# Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review
## 4 Results
### Artificial Intelligence/Machine Learning
#### 4.1.1 Bayesian Networks  
[PERSON] et al. [16] proposed a mission assurance policy, that adapts to the dynamic security status of all assets using a Petri net model along with binary or multilevel logic decision, to determine the security status of cyber assets. The main goal of the proposed model was to determine if a mission could be completed. Mission assurance policy is the continuous assessment of cyber assets which are necessary for an organisation to fulfil specific tasks. Assets fulfil certain tasks, which accomplish specific missions accordingly. This quantitative model is based on a risk management policy which consists of five steps:  
1. Assets' vulnerability assessment, based on a vulnerabilities database such as the NVD. 2. Identification of likelihood and threats, based on data from the intrusion detection system (IDS). 3. Determination of impact and counter-measures (cost-benefit analysis). 4. Quantitative risk assessment using Bayesian networks. 5. Risk assessment evaluation (risk mitigation options and prioritisation). According to the authors, their proposed model can give a clearer picture to decision-makers about their system in real time. Its application was demonstrated through a simple example. Another model was presented by [PERSON] et al. [17] to dynamically and quantitatively assess risks on networks. This model requires the use of a vulnerability scanner in order to detect vulnerabilities of the examined system. A Bayesian network is then used to capture relationships between detected vulnerabilities. The authors then use the common vulnerability scoring system (CVSS) model and expand it by taking into consideration the criticality of an asset's mission, the current damage of an asset (the impact of an attack on a specific asset), and how this vulnerability is going to affect other assets' vulnerabilities. They also use a hidden Markov model (HMM) and Bayesian networks to dynamically model cyber operations, events, and observations (originating from IDS, firewall, etc.) in order to use them to assess dynamically the exploit likelihood in the network. Risk is estimated by pinpointing the most likely path of exploited vulnerabilities, their likelihood of exploitation, and their associated impacts. The authors perform a simulation utilising synthetic data to demonstrate that, given the vulnerabilities of a network, their model is able to quantify and assess risk. [PERSON] et al. [18] introduced a dynamic quantitative RA approach which models both the system (software, hardware, network) and the human factor. The authors used Bayesian networks in order to analyse and assess the cyber risks (low-medium-high) along with direct acyclic graphs (DAGs) to represent the connections between nodes. This model, which is built using experts' opinions to define the risk variables of the system (in this case a structured query language (SQL) server), takes into consideration the dependencies between cyber assets and their interactions with the respective events in order to quantify assets' vulnerabilities, the impact of attacks, and the risks. The authors demonstrated its application in a scenario that included an SQL injection attack. [PERSON] et al. [19] recommend a multilevel Bayesian network to describe the propagation of the risk caused by cyber attacks. It consists of an incident model, a function model, and an attack model. In addition, a novel multimodel-based approach to assess the cybersecurity risk for ICSs is developed. This approach can determine the current cybersecurity risk value by estimating probabilities and quantifying the consequences of numerous potentially hazardous scenarios arising from malicious attacks. The model uses both offline and online/real-time data. The offline data originate from vulnerability scanners, statistical analysis, experts' opinions, and they are used to determine the probabilities of an attack, the dependencies between functions, the relations between incidents, and the risk propagation.