【摘要】 信息系统安全风险评估能够协助风险管理人员对风险进行优先排序，分配重新限制的资源来减轻风险，并做出进一步的防御决策。本文主要从分析网络及信息系统中重要威胁因素入手，通过多态系统事件树，反映不同威胁风险因素可能导致的不同状态，在此基础上构建贝叶斯网络，实现对系统的风险评估，以检验由这些威胁引起的网络安全问题处理机制，达到识别威胁、区分风险优先级的目的，有助于在不同威胁风险下安全策略的制定。更多还原

【Abstract】 Information system security risk assessment can help risk managers prioritize risks, allocate re-restricted resources to reduce risks, and make further defense decisions. In this paper, the important threat factors in network and information system are analyzed, and different states caused by different threat risk factors are reflected through polymorphic system event tree. On this basis, Bayesian network is constructed to evaluate the risk of the system, so as to test the handling mechanism of network security problems caused by these threats, achieve the purpose of identifying threats and prioritizing risks, and contribute to the formulation of security policies under different threat risks.更多还原