# A Dynamic Risk Assessment and Mitigation Model
## 4 Methodology
### Dynamic Risk Assessment
#### 4.3.2 Dynamic and Proactive Threats Assessment  
The second core component of our model is the Bayesian network, which plays a critical role in generating proactive and dynamic threat assessments by incorporating the EPSS scores along with the identified risk scenarios. Given that EPSS values are inherently scaled between 0 and 1, reflecting the probabilistic nature of the EPSS model, no additional normalization is required before integrating them into the Bayesian network. Furthermore, as the EPSS model provides exploitation likelihood estimates for the upcoming 30 days, these scores inherently support proactive threat assessment.  
A Bayesian network is defined as \(N=\{G,P\}\), where \(G=\{V,E\}\) represents the structure of a Directed Acyclic Graph (DAG), with \(V\) as the nodes and \(E\) as the directed edges, and \(P\) denotes the parameters corresponding to the probability distributions of \(V\)[17], typically expressed through Conditional Probability Tables (CPTs). In our model, the Bayesian network structure incorporates two types of nodes: (\(T\)) _threat nodes_, which represent potential threats exploiting CVEs linked to assets, and (\(A\)) _asset nodes_, which denote the assets that attackers may target using the associated threats.  
The construction of the Bayesian network is facilitated by our second module, which is responsible for generating distinct risk scenarios based on the detected vulnerabilities, the target's network topology, and the potential movements of the attacker within it. These risk scenarios are incorporated separately into the Bayesian network, facilitating the generation of dynamic and proactive threat scores for each identified CVE across all risk scenarios.  
Once the structure is defined, the CPT parameters are established. The CPTs for \(T\) nodes are populated using the EPSS scores retrieved for each identified CVE. Two states are defined to represent the likelihood of an exploitation during an attack: S0 (non-attack) and S1 (attack). These states correspond to the relative probabilities of exploitation or non-exploitation. For example, a threat with an EPSS score of 0.8 is interpreted as having a 20% probability of being in the S0 state (non-attack) and an 80% probability of being in the S1 state (attack). The \(A\) nodes are determined by analyzing the network topology and attacker movement in conjunction with the \(T\) nodes for each risk scenario.  
Our model leverages the logic gates proposed by [PERSON] [25] to compute the conditional probability distribution for each node within the Bayesian network. This framework employs two types of gates, \"AND\" and \"OR\", to address cybersecurity-related events. The \"AND\" gate is used when all associated cybersecurity events must occur for a security incident to materialize, whereas the \"OR\" gate is applied when a single event is sufficient to trigger an incident.  
Since, our methodology generates multiple distinct risk scenarios in cases where an asset possesses multiple vulnerabilities exploitable by various threats, or when an attacker can reach an asset node via multiple distinct pathways, the \"OR\" gate is not employed within our methodology. Instead, the CPTs of the Bayesian network rely exclusively on the use of the\"AND\" gate.