# Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review
## 4 Results
### Artificial Intelligence/Machine Learning
#### 4.1.1 Bayesian Networks
In addition, the model receives as input anomaly evidence detected by anomaly detectors, as well as attack evidence detected by the IDS. Based on this information the fuzzy probability Bayesian network interference engine calculates the posterior probability. Finally, the risk is calculated based on the posterior probability and asset losses. Simulations on a simplified chemical reactor were conducted by the authors to present the ability of their model to evaluate risk in a timely manner. A DRA approach that aims to reduce the cyber risk of CI was presented by [PERSON] et al. [24], taking into consideration the cyber-physical interaction. A typical CI consists of a several stations and a control centre. The model consists of two components: DRA and decision making. With respect to the DRA component, every station employs a Bayesian network that utilises real-time attack data from the IDS as input, and generates probabilities for station capacities as output. The station capacity is the capability of a station to work as planned. Then, the probabilities of all station capacities are obtained the same way. The final output of the risk assessment process is the real-time system risk caused by an attack strategy. The decision-making approach for cyber-risk reduction is based on the attack strategy detected by the IDS and the counter-measures that can be applied in order to reduce the risk. Finally, the net benefit of each counter-measure is calculated. A simulation was carried out on a simplified water supply system in order for the authors to prove that their model is able to evaluate cyber risk in real time and to provide the optimal decision-making approach. [PERSON] et al. [PERSON] et al. (2016) recommended HPCvul, a novel approach for vulnerability and risk assessment in high-performance computing (HPC) networks utilising the NVD repository, CVSS scoring, and a network monitoring tool such as IDS. HPCvul agencies are deployed in HPC subnetworks to collect information such as hosts' configurations and services, deployed software, topology, etc. HPCvul uses a Bayesian attack graph to conduct real-time RA by examining vulnerabilities and their dependencies within the network. This allows the model to detect potential attack paths and evaluate the likelihood of an HPC target being compromised by an attacker. Furthermore, quantitative RA metrics are defined to aid in security decision making. Relative case studies were conducted to showcase that this approach is able to assess the probability of compromising a target in dynamic environments. A dynamic model to quantitatively address cybersecurity risk in distributed CPSs was proposed by [PERSON] et al. [PERSON] et al. (2018). Based on a distribution network topology and the CVSS scoring mechanism, a Bayesian network model is built. The attacker's selectivity in attacking targets during cyber attacks is taken into consideration using a combination of the fuzzy analytic hierarchy process (FAHP) and entropy weight method, incorporating both subjective expert opinions and objective indicators. In addition, the model considers the available defence resources. The authors used GeNle to create three different attack scenarios simulations in order to evaluate their model.