# Ontology-Based System for Dynamic Risk Management in Administrative Domains
## 4 Formalization of the Architecture
\[RiskCountry_{j}=\frac{\sum_{i}RiskAC_{j,i}*Asset_{i}}{\sum_{i}Asset_{i}} \tag{1}\]  
Figure 6: Example of a Semantic Web Rule Language (SWRL) rule for risk calculation. Figure 7: High level scheme of system operation. In an AC, the weighted sum of assets, as specified in the initial configuration, will result in the risk of AC. Thus, the risk throughout the national territory will be obtained according to Equation (2). \[Risk_{Spain}=\frac{\sum_{i}RiskCountry_{i}*Asset_{i}}{\sum_{i}Asset_{i}} \tag{2}\]  
Although these operations determine the risk associated with Spain, they are useless for calculating the risk related to an AC or to an asset within an AC. This is due to the fact that (1) and (2) do not model that threats materialized in a given AC could be materialized within other ACs. In order to characterize this risk transfer, the correlation parameter \(\rho\) between AC is used, which indicates how much of the risk of the rest of the ACs affects the current AC analyzed. With this new appreciation, the risk of an asset \(j\) in an autonomous community \(k\) would be modeled by Equation (3). \[RiskAC_{jk}=\frac{Risk_{jk}*Asset_{k}+\rho*\sum_{i\
eq k}Risk_{j}*Asset_{i}}{ \sum_{i}Asset_{i}} \tag{3}\]  
In addition, the risk associated with an AC, \(k\), could consider the risk of the rest of the ACs according to Equation (4). \[RiskAC_{k}=\frac{Risk_{k}*Asset_{k}+\rho*\sum_{i\
eq k}Risk_{i}*Asset_{i}}{ \sum_{i}Asset_{i}} \tag{4}\]  
Nevertheless, previous equations only offer instantaneous risk calculations as they operate on a measurement made at a specific time. In order to take into account the results of previous measurements, the system has been enhanced with memory capability. When a measurement is made, the risk levels are calculated following the process described above, but also the measurements made in the past are taken into account, and through the use of a time function, a new risk level is computed, which is no longer instantaneous. This function must also take into account the age of each past measure to avoid the collapse of the calculation due to the continuous growth of the measurement history. For this, the configuration file defines a forgetfulness variable 3 that represents the number of temporary instants (seconds, milliseconds, etc.) that will determine when a measurement should be discarded, that is, the system memory. Equation (5) shows the function designed for this task. The behavior of (5) can be analyzed in Figure 4:0  
Figure 4:1  
As can be seen, as the measures analyzed get old, they are penalized by this function. It is also necessary to weigh the number of threats analyzed in each measurement since the greater the number  
Figure 4:2 Representation of the memory management function proposed for a time of 3600 s (\(\bar{s}=3600\)). of threats analyzed, the greater their representativeness in the histogram will have to be. The use of the function of time \(f(t)\) and the number of threats can be seen in Equation (6),  
Figure 4:3  
where \(t_{0}\) is the current instant of time and therefore \(f(t_{0})=1\). Finally, once a measurement has been made and all the risk calculations have been performed, the result must be stored. In this sense, all results generated by the system are specified following a specific JSON format. In addition, a graphical interface has also been developed for a better visualization of the information that will be seen in more detail in the following section.