the assessment weight of each risk indicator and risk category, this paper convened three experts in the field to assess the risk level of each risk indicator according to the method shown in Section4.2. The risk level assessment distribution results of each risk indicator of Company 1 are shown in Tables 9 and 10.Table 9
Assessment distribution results of risk indicator frequency level of Company1.
Am1A1m2A2m3A3m1A1m2A2m3A3m1A1m2A2m3A3C1C2C310000.10.100001-20.30.30.30.60.50.600020.20.10.10.10.20.200.10.12-30.50.60.60.20.20.20.10.30.230000000.10.10.13-40000000.60.40.540000000.20.10.1C4C5C610.80.80.80000.30.30.41-20.20.10.10.10.10.10.30.30.3200.10.10.10.10.10.30.20.22-30S000.60.50.40.10.20.130000.200.20003-400000.30.20004000000000C7C8C910.10.10.10.10.10.10001-20.20.20.20.50.60.30.50.30.220.30.20.30000.1002-30.40.40.30.30.20.40.40.50.6300.10.1000.100.10.13-40000.10.10.100.10.14000000000C10C1110000001-20.30.30.20.40.10.2200000.10.12-30.40.50.80.40.50.630.1000.1003-40.20.200.10.30.14000000Table 10
Assessment distribution results of risk indicator loss level of Company1.
m1A1m2A2m3A3m1A1m2A2m3A3m1A1m2A2m3A3C1C2C310000000.10.20.11-20000.40.20.30.80.80.82000.10.10.20.10.100.12-30.80.90.70.50.40.5000300.10.100.10.10003-40.200.100.100004000000000C4C5C610000000.10.30.21-20000.20.30.10.70.60.520000.10.10.10.1002-30.20.20.40.60.50.50.10.10.230.20.20.2000.20003-40.50.50.30.10.10.1000.140.10.10.1000000C7C8C910.30.10.10.30.100001-20.50.60.20.50.20.4000.1200.10.300.10.10002-30.20.20.30.20.50.50.60.70.53000.100.100.10.103-40000000.20.20.440000000.100C10C1110000001-20.40.50.60002000.10002-30.50.50.30.20.20.230000003-40.1000.40.40.340000.40.40.5According to the method proposed in Section4 of this paper, the data of Tables 9 and 10 are simplified by Bayes approximation, and then the simplified results are fused in combination with D–S theory. The fused results are shown in Tables 11 and 12.Table 11
Risk indicator frequency level of Company 1 after fusion.
A¯mA¯C1C2C3C4C5C610.02240.23550.00000.99020.00120.459920.82850.75700.01570.00980.39580.536530.14910.00750.67020.00000.60310.003640.00000.00000.31410.00000.00000.0000C7C8C9C10C1110.03950.24380.03360.01860.009420.84330.65020.71590.57730.592230.11710.10450.25060.40410.394840.00000.00150.00000.00000.0035Table 12
Risk indicator loss level of Company1 after fusion.
A¯mA¯C1C2C3C4C5C610.00000.02600.55560.00000.00660.531620.39020.77920.44440.01800.62310.465230.60980.19480.00000.82000.36920.003240.00000.00000.00000.16200.00110.0000C7C8C9C10C1110.24420.13410.00000.10810.000020.73260.78210.23200.81080.011430.02330.08380.74590.08110.257140.00000.00000.02210.00000.7314


## 6.1.3. Comparative Analysis of Assessment Results Layer by Layer

According to the method in this paper, through substituting the above results into formulas (12)–(14), the mobile service privacy risk assessment results of Company 1 can be calculated. Similarly, this paper also assesses the mobile service of Company 2. Finally, this paper compares the privacy risk assessment results of the two companies layer by layer.(1) Risk Level Comparison in the 3rd Layer. According to the result expression method in Section 5.2, the risk level of each indicator in layer 3 is expressed as levCi=levlowerCi,levmaxCi,levupperCi, and the fuzzy risk level of each indicator is shown in Figures 5 and 6.Figure 5
Privacy risk level of each indicator of Company 1’s mobile service.Figure 6
Privacy risk level of each indicator of Company2’s mobile service.Referring to the classification definition in Table6, levupperCi≥8 indicates that the upper risk level limit of Company 1’s all indicators is above level 8, which means that these indicators are all IIIrd level risk indicators.Among them,levmaxC11=8, indicating that indicator C11 is a more dangerous privacy risk factor in the process of use, which poses the greatest threat to the privacy security of Company1’s mobile services, and it is also a risk factor that users need to pay attention to most in risk management. Except for indicator C11, other risk indicators levmaxCi<8, which means they belong to II level risk indicators, indicating that these factors are unlikely to cause privacy risk in the long-term use process.In addition,levmaxC6=2 indicates that this service has relatively high security in encrypted transmission.In Figure6, only levupperC3<8, indicating that only the maximum risk level of C3 is lower than level III, which means that the services of Company2 have no major privacy risk threat in terms of “mobile advertising attack.”levmaxC9=9 and levmaxC11=8, indicating that these two indicators are dangerous privacy risk factors in the use of company 2’s service, and users need to pay more attention to these two risk factors in the use process. Combining the meanings of C9 and C11, it shows that users need to strengthen the security in “permission operation” and “key management” when using this financial service.In addition,levmaxC3=levmaxC10=2, indicating that this service has high security in terms of “mobile advertising attack” and “third-party application attack.”(2) Risk Level Comparison in the 2nd Layer. Similarly, if the risk level of each risk class in layer 2 is expressed as levβj=levlowerβj,levmaxβj,levupperβj, the fuzzy risk level of each risk class is shown in Figure 7.Figure 7
Privacy risk levels of each risk category of the two companies.As shown in Figure7, there is little difference in the privacy risk levels of the two mobile services in different risk categories. levmaxβj<5 means that all risk categories of the two companies belong to II level risk category, which means that the mobile services of the two companies are in a relatively safe state in most cases. In comparison, the lowest level of Company 2’s all risk categories, levmaxβj>2, indicating that the privacy risk of Company 2 is relatively high.(3) Risk Level Comparison in the 1st Layer. Similarly, if the risk level of the entire service is expressed as lev=levlower,levmax,levupper, the fuzzy risk level of the entire mobile services of the two companies is shown in Table 13.Table 13
Privacy risk level comparison of the entire mobile services between the two companies.
Company1Company2levlowerlevmaxlevupperlevlowerlevmaxlevupper1.4694.70610.4762.1294.8299.609Frequency level of each risk categoryFrequency level of each risk categoryβ1β2β3β1β2β3flower1.1121.0891.100flower1.0721.0741.108fmax2.1152.1252.132fmax1.7361.7461.770fupper3.2473.1633.247fupper2.6622.6722.662Loss level of each risk classLoss level of each risk classβ1β2β3β1β2β3llower1.3441.3031.347llower1.9881.9331.957lmax2.2032.1762.262lmax2.7712.7322.764lupper3.2373.2463.268lupper3.5863.6013.630As shown in Table13, the subordinate range of Company 1’s privacy risk level is 1.469,10.476, while the subordinate range of Company 2’s privacy risk level is 2.129,9.609. Among them, the subordinate range of Company 1’s privacy risk level is relatively large, indicating that the fluctuation range of Company 1’s privacy risk level is relatively large. However, on the whole, the two services’ privacy risk level levmax<5, indicating that the two services are at a relatively safe risk level in the long-term use process.From the above case analysis, it can be seen that the method proposed in this paper is effective and feasible and can provide users with detailed and comprehensive risk assessment results. Based on these assessment results, users can conduct risk analysis from different angles according to their own needs, so as to reasonably manage their own privacy information.


## 6.2. Method Comparison

In order to illustrate the effectiveness and characteristics of the methods proposed in this paper, we carry out the following discussion and comparison.The methods proposed in this paper are mainly used to assess the privacy security of mobile services. Compared with trust computing, they are also a method for security assessment and analysis. During the assessment, for the purpose of security assessment, the two methods all need to sort out the measurement indicators affecting system security and their related attributes and then adopt corresponding methods to assess these indicators. These corresponding methods include AHP [36–38], information entropy [39–41], and trust chain [42–44]. In these methods, trust chain is a method which is mainly used to detect whether the system is attacked or damaged. This method can effectively protect the security of the system. However, this method mainly assesses the vulnerabilities in software and hardware and does not assess other factors such as management risk, man-made operation risk, and application environment risk. In addition, using this method requires the establishment of a special trust chain, and the cost of assessment is high.Therefore, as a risk assessment method, in order to illustrate the characteristics of the method proposed in this paper, it should be compared with other common risk assessment methods, such as risk assessment method based on AHP [45–47], risk assessment method based on risk matrix [48, 49], and risk assessment method based on information entropy [26, 49–52]. They are all mature risk assessment methods, which have been widely used and can provide users with effective risk assessment results.This paper compares the proposed method with the above methods around the following aspects.(i)
Cost: it refers to the cost required for assessment, including the difficulty of expert assessment, task quantity, and computational complexity. The higher the cost, the greater the calculation cost.(ii)
Objectivity: it refers to whether the assessment results can objectively reflect the privacy risk of mobile services. The higher the objectivity, the more accurate the assessment results can describe the privacy risk of the service.(iii)
Completeness: it refers to the comprehensiveness of the privacy risk assessment results. The more privacy risk assessment results this method can provide to users, the more comprehensive the method is.(iv)
Decision support: it refers to whether the assessment results can effectively help users manage privacy information reasonably. The higher the reference value of the assessment results, the higher the decision support.(v)
Difficulty of data acquisition: it refers to the difficulty of obtaining input data.(vi)
Scalability: it refers to the scalability of this method when dealing with new problems.(vii)
Time complexity and space complexity: it refers to the time complexity and space complexity required by this method.As shown in Table14, this paper first compares the methods around the four aspects of cost, objectivity, completeness, and decision support.Table 14
Comparison between this paper’s method and other methods in different aspects.
MethodThe cost required for assessmentMethods to improve objectivityAHPTimes of establishing judgment matrix ≫ 4Pairwise comparison method of weightThis paperTimes of establishing judgment matrix = 4; need to assess the risk level of 11 risk indicatorsPairwise comparison method of weight;Fusion method of expert results based on D–S;Risk level description based on fuzzy theory.Risk matrixNeed to assess the risk level of 11 risk indicatorsOnly uses a fixed value to describe the risk levelInformation entropyNeed to measure the uncertainty of 11 risk indicators and calculate their entropy weightEntropy weight methodComprehensiveness of the assessmentAvailable assessment resultsAHPAnalysis with 3 categories and 3 layersRisk weightThis paperRisk frequency and risk loss analysis from 3 categories and 3 layersRisk weight, risk frequency level, and risk loss levelRisk matrixRisk frequency and risk loss analysisRisk frequency level and risk loss levelInformation entropyUncertainty analysis and entropy weight analysis of riskRisk weight and risk uncertainty


### 6.2.1. Cost Comparison

(1)
AHP: the judgment matrix established in the assessment process of this method is not completely consistent. In order to meet the requirements of consistency, the judgment matrix usually needs to be adjusted many times.(2)
This paper’s method: like AHP, this method needs to establish a special judgment matrix in the assessment process. But when establishing the judgment matrix, this paper proposes to use fuzzy consistency matrix to ensure the consistency of assessment results, which can effectively reduce the difficulty of expert assessment.(3)
Risk matrix: it is only necessary to make a simple level assessment on each risk factor from risk occurrence frequency and risk loss, and its calculation process is very simple.(4)
Information entropy: this method needs to establish a special model and calculate it in combination with the information entropy formula, but it does not need to calculate multiple times like the FAHP method.


### 6.2.2. Objectivity Comparison

(1)
AHP: the method of pairwise comparison is adopted in the assessment process, which reduces the impact of human subjective preference on the assessment results. Its assessment results are relatively objective.(2)
This paper method: in the process of weight assessment, this method inherits the advantages of AHP pairwise comparison method. In the subsequent risk level assessment process, this method combines D–S theory to solve the conflict between experts and combines fuzzy theory to describe the level of privacy risk objectively.(3)
Risk matrix: this method only uses a fixed value to describe the risk level, which is too subjective to reflect the real risk level.(4)
Information entropy: this method effectively describes the risk from the perspective of uncertainty, but it cannot effectively solve the problem of “conflict information” in the assessment process. The assessment results are relatively objective.


### 6.2.3. Comprehensiveness Comparison

(1)
AHP: this method can provide users with multidimensional and multilevel risk assessment results based on the risk attribute model(2)
This paper’s method: this method can also provide users with multidimensional and multilevel risk assessment results and can provide users with the risk level assessment results of risk frequency and risk loss(3)
Risk matrix: this method can only assess each risk factor independently(4)
Information entropy: this method establishes a special risk assessment system, which can also provide users with multilevel assessment results


### 6.2.4. Comparison on the Degree of Decision Support

(1)
AHP: this method can only calculate the impact weight of each risk factor relative to privacy security, but it lacks the measurement of the level of risk.(2)
This paper’s method: it assesses the privacy risk from two aspects—risk frequency and risk loss—and defines the fuzzy triangle number of privacy risk level, including the maximum trust risk level, the maximum risk level, and the minimum risk level. Users can clearly understand each risk and the impact of different risk categories.(3)
Risk matrix: this method can provide users with the assessment results of risk occurrence frequency and risk loss and help users understand the differences of various factors from the above two aspects.(4)
Information entropy: this method describes the level of risk through the degree of uncertainty, which can provide users with the ranking of relevant risk factors, but it does not describe risk frequency and risk loss in detail.


### 6.2.5. Comparison on Difficulty of Data Acquisition

(1)
AHP: it is necessary to obtain the relative weight of each risk indicator and the relative weight of each risk category(2)
This paper’s method: it is necessary to obtain the relative weight of each risk indicator, the relative weight of each risk category, the risk frequency level and risk loss level of each indicator(3)
Risk matrix: it is necessary to obtain the risk frequency level and risk loss level of each indicator(4)
Information entropy: it needs to sort out the uncertain factors affecting each risk indicator or risk category


### 6.2.6. Comparison on Scalability

Taking the service evaluated in this paper as a reference. When it is necessary to carry out more security assessment about this service from more aspects, the scalability comparison of each method is as follows:(1)
AHP: using this method, new risk classes and risk indicators need to be added to the established risk attribute model, which will not affect the risk assessment method.(2)
This paper’s method: like the AHP method, only the risk attribute model needs to be extended(3)
Risk matrix: using this method, although the corresponding risk indicators can be added, it cannot meet the new needs of security assessment(4)
Information entropy: using this method, with the increase of risk indicators, the uncertainty of the whole service will be greatly affected, and its assessment model will also be greatly affected and even need to be reestablishedThe above discussion shows that when there are new risk problems or new safety assessment requirements, AHP method and this paper method have good expansibility. In contrast, the method-based information entropy and the method based risk matrix have poor scalability.To sum up, useHigh=3,Medium=2,Low=1 to describe the characteristics of the above methods, respectively, and the comparison results is shown in Figure 8.Figure 8
Comparison of characteristics between this method and other methods.In Figure8, the value 3 indicates that the method has a higher score than other methods in some respects. The value 2 indicates that the method has a moderate score in some respects, and the value 1 indicates that the method has the lowest score in some respects.


### 6.2.7. Comparison on Time Complexity and Space Complexity

In addition to the comparison of the above 6 aspects, this paper also carries out the comparative analysis of time complexity and space complexity. Suppose the privacy security of a mobile service is affected byn risk indicators. Taking this mobile service as the assessment object, the time complexity and space complexity of each method are shown in Table 15.(1)
This paper: the method proposed in this paper needsnn−1/2 weight judgments and 2n risk level assessments. The total spaces for storing risk frequency level, risk loss level and risk level are 3 n, and the space for storing risk assessment weight is n.(2)
AHP: using the AHP method, in the best case, onlynn−1/2 weight judgments are required. However, in order to pass the consistency test, it is almost necessary to expand nn−1∗logn/2 weight judgments. The required storage space is the same as the method in this paper.(3)
Risk matrix: both in the average and best cases, we only need to setn parameters and conduct 1 assessment for the risk frequency level and risk loss level of n indicators. When there is a conflict between expert assessments, it is necessary to reevaluate the risk level continuously. At this time, the time complexity is logn. In terms of spatial complexity, 3 n spaces are required to store risk frequency level, risk loss level, and risk level.(4)
Information entropy: using this method requiresn assessments for the uncertainty of n indicators. n spaces are required to store the uncertainty level of each indicator.Table 15
Time complexity and space complexity of each method.
MethodT(n)S(n)Average caseBest caseWorst caseMethod of this paperOn2On2On2OnMethod based on AHPOn2lognOn2On2lognOnMethod-based risk matrixO1O1OlognOnMethod-based information entropyOnOnOnOnIn general, this paper introduces FAHP and D–S theory into mobile service privacy risk assessment and proposes a comprehensive assessment method combining risk weight and risk level. This method proposed in this paper inherits the advantages of AHP method and has good scalability. Based on the AHP hierarchical model, this paper uses the fuzzy consistency matrix to solve the consistency problem of judgment matrix in AHP and improves the efficiency of the method. Through comprehensive assessment of risk weight and risk level, the proposed method improves the objectivity, the degree of decision support, and comprehensiveness about the assessment results. However, in order to improve the comprehensiveness of the assessment results, the method proposed in this paper will also increase the difficulty of obtaining the input data, and its time complexity and space complexity will increase accordingly.


## 6.2.1. Cost Comparison

(1)
AHP: the judgment matrix established in the assessment process of this method is not completely consistent. In order to meet the requirements of consistency, the judgment matrix usually needs to be adjusted many times.(2)
This paper’s method: like AHP, this method needs to establish a special judgment matrix in the assessment process. But when establishing the judgment matrix, this paper proposes to use fuzzy consistency matrix to ensure the consistency of assessment results, which can effectively reduce the difficulty of expert assessment.(3)
Risk matrix: it is only necessary to make a simple level assessment on each risk factor from risk occurrence frequency and risk loss, and its calculation process is very simple.(4)
Information entropy: this method needs to establish a special model and calculate it in combination with the information entropy formula, but it does not need to calculate multiple times like the FAHP method.


## 6.2.2. Objectivity Comparison

(1)
AHP: the method of pairwise comparison is adopted in the assessment process, which reduces the impact of human subjective preference on the assessment results. Its assessment results are relatively objective.(2)
This paper method: in the process of weight assessment, this method inherits the advantages of AHP pairwise comparison method. In the subsequent risk level assessment process, this method combines D–S theory to solve the conflict between experts and combines fuzzy theory to describe the level of privacy risk objectively.(3)
Risk matrix: this method only uses a fixed value to describe the risk level, which is too subjective to reflect the real risk level.(4)
Information entropy: this method effectively describes the risk from the perspective of uncertainty, but it cannot effectively solve the problem of “conflict information” in the assessment process. The assessment results are relatively objective.


## 6.2.3. Comprehensiveness Comparison

(1)
AHP: this method can provide users with multidimensional and multilevel risk assessment results based on the risk attribute model(2)
This paper’s method: this method can also provide users with multidimensional and multilevel risk assessment results and can provide users with the risk level assessment results of risk frequency and risk loss(3)
Risk matrix: this method can only assess each risk factor independently(4)
Information entropy: this method establishes a special risk assessment system, which can also provide users with multilevel assessment results


## 6.2.4. Comparison on the Degree of Decision Support

(1)
AHP: this method can only calculate the impact weight of each risk factor relative to privacy security, but it lacks the measurement of the level of risk.(2)
This paper’s method: it assesses the privacy risk from two aspects—risk frequency and risk loss—and defines the fuzzy triangle number of privacy risk level, including the maximum trust risk level, the maximum risk level, and the minimum risk level. Users can clearly understand each risk and the impact of different risk categories.(3)
Risk matrix: this method can provide users with the assessment results of risk occurrence frequency and risk loss and help users understand the differences of various factors from the above two aspects.(4)
Information entropy: this method describes the level of risk through the degree of uncertainty, which can provide users with the ranking of relevant risk factors, but it does not describe risk frequency and risk loss in detail.


## 6.2.5. Comparison on Difficulty of Data Acquisition

(1)
AHP: it is necessary to obtain the relative weight of each risk indicator and the relative weight of each risk category(2)
This paper’s method: it is necessary to obtain the relative weight of each risk indicator, the relative weight of each risk category, the risk frequency level and risk loss level of each indicator(3)
Risk matrix: it is necessary to obtain the risk frequency level and risk loss level of each indicator(4)
Information entropy: it needs to sort out the uncertain factors affecting each risk indicator or risk category


## 6.2.6. Comparison on Scalability

Taking the service evaluated in this paper as a reference. When it is necessary to carry out more security assessment about this service from more aspects, the scalability comparison of each method is as follows:(1)
AHP: using this method, new risk classes and risk indicators need to be added to the established risk attribute model, which will not affect the risk assessment method.(2)
This paper’s method: like the AHP method, only the risk attribute model needs to be extended(3)
Risk matrix: using this method, although the corresponding risk indicators can be added, it cannot meet the new needs of security assessment(4)
Information entropy: using this method, with the increase of risk indicators, the uncertainty of the whole service will be greatly affected, and its assessment model will also be greatly affected and even need to be reestablishedThe above discussion shows that when there are new risk problems or new safety assessment requirements, AHP method and this paper method have good expansibility. In contrast, the method-based information entropy and the method based risk matrix have poor scalability.To sum up, useHigh=3,Medium=2,Low=1 to describe the characteristics of the above methods, respectively, and the comparison results is shown in Figure 8.Figure 8
Comparison of characteristics between this method and other methods.In Figure8, the value 3 indicates that the method has a higher score than other methods in some respects. The value 2 indicates that the method has a moderate score in some respects, and the value 1 indicates that the method has the lowest score in some respects.


## 6.2.7. Comparison on Time Complexity and Space Complexity

In addition to the comparison of the above 6 aspects, this paper also carries out the comparative analysis of time complexity and space complexity. Suppose the privacy security of a mobile service is affected byn risk indicators. Taking this mobile service as the assessment object, the time complexity and space complexity of each method are shown in Table 15.(1)
This paper: the method proposed in this paper needsnn−1/2 weight judgments and 2n risk level assessments. The total spaces for storing risk frequency level, risk loss level and risk level are 3 n, and the space for storing risk assessment weight is n.(2)
AHP: using the AHP method, in the best case, onlynn−1/2 weight judgments are required. However, in order to pass the consistency test, it is almost necessary to expand nn−1∗logn/2 weight judgments. The required storage space is the same as the method in this paper.(3)
Risk matrix: both in the average and best cases, we only need to setn parameters and conduct 1 assessment for the risk frequency level and risk loss level of n indicators. When there is a conflict between expert assessments, it is necessary to reevaluate the risk level continuously. At this time, the time complexity is logn. In terms of spatial complexity, 3 n spaces are required to store risk frequency level, risk loss level, and risk level.(4)
Information entropy: using this method requiresn assessments for the uncertainty of n indicators. n spaces are required to store the uncertainty level of each indicator.Table 15
Time complexity and space complexity of each method.
MethodT(n)S(n)Average caseBest caseWorst caseMethod of this paperOn2On2On2OnMethod based on AHPOn2lognOn2On2lognOnMethod-based risk matrixO1O1OlognOnMethod-based information entropyOnOnOnOnIn general, this paper introduces FAHP and D–S theory into mobile service privacy risk assessment and proposes a comprehensive assessment method combining risk weight and risk level. This method proposed in this paper inherits the advantages of AHP method and has good scalability. Based on the AHP hierarchical model, this paper uses the fuzzy consistency matrix to solve the consistency problem of judgment matrix in AHP and improves the efficiency of the method. Through comprehensive assessment of risk weight and risk level, the proposed method improves the objectivity, the degree of decision support, and comprehensiveness about the assessment results. However, in order to improve the comprehensiveness of the assessment results, the method proposed in this paper will also increase the difficulty of obtaining the input data, and its time complexity and space complexity will increase accordingly.


## 7. Conclusion

Firstly, this paper establishes the privacy risk attribute model based on FAHP, uses the fuzzy consistency matrix method to effectively solve the consistency problem of judgment matrix in AHP, and puts forward an effective risk weight assessment method for mobile service privacy risk. Secondly, this paper redefines the level of privacy risk combined with fuzzy theory, integrates the expert assessment results combined with D–S theory, effectively solves the “opinion conflict problem” in multiexpert assessment, and realizes the measurement of the privacy risk level of mobile services. Finally, through a series of research, this paper proposes a complete assessment method of mobile service privacy risk based on FAHP and D–S theory. This method is objective and feasible. It can provide users with privacy risk assessment results of different dimensions and layers and help users reasonably manage their privacy information. It has long-term significance for the research of mobile service privacy security. In the future research, to provide users with more accurate and detailed assessment results, it is also necessary to further give the corresponding trust degree of risk level based on the research results, and explore effective risk dynamic assessment methods.



---

*Source: 9547533-2022-02-23.xml*