Abstract: This paper studied a comprehensive assessment method of information system security according to the two perspectives of system attack and defense.From the perspective of system attack,we proposed a quantitative assessment of system vulnerability risk assessment model based on CVE standard,association rules algorithm and vulnerability connection network model.From the perspective of system defense,we established assessment information system customi-zed security model which simplies evaluating information system assets.Combining the system information and security,we put forward that “information” is the smallest unit of information system,and established the AHP and three-dimensional assessment model according to GB/T 22239-2008.On the basis of system attack and defense assessment results,comprehensive assessment method realizes comprehensive system security quantitative analysis,system vulnerability risk analysis and system security short plate analysis.The application example shows that the comprehensive assessment method realizes objective,scientific and comprehensive quantitative assessment on information system security.

Key words: Information system,Quantitative assessment,Vulnerability connection,Association rules,Analytic hierarchy process (AHP),Three-dimensional assessment