Cyber-physical systems (CPS) are vulnerable to network attacks because communication relies on the network that links the various components in the CPS. The importance of network security is selfevident. In this study, we conduct a network security risk assessment from the perspectives of the host and the network, and we propose a new framework for a multidimensional network security risk assessment that includes two stages, i.e., risk identification and risk calculation. For the risk identification stage, we propose a multidimensional hierarchical index system for assessing cybersecurity risk; the system's security status is determined in three dimensions, i.e., basic operation, vulnerabilities, and threats, and these dimensions guide the data collection. In the risk calculation stage, we use a hidden Markov model (HMM) to assess the network security risk. We provide a new definition of the quality of alert and optimize the observation sequence of the HMM. The model uses a learning algorithm instead of setting the parameters manually. We introduce the concept of network node association to increase the reliability and accuracy of the risk assessment. The simulation results show that the proposed index system provides quantitative data that reflect the security status of the network. The proposed network security risk assessment method based on the improved HMM (I-HMM) reflects the security risk status in a timely and intuitive manner and detects the degree of risk that different hosts pose to the network. INDEX TERMS Hidden Markov model, network node correlation, network security risk, risk assessment. I. INTRODUCTION Cyber-physical systems (CPS) are complex systems that use sensors, computing and network technology for computation, communication and control to link the physical world and the network. Since the communication of the CPS relies on a network, CPS are plagued by security issues [1], [2]. Malicious activities that specifically target networks [3], [4] and security incidents are occurring with increasing frequency [5]. The types of network security incidents [6] include information system vulnerabilities, phishing, and malicious programs [7]. There are two reasons for the occurrence of network security incidents [8]. First, weak links exist in the network system [9] and second, the emergence of various automated attack tools has caused a sharp increase in intrusions into network systems [10], [11]. The associate editor coordinating the review of this manuscript and approving it for publication was Zhen Ling.