Abstract: Based on cost-benefit analysis and the “level higher than relation” PROMETHEE multi-criteria preference index，an information security risk control model is put forward.Given the preference function，the criteria values and criteria weights of decision-makers，“edge flow” and “inferior flow” of each preparation program is calculated to compare advantages and disadvantages of control measurements，then the partial or complete sequence is obtained.The sensitivity analysis and validation are conducted further.Finally，an example is given to illustrate the application of the proposed method.

摘要： 在成本效益分析的基础上，引入“级别高于关系”的PROMETHEE多属性偏好指数，提出了基于PROMETHEE方法的信息安全风险控制模型。该模型利用决策者给出的偏好，设置偏好函数、准则值和准则权重，从方案优劣程度入手，计算备选方案的“优势流”和“劣势流”，得到方案集的部分或完全排序，并基于此对安全控制措施的备选方案进行有效地筛选。还对该模型的灵敏度进行了分析和验证，最后结合实例分析了该风险控制模型的有效性。