# Cybersecurity Risk Assessment in Smart City Infrastructures +
## 4 The Neural Network Model for the Cybersecurity Risk Assessment
To solve the problem of assessing cybersecurity risks, the network parameters of the smart city nodes (such as the interaction with other nodes) and economic indicators (for example, the value of an asset) are used as input variables, and the assessment result (acceptable or unacceptable) is used as output variables. The unacceptable level of risk suggests that measures need to be taken to improve the security of the large-scale smart city network. The input layer is used to enter the training  
Figure 12: The proposed methodology for the cybersecurity risk assessment. data, the hidden layers transform the raw data into multidimensional nonlinear objects, and the output layer classifies the data. The input layer consists of neurons that take cybersecurity risk measurement indicators as the input vector. Low-level elements from the original input are abstracted into the high-level elements through multiple hidden layers. There is only one neuron in the output layer, representing the level of the cybersecurity risk (acceptable--0 and unacceptable--1). One of the most important steps in training a neural network is preparing datasets. To solve the problem of assessing cybersecurity risks, datasets collected in smart city networks and containing various types of assets, network traffic, and the level of cybersecurity risks are needed. The analysis showed that today there are no datasets that meet such requirements, so it was decided to build our datasets in a synthetic manner applying the network simulator NS-3. In the NS-3 environment, a large-scale dynamic network was built, and such smart city systems as VANET, MANET, IoT, and IIoT were simulated in a single complex. During the simulation, the following network attacks were implemented in the NS-3 network model: black hole (BH), gray hole (GH), DoS, DDoS, and wormhole (WH). This choice is due to the fact that in dynamic networks with peer-to-peer architecture, the problem of attacks aimed at disrupting the dynamic routing is acute [42]. All of these intrusion test cases are related to the types of devices that they can affect. Table 1 shows the features that were extracted during the modeling and included in the datasets. The device types were identified, and this allows us to avoid the exact enumeration of the ever-growing number of connected devices. Types of devices accumulate devices that perform the same functions in the system, as well as interact and exchange messages with the same number of devices of another type. For a risk assessment, the types \(T=\{T_{i}\}\) of the smart devices were obtained, where \(1\leq i\leq n\), \(n\) is a number of the allocated types of devices. \(|T_{i}|=n_{T_{i}}\) is a number of devices of type \(T_{i}\). For each device, its cost was determined. The parameter \(Q_{Tk}\) shows the size of the possible damage during the implementation of the threat. The amount of damage is expressed in monetary units. The cybersecurity threats for the smart network environment \(U=\{U_{j}\}\), \(1\leq j\leq m\), also were denoted, where \(m\) is a number of the identified security threats. It is also necessary to determine the correspondence of \(U_{j}\in U\) threats with the types of \(T_{i}\in T\) devices that are the subject of these threats. To correspond to the specific features of the dynamic networks, the special coefficients \(I_{TITK}\) and \(C_{TITK}\) are used. \(I_{TITK}\) is the coefficient of influence of the devices of the type \(T_{i}\in T\) on the devices of the type \(T_{k}\in T\). To calculate it, the communications are analyzed between