An approach for the information systems security situation assessment based on an improved FAHP and Bayesian network was proposed to solve the problem of obtaining the risk grade.The improved FAHP was used to quantify the factor of attack severity which was hard to scale.Simultaneously

the conditional probability matrices for all fac-tors were defined with the expert knowledge.Then a model for information security situation assessment was established by the Bayesian network inference

and the corresponding approach was presented.Finally

an illustrative instance was given to demonstrate its rationality and feasibility.Thus it may provide a new way for assessing information systems security situation.