# Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review
## 4 Results
### Artificial Intelligence/Machine Learning
#### 4.1.2 Attack Trees  
[PERSON] et al. [PERSON] et al. (2018) presented a security metrics model, which is used for the assessment of risk in distributed information systems. The model takes into consideration the topological dependencies, the severity of attack actions, the skills of adversaries, and the current security state of the system (events, security level, attack surface). The system is able to calculate both static and dynamic risk. The dynamic (performance-based) risk is based on real-time data. This technique uses an external vulnerability database along with the target environment's network topology to generate attack graphs, and combines the latter with information from the IDS in order to dynamically calculate the attacker's position and their possible network path. A quantitative risk assessment methodology based on attack-defence trees (ADTs) was recommended by [PERSON] et al. [PERSON] et al. (2018), taking into consideration both the attack cost and the defence cost. The overall idea is to build the ADT based on the description of the system's vulnerabilities. The model is capable of calculating many variables such as cost of attack/defence, probability of success, impact cost, revised attack cost, revised impact, etc. (revised means that counter-measures are applied). The authors implemented a case study for a SCADA system to demonstrate that the revised attack cost, i.e., what the attacker needs to spend, increases when the counter-measures are applied. Accordingly, the revised impact is reduced. A model aiming to evaluate the current and the future security posture of an enterprise's computer network was introduced by [PERSON] et al. [PERSON] et al. (2018). In order to forecast how the security posture of the network will vary over time, the authors construct an attack graph that captures the interdependencies of all vulnerabilities discovered in the enterprise software. The model determines the initial value of a vulnerability and how this value will develop over time by taking into account the characteristics of the CVSS metric framework. Incorporating the prior analysis (relationships between various network vulnerabilities), they use a Markov model to explain the attacks. The probability that the attacker would succeed in their objective is expressed using a probabilistic path. Although the proposed model is used as a predictive model, it can be used to assess the current risk of an enterprise in a quantitative manner. A case study showed that the proposed model was able to visualise and objectively evaluate network security. [PERSON] et al. [30] presented a model in order to bridge the gap between technical and organisational risk in ICT systems. In their work, they introduced two primary concepts: elementary risk (ER), which pertains to a single detrimental incident affecting a strategic asset, resulting from a possible technical attack scenario which involves a singular supporting asset, e.g., a server; and composite risk (CR), which aggregates the ER based on a specific criteria (technical or organisational, based on specific detrimental events). Their proposed model consists of:  
1. An attack graph generator, which takes into consideration the system topology along with a vulnerability database, such as NVD. 2. \"Elementary risk instantiation\" (based on attack graphs and the organisation's database, which includes information about assets, supporting assets, detrimental events, and mapping between them). 3. ER calculation (likelihood, impact). Likelihood of occurrence depends on the attack scenario and the affected vulnerabilities and it is calculated with the use of Markov modelling. Impact depends on the consequences of the attack scenario. 4. CR calculation (aggregation of ERs). 5. Analysis of results. By conducting a case study of a medium-sized ICT system, the authors were able to show how the proposed model can dynamically quantify an organisation's risk, and that the concept of ER and CR improves the organisation security posture. [PERSON] et al.