# Risk Assessment of UAV Cyber Range Based on Bayesian-Nash Equilibrium
## 2 Related Research Work
### Unmanned Aircraft System Risk Assessment  
Firstly, the threats faced by UAVs, their own risk and UAV assets are analyzed, and then the probability of occurrence of security risk, the severity of risk of UAVs, and the value of UAV assets are evaluated so as to obtain the occurrence and possibility of security incidents and the possible losses caused by security incidents, and finally the overall security value of UAV. Risk assessment methods can be roughly divided into two categories: qualitative assessment and quantitative assessment, and their development trend is shown in the figure below. Therefore, the following is an analysis of the current research status of UAV system risk assessment from these two aspects. * Qualitative assessment  
Qualitative assessment is to make use of security knowledge and experience to conduct a holistic assessment of the security status of a system [45]. In the IT field, typical qualitative information risk evaluation methods include OCTAVE, CORAS, Delphi method, the Analytic Hierarchy Process (AHP), and so on. In the field of industrial control, [PERSON] et al. proposed a risk assessment method of industrial control system based on an attacktree. This method uses the attack tree model to provide a structured view for the industrial control system of the Modbus communication protocol, describes a series of events leading to attacks, and helps security experts take defensive measures. Since qualitative risk assessment can only give a rough or overall description of the security of unmanned aerial systems, it is difficult to accurately display the security details of unmanned aerial systems, and it is difficult to customize appropriate protection strategies according to the security status of unmanned aerial systems. Therefore, qualitative assessment is often used as a basis for quantitative assessment, or applied to scenarios where the accuracy of risk assessment is less required. * Quantitative evaluation  
Quantitative analysis mainly uses mathematical tools such as probability analysis to quantify the security value, and its main advantage is accuracy. At present, many scholars have studied the information risk evaluation of the industrial control system, but few have paid attention to the information risk evaluation of the UAV system. The risk assessment method of the UAV information space is mainly based on the mature theoretical basis of information risk assessment in the field of industrial control. [PERSON] et al. (2016) proposed a risk assessment method for an industrial control information system based on attack scenarios. Industrial control security experts assessed system vulnerabilities and threats, formulated possible attack paths and the success probability of attackers, and finally calculated the security risk value. [PERSON] et al. (2017) used the directed graph model to model the attack process of the industrial control system and calculate the security value. This method also required security experts to specify parameters in the model. [PERSON] et al. (2018) applied game theory to the risk evaluation of industrial control systems, established a non-cooperative game model between attackers and defenders, and finally realized quantitative evaluation by quantifying the benefits of confidentiality, integrity and availability. To sum up, if quantitative evaluation is adopted, there are two typical approaches to the evaluation of UAV information security. The first approach is to evaluate UAV from the perspective of traditional functional security evaluation by using a fault tree, Petri net, transfer function and other commonly used functional security research methods. The second is from the perspective of information risk assessment of the IT cyber range, using common risk assessment techniques in the IT field, including attack graph, Bayesian cyber range, game theory and other methods to carry out risk assessment of UAV.