Abstract: A risk assessment model that based on D-S evidence theory is proposed to solve the problems about the security risk of network information systems.Evidence theory is a reasoning method of processing uncertainty.First “discount ratio” is used to improve Demspter’s rule of combination of evidence and then the improved Demspter’s rule of combination of evidence is used to combine the risk factors of network.It reduces the uncertainty of risk factors.And an example is given to verify the application of this model to network risk assessment and the simulation result shows the correctness of the algorithm.Finally，it is verified that evidence theory had higher accuracy than fuzzy comprehensive evaluation method.