# A Dynamic Risk Assessment and Mitigation Model
## 3 Related Work  
[PERSON] et al. [15] proposed a quantitative model for assessing the cybersecurity risk of firms, utilizing a hierarchical Bayesian network to evaluate security posture. Within this framework, the influence of vulnerabilities is mapped to the overall risk score based on threat information, such as breach statistics. By leveraging Bayesian inference, the model enables dynamic risk assessment, allowing firms to update their risk evaluations. The effectiveness of the proposed methodology is validated through its application in a network security environment, demonstrating its ability to assess cyber risk. [PERSON] et al. [16] proposed a model for quantitatively assessing risk in Industrial Production Systems by evaluating the likelihood and impact of abnormal events. The model combines two key components--probability inference and loss calculation--to deliver real-time risk evaluations. By utilizing an Extended Multilevel Flow Model (EMFM), it quantitatively represents the production process, facilitating the prediction of the consequences of abnormal events. A Bayesian network, built upon the EMFM, is employed to estimate the probabilities of such events, integrating predefined control strategies and data from an Intrusion Detection System (IDS). [PERSON] et al. [17] proposed a method for quantifying cyber risk in Industrial Control System (ICS) environments. This approach integrates real-time attack evidence into a Bayesian network, which is enriched with ICS security knowledge, including vulnerabilities, system functions, potential accidents, and critical assets. The Bayesian network generates probabilities of event occurrences, which are combined with impact assessments to compute real-time risk. [PERSON] et al. [18] introduced a model for dynamically and quantitatively assessing network risks. Using a vulnerability scanner to detect system weaknesses, the model employs a Bayesian network to capture relationships between vulnerabilities and extends the CVSS framework by considering asset criticality, current damage, and inter-vulnerability effects. Additionally, a Hidden Markov Model is used to dynamically evaluate exploitation likelihoods based on observations from intrusion detection systems and firewalls. Risk is estimated by identifying probable exploitation paths and their impacts. [PERSON] et al. [19] proposed HPCvul, a novel framework for vulnerability and risk assessment in High-Performance Computing (HPC) networks. Using the NVD repository, CVSS scoring, and other tools like IDS, HPCvul deploys agents within HPC sub-networks to gather system data, including configurations, services, software, and topology. A Bayesian network performs real-time risk assessment by analyzing vulnerabilities and their dependencies, identifying potential attack paths, and estimating the likelihood of compromise. Quantitative risk metrics are provided to support security decisions. [PERSON] et al. [20] proposed a model to assess the current and future security posture of an enterprise network. To predict how security will evolve over time, the model constructs an attack graph capturing the inter-dependencies of identified software vulnerabilities. Using CVSS metrics, it determines the initial severity of vulnerabilities and their progression. A Markov model is then applied to explain attack scenarios, with success probabilities represented as probabilistic paths. [PERSON] et al. [21] proposed a model to bridge the gap between technical and organizational risk in information and communication technology systems. They introduced two key concepts: Elementary Risk (ER), representing the impact of a single technical attack on a strategic asset (e.g., a server), and Composite Risk (CR), which aggregates ERs based on specific criteria (technical or organizational). The model includes:  
1. An attack graph generator using system topology and a vulnerability database (e.g., NVD). 2. ER instantiation, leveraging attack graphs and organizational data on assets, supporting assets, and detrimental events. 3.