# Risk Assessment of UAV Cyber Range Based on Bayesian-Nash Equilibrium
## 5 Design of UAV Cyber Range Risk Assessment Method  
The game-theory-based approach to UAV range risk assessment, combined with NIST SP 800-30's risk assessment framework, during the risk analysis phase, is designed to identify threats, vulnerabilities, and assets that may affect an organization's objectives and assess the impact of these factors on the organization. By analyzing the game between attackers and defenders, the overall risk of a UAV range can be assessed. The overall risk includes not only the direct threat to assets from attackers, but also the possible cost and impact of defensive measures taken by defenders. Through a game-theory-based approach, the risk assessment of a UAV range is able to more fully consider the game between attackers and defenders, and how this game affects overall risk. Common information system risk assessment methods calculate the threat value based on the three elements of assets, threats and vulnerabilities. The calculation formula is as follows:  
\[R=(A,V,T)=R(L(A,V),P(V,T)) \tag{5}\]  
where \(R\) indicates threat value; \(A\) represents assets; \(V\) represents asset risk; \(T\) indicates threat type; \(L\) indicates loss due to threat; \(P\) indicates the likelihood of a threat. The commonality of information system risk assessment and UAV cyber range risk assessment is analyzed. Based on the security risk calculation formula of information system, the threat value is calculated based on the possibility of UAV security risk occurrence \(P(V,T)\) and the loss caused by the threat \(L(A,V)\). In this paper, the attack and defense game strategy model of the UAV cyber range is constructed by calculating the formulas of attack income and defense income in Section 3. By analyzing the historical data of attack and defense of UAV range, the prior probability of defender to attacker \(P_{D}=P(t_{A}|t_{D})\) and the prior probability of attacker to defender \(P_{A}=P(t_{D}|t_{A})\) are obtained, respectively. The benefits of both offense and defense are input into the model \(UAV-ADM\), and the game equilibrium \(\left(F_{A}^{*}(t_{A}),F_{D}^{*}(t_{D})\right)\) is calculated. According to the rational assumption of the offensive and defense game model, the defender and the attacker will choose the optimal strategy and keep it the same. Therefore, the prediction of the attack strategy of the defender to the attacker in the UAV cyber range can be represented by the mixed strategy Bayesian-Nash equilibrium of the offensive and defense game model \(F_{A}^{*}(t_{A})=\left\{f_{1}^{A^{*}}(t_{A}),f_{2}^{A^{*}}(t_{A}),\cdots,f_{n1} ^{A^{*}}(t_{A})\right\}\), which is the possibility of threat occurrence \(F_{A}^{*}(t_{A})\). Threats cause losses for defense gains. According to [55; 56], the defense measures deployed by the defender in the threat assessment process are determined by the manager. It is assumed that the determined defender strategy \(b_{1}^{\mathrm{D}}\) is as follows: the threat value of the unmanned aerial vehicle (UAV) system in the UAV cyber range can be expressed in a formula \(R_{i}\). The manager conducts risk assessment and analysis of the UAV system according to different defense strategies and calculates the threat value of the UAV system. The UAV security risk level is determined and the optimal defense strategy is deployed. \[R_{i}=\sum_{b_{2}=1}^{n}P(t_{A}|t_{D})\sum_{i_{1}=1}^{m}f_{i}^{A^{*}}(t_{A}) \frac{U_{D}(b_{A},b_{D},t_{D})}{U_{D}^{\mathrm{max}}(b_{A},b_{D},t_{D})} \tag{6}\]Considering that a UAV consists of multiple subsystems such as navigation control, communication, perception and obstacle avoidance, ground station control and mission load, the weight of each subsystem's threat value in the overall UAV security risk value should be considered during the overall UAV risk assessment. The weight vector is represented by \(W=(W_{1},W_{2},\cdots,W_{n})\), and the subsystem threat value is represented by \(R=(R_{1},R_{2},\cdots,R_{n})\).