# A Dynamic Risk Assessment and Mitigation Model
## 3 Related Work
ER calculation, where likelihood is determined via Markov modeling and impact reflects the consequences of attack scenarios. 4. CR calculation by aggregating ERs. 5. Result analysis. [PERSON] et al. [22] proposed a framework to quantitatively analyze cyber risk scenarios in parts of IoT-based smart grid systems. The model is based on the attack-defense trees framework, which is used to calculate key risk metrics. In addition, the method provides risk sensitivity analysis to evaluate different attack scenarios, enabling the optimization of risk strategies and minimizing the estimated risk. The validity of the proposed model is demonstrated through a real-world smart building energy efficiency application. [PERSON] et al. [23] propose an attack graph model designed to quantify risks associated with various distinct attack paths within a network. Each attack path is treated as an independent attack scenario, spanning from the attack source to the target. By estimating the likelihood of an attacker exploiting specific vulnerabilities and assessing the potential impact in monetary terms, the model facilitates the identification and prioritization of high-risk paths. A genetic algorithm is utilized to explore the extensive range of possible attack paths. [PERSON] et al. [24] introduced a dynamic risk assessment methodology to quantitatively evaluate risk in Cyber-Physical Systems (CPS). The model incorporates vulnerability nodes and machine nodes, representing systems accessible to attackers upon exploiting vulnerabilities. Initial probabilities of exploitation are calculated using the CVSS exploitability equation. Conditional Probability Tables (CPTs) are constructed using logic gates, as described by [PERSON] et al. [25]. These elements, combined with the network topology, enable the estimation of posterior probabilities, which are further integrated with impact assessments to determine risk. The authors employed GeNIe to simulate the model and assess its accuracy. [PERSON] et al. [26] developed a risk assessment approach for smart sensor environments that combines business process management with established security standards and frameworks. The model utilizes the CVE-CWE-CAPEC pathway to evaluate the likelihood of successful attacks based on identified CVEs. These likelihoods are then qualitatively combined with their impact on the Confidentiality, Integrity, and Availability (C-I-A) attributes to calculate overall risk. [PERSON] et al. [27] propose a hybrid threat hunting and dynamic risk analysis methodology for CPS. The authors leverage the CVE-CWE-CAPEC pathway to associate identified vulnerabilities with attack patterns, enhancing threat modeling. The CVSS framework is utilized to evaluate vulnerability severity by incorporating exploitability and impact metrics. Additionally, the study introduces an automated threat occurrence estimation approach based on CVE data, asset type, vendor, and historical exploitability trends. The overall risk assessment is derived by integrating threat occurrence, vulnerability severity, and system-specific C-I-A requirements. [PERSON] et al. [28] proposed a cybersecurity risk assessment model tailored for ICS. The model incorporates known vulnerabilities along with CAPEC framework to construct potential attack pathways. It then utilizes Fuzzy Cognitive Maps (FCM) alongside the CVSS framework to calculate the system's overall risk exposure. [PERSON] et al. [29] proposed a Dynamic Risk Management Response System (DBRMS) designed to quantify risks and generate response plans to address cyber threats dynamically. The system employs an attack graph generator, which uses data on device connections, a vulnerability inventory, and a business model (e.g., critical assets) to identify possible attack scenarios. Markov chains estimate the likelihood of attack success based on the difficulty of exploiting vulnerabilities, while impacts are calculated from the consequences on critical business devices.