基于模糊层次分析的工业SCADA安全风险评估方法研究与应用

摘要

数据采集与监控系统SCADA(Supervisory Control And Data Acquisition)的安全防御受到越来越多的重视,风险评估是预防事故风险的发生、保障其安全性的重要手段.为了解决传统系统评估方法的缺陷及人为因素影响较大的问题,提出一种基于模糊综合评估的SCADA系统安全风险评估方法.首先建立安全评估指标体系,然后通过层次分析法得到准则层、指标层和目标层三级体系间下级对上级的权重影响,再通过专家打分的方式,结合模糊数学理论,采用隶属函数的方式得到各级指标的安全隶属度,最终实现对多维多因素的多级评估.实验结果表明,采用模糊综合评估能够较好地解决定量与定性相互转换的难题,使评估方式更能与实际情况相符,从而提高安全评估的准确性,使现场工作人员能对SCADA系统安全做出更正确的决策,从而提高工作效率,在为企业乃至国家带来利益的同时,尽可能降低事故发生的概率.%The security defense of supervisory control and data acquisition (SCADA) is paid more and more attention, and risk assessment is an important ways to prevent the occurrence of accident risk and ensure its security.In order to solve the problem of the traditional assessment method and the human factors, an SCADA system security risk assessment method based on fuzzy comprehensive evaluation is proposed.Firstly, the safety assessment index system is established, then the influence of the subordinate system between the three levels of the criteria layer, the index layer and the target layer on the weights of the superiors is obtained through the analytic hierarchy process.Then through the expert scoring method, combined with the fuzzy mathematics theory, the membership function is adopted to get the security membership degree of each index, and finally the multilevel evaluation of the multidimensional and multi-factor is realized.The experimental results show that the fuzzy comprehensive evaluation can solve the problem of quantitative and qualitative mutual conversion, so that the assessment method can be more consistent with the actual situation,thereby improving the accuracy of safety assessment.It also enables site staff to make more correct decision about SCADA system safety, thereby increasing productivity and reducing the probability of accidents as much as possible,while benefiting the business as well as the nation.