# Educational Organization's Security Level Estimation Model
## 2 Related Works
### Security Risk and/or Security Level Quantitative Estimation Methods  
A Common Vulnerability Scoring System (CVSS) [15] is one of the data sources for quantitative security risk measurement. It provides access vector, attack complexity, privilege necessity, impact, temporal and environment metrics, qualitative rating scale, and other data for stored security vulnerabilities. Therefore, this data can be incorporated for security risk quantitative measurement. For example, [PERSON] et al. [16] use CVSS as a source to estimate the frequency and impact of vulnerabilities. Meanwhile, [PERSON] and [PERSON] [17] use CVSS metrics and additionally take into account vulnerability lifecycle to measure the risk. Multiple authors incorporate CVSS data to express security risk levels [18; 19; 20]. However, those methods are oriented on the target of interest--one specific system, device, etc. To achieve higher accuracy, the complexity and interconnection must be taken into account.  
One example of interconnection incorporation in information security risk measurement is information security management controls [21]. This is necessary when multiple controls must be applied to the same situation and a balance between them must be achieved.  
Another way to present the interconnectivity is the usage of attack trees or graphs. This approach is very popular to present dependencies between elements [22; 23; 24; 25; 26; 27]. Since the attack path analysis via an attack tree or graph security risk assessment can incorporate an analysis of consequences as well to investigate the relationship between different threats. However, the usage of attack trees or graphs in situations with multiple elements becomes very complex and time-consuming.  
Most advanced and difficult risk assessment models utilize statistical modeling techniques that incorporate machine learning algorithms and long-short term dependencies. Machine learning algorithms allow deeper data analysis compared to other security systems [28]. Further, data analysis, simulation, and traffic monitoring become one of the ways to detect anomalies. Theoretically, local and wide area network traffic follow the asymptotic self-similarity model. Consequently, self-similarity, long-short term dependencies, and autocorrelation can be measured by estimating the Hurst parameter [29]. As authors discuss [30], these approaches can improve the detection ability of vulnerability effectively. However, its application requires statistically sufficient data.  
Other directions to simplify the security risk assessment and maintain the analyzed area complexity are fuzzy logic and multi-criteria decision-making solutions. Fuzzy logic helps to solve the problem of value assignment to some security or property level [31; 32]; however, fuzzy cognitive maps can be used to present the interconnectivity of the situation [33]. Meanwhile, multi-criteria decision-making solutions solve the problem of quantitative metrics, composed of multiple criteria [34; 35; 36]. While most information security risk assessments require security expert's interpretation, the multi-criteria decision making usually is based on weighting some criteria; therefore, together with data gathering solutions, it can be used by non-experts in the security area.