Abstract: Most traditional security risk assessment methods have the shortcomings of subjectivity and one-sidedness. Considering the risk analysis demand of vulnerabilities and attacks of network nodes, this paper proposes the concept of vulnerability reliability and attack reliability, and designs a reliability vector orthogonal projection decomposition method of network security risk assessment. First, this method associates vulnerability information which attacks relying on with vulnerability information of the node itself, and quantifies the security risk analysis from the node to the whole network, with the own weight of each node in the network. Second, in order to exclude the own uncertainties of vulnerability scanning tools and the unity of the data source, this method fuses several test results of scan tool, and constitutes the data source when calculating the vulnerability reliability. Finally, based on the idea of Euclidean space vector projection, the method puts forward an algorithm of reliability vector projection decomposition. The result of the experiment of the network security risk evaluation procedure is given to verify the proposed evaluate method.