In the process of information security risk assessment, the risk state estimation is a key link, and the accuracy of the state estimation algorithm will directly determine whether the evaluation results are accurate. Particle filter is a nonlinear non-Gaussian optimal filtering algorithm [7, 25], so this paper select the particle filter algorithm for information system security risk assessment, combined with clustering algorithm to solve the computational problem.

The dynamic model of the information system is assumed to be:
$$\begin{array}{r}\left\{\begin{array}{l}{x}_{k}=f({x}_{k-1},{\nu}_{k-1})\\ {y}_{k}=h({x}_{k},{v}_{k}^{\prime})\end{array}\right.\end{array}$$(4)

where *x*_{k} ∈ *R*^{nx} is the threat index vector of the system at moment *k*, *y*_{k} ∈ *R*^{ny} is risk output vector, *ν*_{k} ∈ *R*^{nν} is the system’s noise, ${v}_{k}^{\prime}\in {R}^{{n}_{n}}$ is the observation noise.

The posterior density *p*(*x*_{0:k}|*y*_{1:k}) is a complete solution to the sequential estimation problem. According to the principle of Monte Carlo simulation, the posterior density can be approximately represented as:
$$\begin{array}{r}p({x}_{0:k}|{y}_{1:k})\approx \sum _{i=1}^{N}{w}_{k}^{i}\delta ({x}_{0:k}-{x}_{0:k}^{i})\end{array}$$(5)

Introducing the key density *q*(*x*_{0:k}|*y*_{1:k}) and assuming that the sample ${x}_{0:k}^{i}$ is obtained from the focus density sampling:
$$\begin{array}{r}{x}_{k}^{i}\sim q({x}_{0:k}|{y}_{1:k})\end{array}$$(6)

and the importance weight:
$$\begin{array}{r}{w}_{k}^{i}\propto \frac{p({x}_{0:k}^{i}|{y}_{1:k})}{q({x}_{0:k}^{i}|{y}_{1:k})}\end{array}$$(7)

Assuming that the density can be decomposed into:
$$\begin{array}{r}q({x}_{0:k}|{y}_{1:k})=q({x}_{k}|{x}_{0:k-1},{y}_{1:k})q({x}_{0:k-1}|{y}_{1:k-1})\end{array}$$(8)

Which means that the sample set ${x}_{0:k}^{i}\sim q({x}_{0:k}|{y}_{1:k})$ can be obtained by adding the new particle ${x}_{k}^{i}\sim q({x}_{k}|{x}_{0:k-1},{y}_{1:k})$ into ${x}_{0:k-1}^{i}\sim q({x}_{0:k-1}|{y}_{1:k-1})$. And *p*(*x*_{0:k}|*y*_{1:k}) can be expressed as a recursive form below:
$$\begin{array}{r}p({x}_{0:k}|{y}_{1:k})=\frac{p({y}_{k}|{y}_{1:k-1}|{x}_{0:k})}{p({y}_{k}|{y}_{1:k-1})}\times \frac{p({y}_{1:k-1}|{x}_{0:k})p({x}_{0:k})}{p({y}_{1:k-1})}\end{array}$$(9)

Using Bayes formula:
$$\begin{array}{rl}p({x}_{0:k}|{y}_{1:k})& =\frac{p({y}_{k}|{y}_{1:k-1}|{x}_{0:k})}{p({y}_{k}|{y}_{1:k-1})}\\ & \times p({x}_{k}|{x}_{0:k-1}|{y}_{1:k-1})p({x}_{0:k-1}|{y}_{1:k-1})\end{array}$$(10)

As the system follows the first order Markov process, and it’s an independent observation system, so
$$\begin{array}{r}p({x}_{0:k}|{y}_{1:k})\propto p({y}_{k}|{x}_{k})p({x}_{k}|{x}_{k-1})p({x}_{0:k-1}|{y}_{1:k-1})\end{array}$$(11)

If the focus density satisfies
$$\begin{array}{r}q({x}_{k}|{x}_{0:k-1},{y}_{1:k})=q({x}_{k}|{x}_{k-1},{y}_{k})\end{array}$$(12)

Combining formulas (4)
$$\begin{array}{r}{w}_{k}^{i}\propto {w}_{k-1}^{i}\frac{p({y}_{k}|{x}_{k}^{i})p({x}_{k}^{i}|{x}_{k-1}^{i})}{q({x}_{k}^{i}|{x}_{k-1}^{i},{y}_{k})}\end{array}$$(13)

Which is
$$\begin{array}{r}{x}_{k}^{i}\sim q({x}_{k}|{x}_{k-1}^{i},{y}_{k})\end{array}$$(14)

After weight normalization
$$\begin{array}{r}{w}_{k}^{i}={w}_{k}^{i}/\sum _{i=1}^{N}{w}_{k}^{i}\end{array}$$(15)

Usually taking
$$\begin{array}{r}q({x}_{k}^{i}|{x}_{k-1}^{i},{y}_{k})=p({x}_{k}^{i}|{x}_{k-1}^{i})\end{array}$$(16)

Which is
$$\begin{array}{r}{x}_{k}^{i}\sim p({x}_{k}|{x}_{k-1}^{i})\end{array}$$(17)

Then
$$\begin{array}{r}{w}_{k}^{i}\propto {w}_{k-1}^{i}p({y}_{k}|{x}_{k}^{i})\end{array}$$(18)

The above steps are all the basis of particle filter dynamic estimation algorithm. According to the measuring value of the system, the above-mentioned method is used to calculate samples and weight recursively, forming a dynamic estimation algorithm of particle filtering. And the progress of particle filter and state estimation algorithm based on weight is as follows:

**Step 1**. Initialization: At *k* = 0 moment, taking samples according to the key density, *k* = 1;

**Step 2**. Predication:
$$\begin{array}{r}{x}_{k}^{i}=f({x}_{k-1}^{i},{\nu}_{k-1})\end{array}$$(19)

**Step 3**. Weighting:
$$\begin{array}{r}{w}_{k}^{i}={w}_{k-1}^{i}\times \frac{p({y}_{k}|{x}_{k}^{i})p({x}_{k}^{i}|{x}_{k-1}^{i})}{q({x}_{k}^{i}|{x}_{k-1}^{i},{y}_{k})}\end{array}$$(20)

**Step 4**. Weight normalization:
$$\begin{array}{r}{w}_{k}^{i}={w}_{k}^{i}/\sum _{i=1}^{N}{w}_{k}^{i}\end{array}$$(21)

**Step 5**. State estimation:
$$\begin{array}{r}{x}_{{}_{k}}^{\ast}=\sum _{i=1}^{N}{x}_{k}^{i}\times {w}_{k}^{i}\end{array}$$(22)

**Step 6**. Back to step 2.

The essence of the method of information system state estimation based on particle filter is that making *j*-steps forward prediction about the particle at *k* moment. Knowing the observed value *y*_{1:k}, when making *j*-steps forward prediction about the system’s state, particles are updated in an existing way, the weight of a particle at (*k* + *j*) moment keeps unchanged to particle at *k* moment, and the *j*-step forward to the state of risk prediction probability (*i.e.*, a comprehensive assessment of the risk level) can be calculated as:
$$\begin{array}{r}rp(j,k)=\sum _{i=1}^{N}{w}_{k}^{j}I({x}_{k+j\left|k+j-1\right.}^{i}),\phantom{\rule{1em}{0ex}}j\in [1,n]\end{array}$$(23)

Where ${w}_{k}^{j}$ is the importance weight corresponding to ${x}_{k}^{i}$, which is the system risk state, such as {normal, medium, dangerous}, and *w*_{0} = {0.1, 0.5, 1}, *I*(*A*) is the symbolic function. In order to ensure the accuracy of calculation, usually take *j* = 1, which means one step prediction.

## Comments (0)

General note:By using the comment function on degruyter.com you agree to our Privacy Statement. A respectful treatment of one another is important to us. Therefore we would like to draw your attention to our House Rules.