# Ontology-Based System for Dynamic Risk Management in Administrative Domains
## 1 Introduction  
Risk management systems are important cybersecurity tools for monitoring different attributes of an interactive environment to determine possible vulnerabilities the environment is under and, therefore, the security state of the environment. Usually, these kinds of supervision systems are based on a specification of risk levels for the set of attributes analyzed, determining, finally, the actions that are required to alleviate the overall risk to the environment.  
Nowadays, risk management seeks to evolve the classical approaches of static risk analysis based on well-defined methodologies such as MAGERIT [1], which allow the characterization of an organization's risks. To do this, these approaches usually take a snapshot of the situation of the organization at a given moment, and then, security metrics and policies are generated. However, most of the parameters involved in a risk analysis are dynamic, constantly changing over time, so a static risk management approach can become obsolete quickly [2; 3].  
On the other hand, dynamic risk management systems attempt to adapt to these circumstances by including temporary variations in the elements that compose these analyses. Therefore, it is necessary to characterize these elements and their temporal variations and generate the appropriate outputs, often known as situational awareness systems. An example of the application of these dynamic systems isthe generation of metrics for calculating the level of risk in a global and complex environment, such as a country, a region, or a public sector [4; 5; 6]. In these cases, the environment's assets are unclearly defined as belonging to some administrative domain that operates with estimates of them.  
In this sense, this main contribution of the article is the proposal of a formal model of an administrative domain, where assets are fuzzily defined, in order to dynamically measure the risk level of the global administrative domain or specific subdomains. The formal model is based on an ontology that formally defines all the involved components of the administrative domain (assets, threats, etc.) in order to define the adequate security metrics (which are expressed as formal rules to be executed dynamically in a reasoning engine over the instances of that ontology), which dynamically calculate the different risk levels defined for the domain or subdomains. In addition, this research will provide a methodology for defining the environment's assets, taking into account the limitation due to the blurred definition of the administrative domain and, therefore, of the amount of assets to be analyzed.  
To address these objectives, this article presents a design of a system capable of handling several sources of information by means of a trustworthy, reliable management system capable of being replenished, generating new knowledge. To do this, the system will model the influence of the time elapsed since the appearance of each threat and its effect on the level of risk, while being able to represent it visually with understandable graphic display systems. Finally, in order to address the dynamism requirement, this proposed system will be able to operate in real-time.  
Therefore, first of all, this article will analyze the state of the art in similar systems and approaches in order to validate its applicability to the problem. Subsequently, the proposed architecture is defined, and the design, development, and validation of a prototype carried out in a real environment is detailed.  
So, with the purpose of presenting this paper's contribution, first, it will address an analysis of related works along Section 2. Then, Sections 3 and 4 detail the proposed system, presenting, first, the architecture design, and then an implementation prototype of it. In Section 5, a verification and validation process will be carried out. Finally, conclusions are pointed out in Section 6.