# Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review
## 4 Results
### Mathematical Model Methods
Their model is based on eight vectors:  
1. System characterisation--environment to be assessed. 2. Asset identification--critical assets to be protected, their value, container, and custodian. 3. Threat analysis based on the system's surroundings. 4. Vulnerability analysis--the system's overall vulnerability and critical components which are vulnerable. 5. Threat-vulnerability pair (TVP)--matching a threat to a vulnerability. 6. Control analysis--effectiveness of current counter-measures. 7. Likelihood, defined as the probability of a threat to exploit a vulnerability of an asset, also taking into account the available counter-measures, which are graded based on their effectiveness. 8. Impact analysis, which is proportional to the value of an asset. Simulation results showed that a system's security risk exposure depends on the complexities of infrastructure interdependencies and the applied counter-measures. A model which is based on an ontology was presented by [PERSON] et al. [46]. The model collects information about assets and threat events for a specific administrative domain in order to evaluate them and present them by utilising an ontology language (OWL). In addition, the model uses a semantic reasoner (SWRL) in order to create security-related rules and to calculate the risk of a specific device or an operating system for a specific asset. The model uses simple equations to calculate the total risk of the respective administrative domain. The authors conducted a case study to show that their model is able to calculate the total risk in real time and that this risk depends on the number of threats. [PERSON] et al. [47] developed a fuzzy fractional differential equation-based method for dynamic real-time network security risk detection. Accordingly, a quantitative network risk model based on antibody concentration is applied in order to assess the risk. A tolerance method is used in order for the system's false positive rate to be reduced. The authors carried out an experiment in a network security attack and defence laboratory, using 40 computers and simulating 20 kinds of attack, to prove that their proposed model can quantitatively analyse the network's current security state in real time. [PERSON] et al. [48] introduced a model based on a dynamic offensive/defensive game in order to evaluate quantitatively systems' risk at CPSs. The authors used equations to describe both the attacker's and defender's actions. The model considers constraints on both sides, such as the quantity of resources available, their distribution, cost effectiveness, and the number of attacked nodes. The model is built based on the logic that both the attacker and the defender try to maximise their benefits by adjusting their resource allocation. Simulations showed that their success depends on their resource allocation strategy. A different approach for DRA calculation in fog computing was presented by [PERSON] et al. [49]. More specifically, the authors proposed a model composed of three entities: a fog computing provider, an attacker, who belongs to an APT (advanced persistent threat) group, and a cyber insurer. The model shows that in order for the fog provider to prevent potential losses due to successful cyber attacks, a dynamic subscription to the cyber insurer for each fog node is necessary. The model uses mathematical formulas to calculate the probability of a successful APT attack/defence and the expected payoffs accordingly. A model addressing cybersecurity-related risks in nuclear power plants was recommended by [PERSON] et al. [50]. The model employs mathematical formulas and equations to calculate the system's state at any given time, along with computing the expected rewards for game theory-based cyber attack modelling, providing a quantitative approach to risk assessment. [PERSON] et al. [51] suggested a quantitative and DRA framework aimed at analysing threats and vulnerabilities in AC/DC hybrid transmission systems under coordinated physical- cyber attacks with the use of CVSS scoring.