## 1 Introduction  
The cyber physical system is a multi-dimensional complex system that integrates computing, the network and the physical environment, and it has a wide range of applications [1; 2]. When it comes to computing, many studies such as research on cloud computing have been conducted [3]. Furthermore, network security is also a rather significant component of cyber physical systems. The last few years have witnessed a burst in the exploration of network security, such as network security studies of SCADA (supervisory control and data acquisition) systems [4], the Internet of Things [5], software-defined networks [6], wireless sensor networks [7] and the smart grid [8]. Besides, many studies have researched the security of computer networks because of the emergence of a large number of cyber crimes, which are researched in many studies [9; 10]. To combat cyber crimes vigorously, studies regarding computer forensics [11; 12], virus prevention technologies [13], security visualization for computer network logs [14], intrusion detection [15], etc., have been performed in recent years. In addition, approaches of computer network security risk assessment are also of great significance to improve computer network security. There is a variety of approaches to assess the security of computer networks, such as game theory [16], RBF (radial basis function) neural networks [17], attack graphs [18], vulnerability correlation graphs [19], and so on. In [20], a quantitative measure of the security risk level of networks is proposed to assess network security. Firstly, the vulnerability scanning tool is used to scan the network to determine the vulnerability of each node in the network. Then, the probability approach is employed to calculate the overall security risk level of the sub-networks and the entire network. Besides, the (fuzzy) analytic hierarchy process is also used for network security assessment [21; 22; 23]. In this evaluation method, the index system of network security risk assessment is first established, and then, the (fuzzy) analytic hierarchy process is applied to obtain the final evaluation results. D-S evidence theory is also an effective tool for assessing network security risk [24; 25]. The index system of network security risk assessment is first needed. Then, based on the weights of indexes and the evaluation data of the bottom criteria (expressed by basic probability assignment (BPA)), D-S evidence theory is used to combine evidence from bottom to top to obtain the risk level of network security. Herein, it is worth noting that the key issue of network security risk assessment is how to deal with the uncertainty information. Many solutions such as fuzzy sets theory [26; 27; 28], rough sets theory [29], possibility theory [30] and D-S evidence theory [31; 32; 33; 34] can be applied to address the problem. However, to date, there is no universal and effective method of computer network security risk assessment. Of those studies that apply a comprehensive evaluation method to evaluate networks, only the weights of criteria are taken into account, and the weights of evaluation data are simply ignored. Therefore, a novel approach is proposed in this paper by combining subjective weights of criteria and objective weights of evaluation data under uncertainty. Based on the hierarchical structure of computer networks, subjective weights of all criteria and risk values of bottom criteria are given by experts. Then, by using an uncertainty measure \(iTU^{I}\)[35], the uncertainty values of bottom evaluation data are derived. Take the reciprocal of uncertainty values, and then, normalize them to get objective weights. After that, combing the subjective and objective weights and using [PERSON]'s rule of combination [36], the risk values of bottom criteria are fused to be the risk values of the upper level criteria.