Abstract: A risk assessment model that based on D-S evidence theory is proposed to solve the problems about the security risk of network information systems.Evidence theory is a reasoning method of processing uncertainty.First “discount ratio” is used to improve Demspter’s rule of combination of evidence and then the improved Demspter’s rule of combination of evidence is used to combine the risk factors of network.It reduces the uncertainty of risk factors.And an example is given to verify the application of this model to network risk assessment and the simulation result shows the correctness of the algorithm.Finally，it is verified that evidence theory had higher accuracy than fuzzy comprehensive evaluation method.

摘要： 针对网络信息系统的安全风险评估问题，提出了基于D－S证据理论的风险评估模型。证据理论是一种处理不确定性的推理方法。首先用“折扣率”对Dempster合成法则进行了改进，然后使用改进后的Dempser合成法则对网络中存在的各种风险因素进行合成，减少了风险因素中的不确定性，并以实例验证了该模型在网络安全风险评估中的应用，仿真结果证明了该算法的正确性。最后，通过与模糊综合评判法进行比较验证了证据理论具有更高的准确性。