# Ontology-Based System for Dynamic Risk Management in Administrative Domains
## 3 System Architecture  
The architecture presented is based on the use of ontologies. However, unlike the research works analyzed along the previous section, the proposed system aims to achieve effective feedback taking into account the context of the environment and past events, all this, handling a high flow of real-time data. To create a risk calculation system that can infer new information, it is first necessary to identify the elements involved in a dynamic risk management system:  
* Identification of assets, that is, determine relevant assets of the administrative domain;
* Evaluation of assets based on quantitative and qualitative values given to previously identified assets;
* Threat identification;
* Threat assessment by means of parametrization of them, both their impact on assets and the likelihood that they will materialize;
* Risk assessment, which points out the risk level of the system. In this way, a generic risk analysis schema could be followed, such as the one shown in Figure 1.  
However, identifying and modeling assets in detail of an administrative domain, e.g., a country, a sector, etc., both in terms of their quantity and diversity, and the vulnerabilities of those assets that can be exploited by threats, is a challenging task. Therefore, it has been necessary to define an architecture development methodology, which is presented in Figure 2.  
Figure 1: Generic risk analysis diagram followed for the development of the proposed architecture. As can be seen, the starting point is a generic analysis of the assets in the administrative domain, which are characterized by specific attributes. This information is modeled along with several events that arrive at the system representing different threats. In addition, the architecture proposed must handle a large amount of information from several kinds of sources, so it is necessary to use appropriate techniques to deal with it while maintaining its semantics. For this reason, a system based on ontologies has been chosen capable of structuring this information and also to infer new knowledge, in this case, the level of risk. Therefore, a key task of the proposed architecture is focused on collecting relevant information in order to identify and evaluate both assets and threat events, and modeling it using an ontology language for future reasoning. For this, we selected OWL, the most widely used ontology language currently defined by W3C. The asset modeling of an administrative domain for dynamic cybersecurity risk management has been structured in two main elements: citizens as human-being assets, and devices used by these citizens as technological assets. First, the different actors involved in the administrative domain have been defined in Table 1, with a classification according to their potential degree of exposure to cybersecurity risks. These actors (human-being assets) have been characterized by:  
* Actor's technical and technological knowledge and the importance of the devices managed for the actor. * Actor's cybersecurity knowledge. * Importance of the actor within the framework of the administrative domain.