# Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review
## 4 Results
### Artificial Intelligence/Machine Learning
#### 4.1.1 Bayesian Networks
The online data, which comprise the input of the system, originate from attack evidence (IDS) and anomaly evidence (anomaly detection system--ADS). ADS data are compared with normal values to produce information related to the system's malfunction. All these data are processed using Bayesian networks. The authors performeda simulation on a chemical reactor control system to demonstrate that their approach was able to calculate the cybersecurity risk of an ICS in real time. A dynamic, quantitative model based on Bayesian networks was presented by [PERSON] et al. [20] in order to address cyber risk for SCADA environments. The model combines the posterior probability along with the value of an asset in the SCADA environment to calculate the risk. The first step is to differentiate the nodes into two categories: the vulnerability nodes (nodes that have vulnerabilities which can be discovered by a vulnerability scanner software or by querying the common vulnerabilities and exposures database--CVE) and the privilege escalation nodes (nodes that can be used to damage the system). [PERSON] theorem is used to predict the posterior probability based on real-time data/evidence collected from the IDS. The authors used multiple techniques in order to make more accurate risk predictions, such as:  
* A leaky noisy-OR gate to predict unknown attacks. * Offline batching (although complete datasets existed offline, they utilised the expectation maximisation principle to fill the missing values because it is quite common for the attack sample to be incomplete for SCADA systems). * Online incremental learning in order for the model to be able to update and adapt to real-time observations. The model combines historical data and real-time observations, using machine learning techniques to make accurate predictions. A chemical process network was simulated by the authors to demonstrate that the proposed model is able to provide real-time risk calculations for known and unknown attacks. [PERSON] et al. [21] proposed a method to quantitatively calculate cyber risk in ICS environments. Real-time data (evidence from attack) are fed to the Bayesian network along with the ICS security knowledge, which contains information about vulnerabilities, functions, accidents, and assets. The output of the Bayesian network is the probability of occurrence of an event which is combined with the impact, to calculate the real-time risk. The value of the impact depends on the severity of the affected asset. An expectation maximisation algorithm is chosen in case the data are incomplete. The authors conducted a case study on a simulated chemical control process to show that their model can achieve a high level of risk accuracy in real time. [PERSON] et al. [22] introduced a model to quantitatively assess the risk in IPSs by calculating the probabilities and consequences of an abnormal event (tampering with control strategies). The model consists of two parts, probability inference and loss calculation, which were combined to produce real-time risk. An extended multilevel flow model (EMFM) is used to describe the production process (structures and functions of the system) quantitatively, and based on this, the model is able to forecast the consequences of an abnormal event (loss calculation). Regarding the probability inference, a Bayesian network based on the EMFM is used to infer the probabilities of an abnormal event. The system uses as input established control strategies and attack evidence from the IDS. The authors carried out simulations on a chemical process system to present the ability of the proposed model to quantify the risk. [PERSON] et al. [23] presented a novel dynamic quantitative model to address the cybersecurity risk assessment in ICS. The model feeds a fuzzy probability Bayesian network with cyber attack knowledge, system function knowledge, hazardous incident knowledge, and the system's asset knowledge. The authors used fuzzy probability in order to replace the crisp probabilities required in Bayesian networks.