The means and methods of AGI technology are developing rapidly; as a result of these developments, many researchers have proposed various AGI security evaluation models. One area of research focuses on the classification of security risk and the determination of an index system, while the other kinds focus on the design and construction of evaluation model.
In order to deal with the network attack classification and index system establishment, Nong et al. [
1] proposed a system-fault-risk framework to subdivide the actions of network attacks and provide a threat risk analysis. However, in their scheme, the authors did not explicitly propose an attack classification framework. Alcaraz et al. [
2] proposed an attack classification method for availability, integrity and confidentiality. According to the attack classification, the authors analyzed security threats to resources, information and users, and evaluated the network attack’s impact on critical infrastructure. Cazorla et al. [
3] improved on the basis of [
2] and proposed an AICAn (availability, integrity, confidentiality and anomalies) classification, which included the anomalies of the infrastructure in addition to availability, integrity and confidentiality. According to the AICAn classification, the authors [
3] broadened the evaluation scope of the impact of a network attack. Gunduz et al. [
4] proposed a classification method for network attacks based on confidentiality, integrity and availability (CIA) for smart grid security and divided the attacks into 17 types. However, the authors of [
2,
3,
4] only provided a relatively effective classification of network attacks, but did not refine the quantifiable indicators of each type of attacks. Jia et al. [
5] constructed a relatively complete network attack classification and index system via an analytic hierarchy process. However, the authors did not consider the consistency test and correction of the pairwise comparison matrix. Al-Zewairi et al. [
6] classified unknown attacks by conducting experimental evaluations with modern shallow and deep ANN models, as well as two benchmark datasets commonly used in IDS research. However, their classification lacked a theoretical basis and could not prove the rationality of the classification. Bashaiwth et al. [
7] utilized the long short-term memory (LSTM) model to classify DDoS attacks. However, their model struggled to distinguish between some types of DDoS attacks, which resulted in a poor classification performance. Ahmed et al. [
8] proposed a model for detecting botnets using deep learning to identify zero-day botnet attacks in real time. However, the above schemes [
7,
8] had significant limitations and could only classify specific types of attacks, which made it difficult to apply them to the classification of other attacks. Aldhaheri et al. [
9] developed a novel hybrid deep learning and Dendritic Cell Algorithm (DeepDCA) in the context of an Intrusion Detection System (IDS) to classify IoT intrusion and minimize false-alarm generation. However, their scheme only applied one dataset and extracted too few beneficial features, which made the results unconvincing. Kim et al. [
10] proposed a TTP classification method to improve classification accuracy of cyber-threat intelligence. However, they applied an overfitting strategy to achieve their goals, which was only effective for specific versions of the dataset. Once the dataset was changed or new data were added, their results were likely to be invalid. Ahmed et al. [
11] designed a 5G-enabled system, which consisted of a deep learning-based architecture that aimed to classify malware attacks on the Industrial Internet of Things (IIOT). However, all the above schemes [
6,
7,
8,
9,
10,
11] lacked classification indicators for attacks and were difficult to quantify.
In order to evaluate the security model, Huang et al. [
12] proposed a novel federated Execution and Evaluation dual network framework (EEFED), which allowed multiple federal participants to personalize their local detection models. However, their model required additional global detection models to assist in achieving good performance. Meira et al. [
13] presented an experimental study on the detection of unknown attacks with unsupervised learning techniques. However, the results showed that all their algorithms performed poorly in terms of precision. Li et al. [
14] proposed an evaluation model based on the variable weight theory and technique for order preference with an ideal solution (TOPSIS) method and introduced the temporal and spatial correlation attributes into the network attack effect evaluation index system. Qi et al. [
15] conducted cyber-attack analysis by constructing a knowledge graph. Kumar et al. [
16] calculated the impact of attacks on critical infrastructure by designing a regression equation. However, their models [
15,
16] had limitations in specific scenarios. In the field of web application security, Kumar et al. [
17] proposed a security durability evaluation scheme based on a hesitant fuzzy set, AHP and TOPSIS. In the field of engineering, Jiskani et al. [
18] used the grey clustering method to evaluate mining engineering security effectively. In the evaluation of indicators and uncertainty, the analytic hierarchy process had a wide range of applications [
19,
20,
21,
22,
23]. However, as mentioned in [
12,
13,
14,
15,
16,
17,
18,
19,
20,
21,
22,
23], there are still many problems with this process, such as the consistency of the pairwise comparison matrix and the determination of the stratification index.