云用户行为安全评价的犹豫模糊奖优罚劣方法

doi:10.3778/j.issn.1673-9418.2107053

摘要/Abstract

摘要： 安全问题是云计算相关研究中的关键议题，云计算用户（CSU）的不安全行为是云计算安全威胁的主要致因。对CSU进行行为安全（BBS）评价是纠正不安全行为、维持安全行为，从而有效提升云计算安全的基础。为有效对CSU-BBS评价且体现安全评价的奖优罚劣目的，提出一种基于逼近理想解法（TOPSIS）虚拟最劣解思想的犹豫模糊奖优罚劣的CSU-BBS评价方法。首先，对于多点监测获取的差异化CSU行为数据以犹豫模糊元（HFE）形式表达，并直接用于后续评价，确保用于评价的CSU行为数据真实、完全；其次，针对安全问题应“奖罚分明”的特点及BBS的“正负强化”需要，在犹豫模糊背景下提出一种体现“奖优罚劣”功能的犹豫模糊去量纲方法。接着，为获得多方案合理排序，基于TOPSIS的变体——虚拟最劣解方法，发展了一种CSU-BBS优劣评价的犹豫模糊求解途径。最后，以某中小型互联网企业的3个云计算平台用户行为数据对5名CSU进行BBS实例评价并辅以对比分析。评价结果表明所提方法能够有效评价CSU-BBS且具奖优罚劣功能。

关键词: 云计算, 行为安全（BBS）评价, 犹豫模糊集（HFS）, “奖优罚劣”去量纲, 虚拟最劣解

Abstract: Security issue is one of key contents of the related cloud computing research, and unsafe behavior of cloud computing service users (CSU) is the main cause of cloud computing security threats. The behavior-based safety (BBS) evaluation of CSU is the basis for correcting unsafe behaviors, maintaining safe behaviors, and effectively improving cloud computing security. In order to effectively evaluate behavior-based safety (BBS) of CSU and reflect the purpose of rewarding good and penalizing bad in evaluation process, a hesitant fuzzy CSU-BBS evaluation method based on the idea of TOPSIS (technique for order preference by similarity to an ideal solution) virtual worst solution is proposed. Firstly, differential CSU behavior data obtained by multi-point monitoring are expressed in hesitating fuzzy element (HFE) and directly used for subsequent evaluation to ensure that the CSU behavior data used for evaluation are true and comprehensive. Secondly, in view of the characteristics of “reward and penalization distinct” of security issues and the need of “positive and negative reinforcement” of BBS, a hesitant fuzzy de-dimensional method that reflects the function of “rewarding good and penalizing bad” is proposed. Next, in order to obtain a reasonable ordering of multiple schemes, under the virtual worst solution (TOPSIS variant) framework, a hesitant fuzzy procedure for evaluating CSU-BBS is developed. Finally, the BBS of five CSU is evaluated based on the user behavior data of three cloud computing platforms of a small and medium-sized Internet company. Evaluation results show that the proposed method can effectively evaluate CSU-BBS and has the function of rewarding good and penalizing bad.

Key words: cloud computing, behavior-based safety (BBS) evaluation, hesitant fuzzy set (HFS), “rewarding good and penalizing bad” de-dimensional method, virtual worst solution

彭定洪, 宋博, 张文华. 云用户行为安全评价的犹豫模糊奖优罚劣方法[J]. 计算机科学与探索, 2023, 17(4): 973-984.

PENG Dinghong, SONG Bo, ZHANG Wenhua. Hesitant Fuzzy Method of Rewarding Good and Penalizing Bad in Cloud Service User Behavior-Based Safety Evaluation[J]. Journal of Frontiers of Computer Science and Technology, 2023, 17(4): 973-984.

参考文献

[1] 张玉清, 王晓菲, 刘雪峰, 等. 云计算环境安全综述[J]. 软件学报, 2016, 27(6): 1328-1348.
ZHANG Y Q, WANG X F, LIU X F, et al. Survey on cloud computing security[J]. Journal of Software, 2016, 27(6): 1328-1348.
[2] NAMASUDRA S, DEVI D, KADRY S, et al. Towards DNA based data security in the cloud computing environment[J]. Computer Communications, 2020, 151: 539-547.
[3] 鲁金钿, 肖睿智, 金舒原. 云数据安全研究进展[J]. 电子与信息学报, 2021, 43(4): 881-891.
LU J D, XIAO R Z, JIN S Y. A survey for cloud data se-curity[J]. Journal of Electronics & Information Technology, 2021, 43(4): 881-891.
[4] 王于丁, 杨家海, 徐聪, 等. 云计算访问控制技术研究综述[J]. 软件学报, 2015, 26(5): 1129-1150.
WANG Y D, YANG J H, XU C, et al. Survey on access control technologies for cloud computing[J]. Journal of Software, 2015, 26(5): 1129-1150.
[5] ZHANG P Y, ZHOU M C, KONG Y. A double-blind anony-mous evaluation-based trust model in cloud computing en-vironments[J]. IEEE Transactions on Systems, Man, and Cybernetics: Systems, 2021, 51(3): 1805-1816.
[6] 王国峰, 刘川意, 潘鹤中, 等. 云计算模式内部威胁综述[J]. 计算机学报, 2017, 40(2): 296-316.
WANG G F, LIU C Y, PAN H Z, et al. Survey on insider threats to cloud computing[J]. Chinese Journal of Compu-ters, 2017, 40(2): 296-316.
[7] CHAWKI E B, AHMED A, ZAKARIAE T. IaaS cloud model security issues on behalf cloud provider and user security behaviors[J]. Procedia Computer Science, 2018, 134: 328-333.
[8] 陈亚睿, 田立勤, 杨扬. 云计算环境下基于动态博弈论的用户行为模型与分析[J]. 电子学报, 2011, 39(8): 1818-1823.
CHEN Y R, TIAN L Q, YANG Y. Model and analysis of user behavior based on dynamic game theory in cloud com-puting[J]. Acta Electronica Sinica, 2011, 39(8): 1818-1823.
[9] 李存斌, 蔺帅帅, 徐方秋. 基于改进VIKOR法的云计算环境下用户行为安全的评估研究[J]. 计算机科学, 2017, 44(12): 105-109.
LI C B, LIN S S, XU F Q. Safety assessment of user beha-viors under environment of computing based on improved VIKOR method[J]. Computer Science, 2017, 44(12): 105- 109.
[10] 宋国峰, 梁昌勇. 一种基于用户行为信任的云安全访问控制模型[J]. 中国管理科学, 2013, 21(S2): 669-676.
SONG G F, LIANG C Y. A cloud security access control model based on user behavior trust[J]. Chinese Journal of Management Science, 2013, 21(S2): 669-676.
[11] ALRUWAYTHI M, KAMBHAMPATY K, NYGARD K E. User behavior and trust evaluation in cloud computing[C]//Proceedings of the 34th International Conference on Compu-ters and Their Applications, Honolulu, Mar 18-20, 2019.
[12] HOSSEINI S B, SHOJAEE A, AGHELI N. A new method for evaluating cloud computing user behavior trust[C]//Proceedings of the 2015 7th Conference on Information and Knowledge Technology, Urmia, May 26-28, 2015. Piscata-way: IEEE, 2015: 1-6.
[13] CHEN Z G, TIAN L Q, LIN C. Trust evaluation model of cloud user based on behavior data[J]. International Journal of Distributed Sensor Networks, 2018, 14(5): 1550147718776924.
[14] ALRUWAYTHI M, NYGARD K E. Fuzzy logic approach based on user behavior trust in cloud security[C]//Procee-dings of the 2019 IEEE International Conference on Electro Information Technology, Brookings, May 20-22, 2019. Pis-cataway: IEEE, 2019: 1-6.
[15] 傅贵, 张苏, 董继业, 等. 行为安全的理论实质与效果讨论[J]. 中国安全科学学报, 2013, 23(3): 150-154.
FU G, ZHANG S, DONG J Y, et al. Discussions on the theoretical understanding and effects of behavior based safety[J]. China Safety Science Journal, 2013, 23(3): 150-154.
[16] NICIEJEWSKA M, OBRECHT M. Impact of behavioral safety (behavioural-based safety-BBS) on the modification of dangerous behaviors in enterprises[J]. System Safety: Human-Technical Facility-Environment, 2020, 2(1): 324-332.
[17] 佟瑞鹏, 杨校毅. 行为安全损耗和激励双路径管理理论研究[J]. 中国安全科学学报, 2020, 30(9): 8-14.
TONG R P, YANG X Y. Dual path management theory of behavior-based safety impairment and motivation[J]. China Safety Science Journal, 2020, 30(9): 8-14.
[18] 詹敏, 廖志高, 徐玖平. 线性无量纲化方法比较研究[J]. 统计与信息论坛, 2016, 31(12): 17-22.
ZHAN M, LIAO Z G, XU J P. Character analysis of linear dimensionless methods[J]. Statistics & Information Forum, 2016, 31(12): 17-22.
[19]戴文战, 邹立华, 汪建章, 等. 一种基于奖优罚劣原则的多阶段多目标决策模型[J]. 系统工程理论与实践, 2000，20(6): 32-36.
DAI W Z, ZOU L H, WANG J Z, et al. A method of the dynamic multiple attribute decision modeling based on new effective function and its application[J]. Systems Engineering-Theory & Practice, 2000, 20(6): 32-36.
[20] 宋捷, 党耀国, 王正新. 基于强“奖优罚劣”算子的多指标灰靶决策模型[J]. 系统工程与电子技术, 2010, 32(6):1229-1232.
SONG J, DANG Y G, WANG Z X. Multi-attribute decision model of grey target based on majorant operator of “rewar-ding good and punishing bad”[J]. Systems Engineering and Electronics, 2010, 32(6): 1229-1232.
[21] 王昭聪, 潘学萍, 马倩. 基于“奖优罚劣”线性变换改进前景理论的电网建设项目多属性投资排序方法[J]. 电网技术, 2019, 43(6): 2154-2164.
WANG Z C, PAN X P, MA Q. Multi-attribute investment ranking method for power grid project construction based on improved prospect theory of “rewarding good and punishing bad” linear transformation[J]. Power System Technology, 2019, 43(6): 2154-2164.
[22] 刘勇, Jeffrey Forrest, 刘思峰. 基于“奖优罚劣”线性变换算子的区间数多目标灰色局势决策方法[J]. 统计与信息论坛, 2012, 27(4): 22-26.
LIU Y, FORREST J, LIU S F. Multi-objective grey situa-tion decision making model and application with interval numbers based on linear transformation operator with re-warding good and punishing bad[J]. Statistics & Informa-tion Forum, 2012, 27(4): 22-26.
[23] TIAN L Q, LIN C, NI Y. Evaluation of user behavior trust in cloud computing[C]//Proceedings of the 2010 Interna-tional Conference on Computer Application and System Mo-deling, Taiyuan, Oct 22-24, 2010. Piscataway: IEEE, 2010: 567-572.
[24] TORRA V, NARUKAWA Y. On hesitant fuzzy sets and deci-sion[C]//Proceedings of the 18th IEEE International Confe-rence on Fuzzy Systems, Jeju Island, Aug 20-24, 2009. Pis-cataway: IEEE, 2009: 1378-1382.
[25] HWANG C L, YOON K. Multiple attribute decision making: methods and applications a state-of-the-art survey[M]. Berlin, Heidelberg: Springer, 1981.
[26] 牛莉霞, 刘谋兴, 李乃文, 等. HVB惯性度的MPHMADM评价[J]. 中国安全科学学报, 2017, 27(7): 48-52.
NIU L X, LIU M X, LI N W, et al. Evaluation of HVB inertia degree based on MPHMADM[J]. China Safety Science Journal, 2017, 27(7): 48-52.
[27] 曾旭, 陆刚, 陈振伟, 等. 组织管理失误对操作人员行为安全影响分析[J]. 中国安全生产科学技术, 2016, 12(8): 185- 192.
ZENG X, LU G, CHEN Z W, et al. Study on influence to behavior safety of operators by organizational management error[J]. Journal of Safety Science and Technology, 2016, 12(8): 185-192.
[28] 王瑛, 肖薇, 王娜. 基于FC-OWA算子和改进竞合视角的科技奖励综合评价[J]. 统计与决策, 2015(8): 59-63.
WANG Y, XIAO W, WANG N. A comprehensive evalua-tion of science and technology awards based on technology awards based on FC-OWA operator and improved compe-titive perspective[J]. Statistics & Decision, 2015(8): 59-63.
[29] 俞立平, 潘云涛, 武夷山. 修正TOPSIS及其在科技评价中的应用研究[J]. 情报杂志, 2012, 31(6): 103-107.
YU L P, PAN Y T, WU Y S. Study on accurate TOPSIS and its use in science and technology evaluation[J]. Journal of Intelligence, 2012, 31(6): 103-107.
[30] 王霞. 基于改进TOPSIS的三参数区间灰数多属性决策方法[J]. 系统科学与数学, 2021, 41(5): 1328-1338.
WANG X. Multi-attribute decision making method based on improved TOPSIS under three-parameter interval grey num-ber[J]. Systems Science and Mathematics, 2021, 41(5): 1328-1338.
[31] 李美娟, 袁宁, 陈磊. 基于投影法和夹角度量法的改进TOPSIS[J]. 系统科学与数学, 2020, 40(9): 1614-1627.
LI M J, YUAN N, CHEN L. Improved TOPSIS based on projection method and angle measure evaluation method [J]. Journal of Systems Science and Mathematical Sciences, 2020, 40(9): 1614-1627.
[32] 郑晓薇, 汤胜利, 龚兆仁. 按对象分层决策矩阵的逼近理想解TOPSIS法的算法及实现[J]. 计算机工程与应用, 2000, 36(10): 81-83.
ZHENG X W, TANG S L, GONG Z R. An algorithm pro-gram of decision matrix according to object divided layers structure[J]. Computer Engineering and Applications, 2000,36(10): 81-83.
[33] 陈伟. 关于TOPSIS法应用中的逆序问题及消除的方法[J]. 运筹与管理, 2005, 14(3): 39-43.
CHEN W. On the problem and elimination of rank reversal in the application of TOPSIS method[J]. Operations Research and Management Science, 2005, 14(3): 39-43.
[34] 徐林明, 李美娟, 欧忠辉, 等. 基于虚拟最劣解TOPSIS和灰关联度的动态评价方法[J]. 系统科学与数学, 2019, 39(3): 365-377.
XU L M, LI M J, OU Z H, et al. Dynamic evaluation method based on virtual worst solution TOPSIS and gray correla-tion degree[J]. Journal of Systems Science and Mathema-tical Sciences, 2019, 39(3): 365-377.
[35] 周彬, 赵宽, 钟林生, 等. 舟山群岛生态系统健康与旅游经济协调发展评价[J]. 生态学报, 2015, 35(10): 3437-3446.
ZHOU B, ZHAO K, ZHONG L S, et al. Coordinated deve-lopment evaluation of the ecosystem health and the tourism economy Zhoushan Islands[J]. Acta Ecologica Sinica, 2015, 35(10): 3437-3446.
[36] WANG Y J, LEE H S. Generalizing TOPSIS for fuzzy mul-tiple-criteria group decision-making[J]. Computers & Ma-thematics with Applications, 2007, 53(11): 1762-1772.
[37] XIA M M, XU Z S. Hesitant fuzzy information aggregation in decision making[J]. International Journal of Approximate Reasoning, 2010, 52(3): 395-407.
[38] 党耀国, 刘国峰, 王建平, 等. 多指标加权灰靶的决策模型[J]. 统计与决策, 2004(3): 29-30.
DANG Y G, LIU G F, WANG J P, et al. Decision model with multi-indicator weighted gray target[J]. Statistics & Decision, 2004(3): 29-30.
[39] 郭亚军, 易平涛. 线性无量纲化方法的性质分析[J]. 统计研究, 2008(2): 93-100.
UO Y J, YI P T. Character analysis of linear dimensionless methods[J]. Statistical Research, 2008(2): 93-100.