Abstract: With the advent of the information age, information security issues become increasingly complex and diverse, so a costeffective solution should be badly in need. Based on the previous research, this paper further improves the application of Bayesian network model in information security risk assessment. Firstly, it analyzes the types of risk elements of information system, and puts forward a new method to determine the risk factors, that is, the common relationship between factors. Then, the information system index system is determined according to the factor relation. Combined with the conditional probability of experience accumulation, the Matlab Bayesian network toolbox (BNT) is used to construct a complete Bayesian network risk assessment model, which includes the analysis of the assessment process, the use of methods and the determination of risk levels. Finally, by analyzing the improved Bayesian assessment model, the probability of each level of risk is deduced according to experimental data. The simulation results are consistent with the actual results, which show that the improved evaluation method is effective and reasonable.

Key words: information security, risk assessment, Bayesian network, risk factors, risk grades