# Ontology-Based System for Dynamic Risk Management in Administrative Domains
## 5 Proof of Concept and Validation  
In order to test the capabilities of the system, it has been subjected to several tests. First, the system has been tested with a large number of incoming threats, being capable of analyzing each one in an average time of 0.01 s. Then, the system was also tested with threats from more than one source of information, some with a high degree of confidence and others with a very low level. At the end of each analysis, a JSON document with the results is generated. An example of this kind of document is shown in Figure 9.  
Here, 126 threats were analyzed, which came from sources of information with a high level of confidence, and therefore, all of them were influenced by the confidence assigned to that source. As can be seen, there is a considerable difference between the general risk for Spain (riskSpain) and the risk when taking into account the history of attacks, that is, the memory of the system related to how old the attacks are by applying equation 5 (riskSpainWithMemory). If this situation were maintained over time, the risk with memory would end up converging with the instantaneous risk. In addition, the risk within an AC, i.e., Andalusia, is calculated based on 48 threats, both with and without memory.  
In order to simplify the visualization of the data produced by the system, a graphical interface was implemented by using Java's library JFreeChart. Figure 10 shows the history of the general risk in Spain, both with memory and the instantaneous one.  
Figure 9: Example of JSON generated at the end of a measurement.  
As can be observed, the risk with memory tends to follow the trend of the instantaneous, but if the variations are very fast, it tends to represent the average of these. The strongest peaks of memory risk are due to the fact that certain measurements are composed of a large number of threats and, therefore, great representativeness. The history described in Figure 10 is composed of 36 risk measurements, each generated with a range of threat events from 100 to 500. Each threat event has been compounded by its geographic location, IP, a timestamp, severity index, the event confidence, name of the detected threat, etc. The threats simulated were balanced in terms of impact level and confidence in the source of information. This is why the instantaneous trend, represented by the red line, has such pronounced peaks.  
The system also provides the analyst with a detailed asset histogram, which can be grouped by a specific AC, as Figure 11 shows. Finally, the risk in real-time can also be observed. In this sense, Figure 12 shows the risk in real-time as measurements are produced.  
Figure 11: Visualization of the histogram of the risks of the different autonomous communities (ACs). The upper section offers a selection menu to determine the temporal analysis window, in this case, 3 weeks. The second section allows you to select the administration you want to view, being able to select one or all ACs. The lower section shows the selected display. This example shows a histogram that includes all the ACs of Spain.  
Figure 10: Visualization of the risk history of Spain. The first section allows the analyst to select a temporary viewing window, in this case, 3 weeks of risk history. The second section offers the option of selecting the graph to be displayed; in this case, the grouped risk of Spain. Finally, the lower section shows the visualization of the selected data in the time window defined at the top, differentiating the instantaneous risk (square red), and the risk with memory (blue circle line).