Soft Computing Techniques Help Assign Weights to Different Factors in Vulnerability Analysis

The main objective of vulnerability analysis is to select the alternative which is the least vulnerable. To make this selection, we must describe the vulnerability of each alternative by a single number – then we will select the alternative with the smallest value of this vulnerability index. Usually, there are many aspects of vulnerability: vulnerability of a certain asset to a storm, to a terrorist attack, to hackers’ attack, etc. For each aspect, we can usually gauge the corresponding vulnerability, the difficulty is how to combine these partial vulnerabilities into a single weighted value. In our previous research, we proposed an empirical idea of selecting the weights proportionally to the number of times the corresponding aspect is mentioned in the corresponding standards and requirements. This idea was shown to lead to reasonable results. In this paper, we provide a possible theoretical explanation for this empirically successful idea. I. FORMULATION OF THE PROBLEM Need for vulnerability analysis. When it turns out that an important system is vulnerable – to a storm, to a terrorist attack, to hackers’ attack, etc. – we need to protect it. Usually, there are many different ways to protect the same system. It is therefore desirable to select the protection scheme which guarantees the largest degree of protection within the given budget. The corresponding analysis of different vulnerability aspects is known as it vulnerability analysis; see, e.g., [2], [8], [11], [12], [13], [14]. Vulnerability analysis: reminder. Among several possible alternative schemes for protecting a system, we must select a one under which the system will be the least vulnerable. As we have mentioned, there are many different aspects of vulnerability. Usually, it is known how to gauge the vulnerability vi of each aspect i. Thus, each alternative can be characterized by the corresponding vulnerability values (v1, . . . , vn). Some alternatives results in smaller vulnerability of one of the assets, other alternatives leave this asset more vulnerable but provide more protection to other assets. To be able to compare different alternatives, we need to characterize each alternative by a single vulnerability index v – an index that would combine the values v1, . . . , vn corresponding to different aspects: v = f(v1, . . . , vn). If one of the vulnerabilities vi increases, then the overall vulnerability index v must also increase (or at least remain the same, but not decrease). Thus, the combination function f(v1, . . . , vn) must be increasing in each of its variables vi. Vulnerability analysis: important challenge. While there are well-developed methods for gauging each aspect of vulnerability, there is no well-established way of combining the resulting values v1, . . . , vn into a single criterion v = f(v1, . . . , vn). Usually, vulnerabilities vi are reasonably small; so terms which are quadratic (or of higher order) in vi can be usually safely ignored. As a result, we can expand the (unknown) function f(v1, . . . , vn) in Taylor series in vi and keep only linear terms in this expansion. As a result, we get a linear dependence v = c0 + n ∑