# Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review
## 4 Results
### Mathematical Model Methods  
Models in this category utilise mathematical equations as their primary analysis method. An automated risk quantification approach for computing infrastructures was suggested by [PERSON] et al. [40]. The risk score is defined as a product of:  
* conditional probability of threat, which is calculated based on real-time traffic logs extracted from the IDS over a specific time period;
* evaluation of the severity of each threat from the administrator;
* a constant weighting factor which ensures that threats with higher severity would always have higher impacts (compared with threats with lower severity). The authors tested their model using the seven most frequently occurring threats, which were found in the collected log sample, to show that values of the specific threats in the proposed model were different compared to values in other approaches, such as snapshots, which only represented the value of the threat at a specific time slot. Their model also provided a clear picture about pre- and post-variation trends in threats. They concluded that their model can help a network administrator to evaluate potential threats effectively. A similar framework was introduced by [PERSON] et al. [41] to calculate the risk score of a specific host on the network based on the software running on it. This framework uses a formula which takes into consideration the conditional probability of a threat, which is calculated from real-time data extracted from the IDS, the severity of the specific threat, and a weighting factor (from the administrators' evaluation), in order to calculate the risk score quantitatively for a specific time period. By using real-time logs, the authors proved that the risk associated with different software applications fluctuated over time. A model to quantify the risk of network's vulnerabilities was proposed by [PERSON] et al. [42]. The model considers how a node is exposed to an untrusted network (danger zone), the applied security mechanisms, and the CVSS values of all vulnerabilities at a specific host, in order to calculate the adjusted vulnerability score for this host. The final risk of a host is the combination of the adjusted vulnerability of this host and the adjusted vulnerabilities values of its neighbours. The total risk of the network is calculated by aggregating the risk of each host. The authors used a network simulation to prove that the total risk of the network was reduced much more by eliminating the top vulnerabilities ranked by their model compared to the elimination of the top vulnerabilities ranked by the CVSS. Two almost similar models were presented by [PERSON] et al. [43] and by [PERSON] et al. [44] for risk calculation. The first model applies on \"energy internet infrastructure\" and the second on a computer network. Both of them depend on:  
* Asset identification, which is based on experts' opinions. * Estimation of the dynamic threat, which is based on the rolling mechanism algorithm, according to which a dynamic threat value is calculated based on historic past events, similar to conditional probability. * Vulnerability identification and scoring, for example, based on CVSS. * Security relations between assets, which depend on the dependency structure matrix (DMS) technique. According to DSM theory, there are three types of dependency relationships: 1. Parallel relationship: the functions of asset A do not affect asset B. 2. Sequential relationship: the functions of asset A affect asset B, but the functions of asset B do not affect the function of asset A. 3. Coupled relationship: the functions of asset A and asset B depend on each other. * Overall risk estimation, which is based on the propagation or conduct effect. Both models illustrated their proposed approach with an example. [PERSON] et al. [45] proposed a model to address risk dynamically in CI environments (such as the energy sector and its supporting technologies), based on causal-loop diagrams, which are used to describe interdependencies between systems' key variables.