Abstract: For the practical purposes of intrusion response decision-making and security management, a Fuzzy Analytic Hierarchy Process approach based on Weighted Ordered Weighted Averaging aggregation(WOWA-FAHP) and a network security situation assessment model based on WOWA-FAHP were proposed. Besides preserving the merits of the FAHP, the WOWA-FAHP approach takes into account both objective and subjective associations among the attributes,and is able to adapt various decision preferences. I}he assessment model based on WOWA-FAHP combines static and dynamic assessments; utilizes multiple information sources, such as system security risk evaluation, intrusion alert fusion and correlation, anomaly monitor and security audit; considers multiple aspects, such as intrusion alerts, anomalies, vulnerabilitics,and attack effects;and handles the complex relations among the factors with the WOWA-FAHP approach according to different security policies. The effectiveness of the proposed approach and model is illustrated via an actual security situation assessment for a network application service system.

Key words: Network security, Situation assessment, Weighted ordered weighted averaging operator, Fuzzy analytic hierarchy process, Decision preference