An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things
---
paper_title: Quantifying IT estimation risks

paper_content:

A statistical method is proposed for quantifying the impact of factors that influence the quality of the estimation of costs for IT-enabled business projects. We call these factors risk drivers as they influence the risk of the misestimation of project costs. The method can effortlessly be transposed for usage on other important IT key performance indicators (KPIs), such as schedule misestimation or functionality underdelivery. We used logistic regression as a modeling technique to estimate the quantitative impact of risk factors. We did so because logistic regression has been applied successfully in fields including medical science, e.g. in perinatal epidemiology, to answer questions that show a striking resemblance to the questions regarding project risk management. In our study we used data from a large organization in the financial services industry to assess the applicability of logistic modeling in quantifying IT risks. With this real-world example we illustrated how to scrutinize the quality and plausibility of the available data. We explained how to deal with factors that cannot be influenced, also called risk factors, by project management before or in the early stage of a project, but can have an influence on the outcome of the estimation process. We demonstrated how to select the risk drivers using logistic regression. Our research has shown that it is possible to properly quantify these risks, even with the help of crude data. We discussed the interpretation of the models found and showed that the findings are helpful in decision making on measures to be taken to identify potential misestimates and thus mitigate IT risks for individual projects. We proposed increasing the auditing process efficiency by using the found cost misestimation models to classify all projects as either risky projects or non-risky projects. We discovered through our analyses that projects must not be overstaffed and the ratio of external developers must be kept small to obtain better cost estimates. Our research showed that business units that report on financial information tend to be risk mitigating, because they have more cost underruns in comparison with business units without reporting; the latter have more cost overruns. We also discovered a maturity mismatch: an increase from CMM level 1 to 2 did not influence the disparity between a cost estimate and its actual if the maturity of the business is not also increased.
---
paper_title: A dynamic risk-based access control architecture for cloud computing

paper_content:

Cloud computing is a distributed computing model that still faces problems. New ideas emerge to take advantage of its features and among the research challenges found in the cloud, we can highlight Identity and Access Management. The main problems of the application of access control in the cloud are the necessary flexibility and scalability to support a large number of users and resources in a dynamic and heterogeneous environment, with collaboration and information sharing needs. This paper proposes the use of risk-based dynamic access control for cloud computing. The proposal is presented as an access control model based on an extension of the XACML standard with three new components: the Risk Engine, the Risk Quantification Web Services and the Risk Policies. The risk policies present a method to describe risk metrics and their quantification, using local or remote functions. The risk policies allow users and cloud service providers to define how to handle risk-based access control for their resources, using different quantification and aggregation methods. The model reaches the access decision based on a combination of XACML decisions and risk analysis. A prototype of the model is implemented, showing it has enough expressivity to describe the models of related work. In the experimental results, the prototype takes between 2 and 6 milliseconds to reach access decisions using a risk policy. A discussion on the security aspects of the model is also presented.
---
paper_title: Fuzzy Multi-Level Security: An Experiment on Quantified Risk-Adaptive Access Control

paper_content:

This paper presents a new model for, or rather a new way of thinking about adaptive, risk–based access control. Our basic premise is that there is always inherent uncertainty and risk in access control decisions that is best addressed in an explicit way. We illustrate this concept by showing how the rationale of the well–known, Bell–Lapadula model based, Multi–Level Security (MLS) access control model could be used to develop a risk-adaptive access control model. This new model is more like a Fuzzy Logic control system [9] than a traditional access control system and hence the name “Fuzzy MLS”. The long version of this paper is published as an IBM Research Report [3].
---
paper_title: Architecture for Internet of Things to minimize human intervention

paper_content:

Today, smart objects in Internet of Things (IOT) are able to detect their state and share it with other objects across the Internet, thus collaboratively making intelligent decisions on their own. Large number of objects is quietly introduced into the web every day. It is impossible for a user to keep a track of all objects available around him. Therefore a search engine that could find smart objects is used. If an exact object yielding the required service is not present then system requires explicit user inputs to find alternatives such as name of an alternate object that may provide the same service. Humans always find alternatives around them to carry out their work smoothly. Service provisioning in IOT should also be made capable of providing similar or alternate objects that are aligned with user requirements, current context and previous knowledge without any human intervention. We propose an architecture that uses Naive Bayesian prediction on user history and Ant Colony Optimization for accurately predicting objects of user interest so as to reduce the dependency of IOT application on human inputs for finding an object match.
---
paper_title: Dynamic risk-based decision methods for access control systems

paper_content:

In traditional multi-level security systems, trust and risk values are pre-computed. Any change in these values requires manual intervention of an administrator. In many dynamic environments, however, these values should be auto-adaptive, and auto-tunable according to the usage history of the users. Moreover, occasional exceptions on resource needs, which are common in dynamic environments like healthcare, should be allowed if the subjects show a positive record of use toward resources they acquired in the past. Conversely, access of authorized users, who have negative record, should be restricted. These requirements are not taken into consideration in existing risk-based access control systems. In order to overcome these shortcomings and to meet different sensitivity requirements of various applications, we propose two dynamic risk-based decision methods for access control systems. We provide theoretical and simulation-based analysis and evaluation of both schemes. Also, we analytically prove that the proposed methods, not only allow exceptions under certain controlled conditions, but uniquely restrict legitimate access of bad authorized users.
---
paper_title: On Estimating the Security Risks of Composite Software Services

paper_content:

A reversible, side mounted rearview mirror for vehicles adapted to be mounted at the exterior of the vehicle and having opposed reflective surfaces one of which is suitable for daytime use and the other which is suitable for nighttime use. The mirror is supported within the housing for rotation about a horizontal axis and for swinging movement about a vertical axis at one end of the mirror to provide a full range of adjustment and to permit selecting one or the other of the reflective surfaces.
---
paper_title: Risk-based Dynamic Access Control for a Highly Scalable Cloud Federation

paper_content:

Cloud Computing is already a successful paradigm for distributed computing and is still growing in popularity. However, many problems still linger in the application of this model and some new ideas are emerging to help leverage its features even further. One of these ideas is the cloud federation, which is a way of aggregating different clouds to enable the sharing of resources and increase scalability and availability. One of the great challenges in the deployment of cloud federations is Identity and Access Management. This issue is usually solved by the creation of identity federations, but this approach is not optimal. In this paper, we propose an access control system for a highly scalable cloud federation. The presented system is dynamic and risk-based, allowing the use of cloud federations without the need of identity federations. We also present results of a prototype implementation and show that it is scalable and flexible enough to meet the requirements of this highly dynamic and heterogeneous environment.
---
paper_title: Quantifying IT estimation risks

paper_content:

A statistical method is proposed for quantifying the impact of factors that influence the quality of the estimation of costs for IT-enabled business projects. We call these factors risk drivers as they influence the risk of the misestimation of project costs. The method can effortlessly be transposed for usage on other important IT key performance indicators (KPIs), such as schedule misestimation or functionality underdelivery. We used logistic regression as a modeling technique to estimate the quantitative impact of risk factors. We did so because logistic regression has been applied successfully in fields including medical science, e.g. in perinatal epidemiology, to answer questions that show a striking resemblance to the questions regarding project risk management. In our study we used data from a large organization in the financial services industry to assess the applicability of logistic modeling in quantifying IT risks. With this real-world example we illustrated how to scrutinize the quality and plausibility of the available data. We explained how to deal with factors that cannot be influenced, also called risk factors, by project management before or in the early stage of a project, but can have an influence on the outcome of the estimation process. We demonstrated how to select the risk drivers using logistic regression. Our research has shown that it is possible to properly quantify these risks, even with the help of crude data. We discussed the interpretation of the models found and showed that the findings are helpful in decision making on measures to be taken to identify potential misestimates and thus mitigate IT risks for individual projects. We proposed increasing the auditing process efficiency by using the found cost misestimation models to classify all projects as either risky projects or non-risky projects. We discovered through our analyses that projects must not be overstaffed and the ratio of external developers must be kept small to obtain better cost estimates. Our research showed that business units that report on financial information tend to be risk mitigating, because they have more cost underruns in comparison with business units without reporting; the latter have more cost overruns. We also discovered a maturity mismatch: an increase from CMM level 1 to 2 did not influence the disparity between a cost estimate and its actual if the maturity of the business is not also increased.
---
paper_title: An Efficient Authentication and Access Control Scheme for Perception Layer of Internet of Things

paper_content:

The research is support by National Natural ScienceFoundation of P. R. China ( Grant ::: No.61170065,61373017,61171053,61103195 and 61203217), Peak of Six Major Talent in Jiangsu Province (Grant No.2010DZXX026), the Natural Science Foundation of Jiangsu Province(Grant No.BK2012436 and BK20130882),Scientific & Technological Support Project of Jiangsu ProvinceGrant No. BE2012183 and BE2012755), Natural Science Key Fund for Colleges and Universities in Jiangsu Province (Grant No. ::: 11KJA520001 and 12KJA520002), Scientific Research & Industry Promotion Project for Higher Education InstitutionsJHB2012-7) .
---
paper_title: Fuzzy Multi-Level Security: An Experiment on Quantified Risk-Adaptive Access Control

paper_content:

This paper presents a new model for, or rather a new way of thinking about adaptive, risk–based access control. Our basic premise is that there is always inherent uncertainty and risk in access control decisions that is best addressed in an explicit way. We illustrate this concept by showing how the rationale of the well–known, Bell–Lapadula model based, Multi–Level Security (MLS) access control model could be used to develop a risk-adaptive access control model. This new model is more like a Fuzzy Logic control system [9] than a traditional access control system and hence the name “Fuzzy MLS”. The long version of this paper is published as an IBM Research Report [3].
---
paper_title: Authentication and Access Control in the Internet of Things

paper_content:

Due to the inherent vulnerabilities of the Internet, security and privacy issues should be considered and addressed before the Internet of Things is widely deployed. This paper mainly analyzes existing authentication and access control methods, and then, it designs a feasible one for the Internet of Things.
---
paper_title: Enhancing Cloud Security through Access Control Models: A Survey

paper_content:

Cloud computing is a new computing paradigm in which an application can run on connected Cloud Server instead of local server. Cloud computing provides efficient data storage, resource sharing and services in a distributed manner with great ease. However Cloud computing is having issues like security and privacy of data when sensitive data is stored under third party cloud service providers. Various access control models have been proposed to resolve the security issue in cloud computing. So in this paper we have discussed various access control models starting from the traditionally DAC (Discretionary Access Control), MAC (Mandatory Access Control), RBAC (Role Based Access Control) and ABAC (Attribute Based Access Control) to the latest ABE (Attribute Based Encryption) models like CP-ABE (Ciphertext Policy Attribute Based Encryption), KP-ABE (Key Policy Attribute Based Encryption), HABE (Hierarchical Attribute Based Encryption) and HASBE (Hierarchical Attribute Set Base Encryption).
---
paper_title: A dynamic risk-based access control architecture for cloud computing

paper_content:

Cloud computing is a distributed computing model that still faces problems. New ideas emerge to take advantage of its features and among the research challenges found in the cloud, we can highlight Identity and Access Management. The main problems of the application of access control in the cloud are the necessary flexibility and scalability to support a large number of users and resources in a dynamic and heterogeneous environment, with collaboration and information sharing needs. This paper proposes the use of risk-based dynamic access control for cloud computing. The proposal is presented as an access control model based on an extension of the XACML standard with three new components: the Risk Engine, the Risk Quantification Web Services and the Risk Policies. The risk policies present a method to describe risk metrics and their quantification, using local or remote functions. The risk policies allow users and cloud service providers to define how to handle risk-based access control for their resources, using different quantification and aggregation methods. The model reaches the access decision based on a combination of XACML decisions and risk analysis. A prototype of the model is implemented, showing it has enough expressivity to describe the models of related work. In the experimental results, the prototype takes between 2 and 6 milliseconds to reach access decisions using a risk policy. A discussion on the security aspects of the model is also presented.
---
paper_title: Fuzzy Multi-Level Security: An Experiment on Quantified Risk-Adaptive Access Control

paper_content:

This paper presents a new model for, or rather a new way of thinking about adaptive, risk–based access control. Our basic premise is that there is always inherent uncertainty and risk in access control decisions that is best addressed in an explicit way. We illustrate this concept by showing how the rationale of the well–known, Bell–Lapadula model based, Multi–Level Security (MLS) access control model could be used to develop a risk-adaptive access control model. This new model is more like a Fuzzy Logic control system [9] than a traditional access control system and hence the name “Fuzzy MLS”. The long version of this paper is published as an IBM Research Report [3].
---
paper_title: Enforcing Access Control Using Risk Assessment

paper_content:

Context-based access control is an emerging approach for modeling adaptive solution, making access control management more flexible and powerful. But in the ubiquitous environment, this approach is not enough for many emerging security vulnerabilities. Thus, improving current access control mechanisms is still necessary. Risk is an effective tool used for decision-making in economics. In this paper, we design a new model for risk assessment in ubiquitous environment and use risk as a key component in decision-making process in our access control model. This solution makes access control management more dynamic and precise
---
paper_title: Quantifying IT estimation risks

paper_content:

A statistical method is proposed for quantifying the impact of factors that influence the quality of the estimation of costs for IT-enabled business projects. We call these factors risk drivers as they influence the risk of the misestimation of project costs. The method can effortlessly be transposed for usage on other important IT key performance indicators (KPIs), such as schedule misestimation or functionality underdelivery. We used logistic regression as a modeling technique to estimate the quantitative impact of risk factors. We did so because logistic regression has been applied successfully in fields including medical science, e.g. in perinatal epidemiology, to answer questions that show a striking resemblance to the questions regarding project risk management. In our study we used data from a large organization in the financial services industry to assess the applicability of logistic modeling in quantifying IT risks. With this real-world example we illustrated how to scrutinize the quality and plausibility of the available data. We explained how to deal with factors that cannot be influenced, also called risk factors, by project management before or in the early stage of a project, but can have an influence on the outcome of the estimation process. We demonstrated how to select the risk drivers using logistic regression. Our research has shown that it is possible to properly quantify these risks, even with the help of crude data. We discussed the interpretation of the models found and showed that the findings are helpful in decision making on measures to be taken to identify potential misestimates and thus mitigate IT risks for individual projects. We proposed increasing the auditing process efficiency by using the found cost misestimation models to classify all projects as either risky projects or non-risky projects. We discovered through our analyses that projects must not be overstaffed and the ratio of external developers must be kept small to obtain better cost estimates. Our research showed that business units that report on financial information tend to be risk mitigating, because they have more cost underruns in comparison with business units without reporting; the latter have more cost overruns. We also discovered a maturity mismatch: an increase from CMM level 1 to 2 did not influence the disparity between a cost estimate and its actual if the maturity of the business is not also increased.
---
paper_title: A dynamic risk-based access control architecture for cloud computing

paper_content:

Cloud computing is a distributed computing model that still faces problems. New ideas emerge to take advantage of its features and among the research challenges found in the cloud, we can highlight Identity and Access Management. The main problems of the application of access control in the cloud are the necessary flexibility and scalability to support a large number of users and resources in a dynamic and heterogeneous environment, with collaboration and information sharing needs. This paper proposes the use of risk-based dynamic access control for cloud computing. The proposal is presented as an access control model based on an extension of the XACML standard with three new components: the Risk Engine, the Risk Quantification Web Services and the Risk Policies. The risk policies present a method to describe risk metrics and their quantification, using local or remote functions. The risk policies allow users and cloud service providers to define how to handle risk-based access control for their resources, using different quantification and aggregation methods. The model reaches the access decision based on a combination of XACML decisions and risk analysis. A prototype of the model is implemented, showing it has enough expressivity to describe the models of related work. In the experimental results, the prototype takes between 2 and 6 milliseconds to reach access decisions using a risk policy. A discussion on the security aspects of the model is also presented.
---
paper_title: On Estimating the Security Risks of Composite Software Services

paper_content:

A reversible, side mounted rearview mirror for vehicles adapted to be mounted at the exterior of the vehicle and having opposed reflective surfaces one of which is suitable for daytime use and the other which is suitable for nighttime use. The mirror is supported within the housing for rotation about a horizontal axis and for swinging movement about a vertical axis at one end of the mirror to provide a full range of adjustment and to permit selecting one or the other of the reflective surfaces.
---
paper_title: Context-Aware Authentication for the Internet of Things

paper_content:

Many traditional authentication and access control mechanisms do not use context-aware approach, i.e., those mechanisms do not incorporate context parameters while mak- ing authentication and authorisation decisions. The context unaware mechanisms can be inadequate for the Internet of Things due to its dynamic and heterogeneous environment. The context information can be used to reconfigure security mechanisms and adjust security parameters. The contextual information can be integrated into various security mecha- nisms such as authentication, access control, encryption, etc. The context-aware security is the dynamic adjustment of secu- rity policy based on the context. In this paper, we discuss the context-awareness techniques for authentication and access control mechanisms. We present the concepts of context, con- text- awareness, and context based security and highlight con- textual attributes that can be used to support and enhance authentication and access control mechanisms for the Internet of Things.
---
paper_title: Fuzzy logic-based risk assessment

paper_content:

Safety and reliability are essential issues in modern sciences. Modern equipment and systems should meet technical, safety and environmental protection requirements. The risk can appear as personal injury or death, mission degradation, property technical damage or destruction. The risk is a measure of harm or loss associated with the human activity. It is the combination of the likelihood and the consequence of a specified hazard being realized. For decision making we need the opinions of other sciences, sometimes we have to consider moral questions. One of them is to manage risk of human activities. To make reliable decision, the risk of the given system or process should be known correctly. Fuzzy logic is a new mathematical tool to model inaccuracy and uncertainty of the real world and human thinking. This paper will show the possibility of use of the fuzzy logic to assess the risk.
---
paper_title: A Fuzzy Modeling Approach for Risk-Based Access Control in eHealth Cloud

paper_content:

A number of recent studies have adopted risk assessment in access control for healthcare applications, but few of the work is specifically concerned with the risk assessment in the presence of uncertainties, such as uncertain values of risk factors, and consequences of imprecision. This paper presents a fuzzy modeling-based approach that accounts for uncertainty analysis when evaluating the risk. Three inputs -- data sensitivity, action severity, and risk history -- are modeled with fuzzy set and used to calculate the level of risk associated with healthcare information access in a cloud environment. Experiments were conducted and demonstrated that the approach can generate accurate and realistic outcomes in assessing current security risk and predicting the scope and impact of different risk factors. This would lead to a great change of access control from being active to being proactive to security breach, and enhance the security level of eHealth cloud applications.
---
paper_title: Fuzzy Multi-Level Security: An Experiment on Quantified Risk-Adaptive Access Control

paper_content:

This paper presents a new model for, or rather a new way of thinking about adaptive, risk–based access control. Our basic premise is that there is always inherent uncertainty and risk in access control decisions that is best addressed in an explicit way. We illustrate this concept by showing how the rationale of the well–known, Bell–Lapadula model based, Multi–Level Security (MLS) access control model could be used to develop a risk-adaptive access control model. This new model is more like a Fuzzy Logic control system [9] than a traditional access control system and hence the name “Fuzzy MLS”. The long version of this paper is published as an IBM Research Report [3].
---
paper_title: Enforcing Access Control Using Risk Assessment

paper_content:

Context-based access control is an emerging approach for modeling adaptive solution, making access control management more flexible and powerful. But in the ubiquitous environment, this approach is not enough for many emerging security vulnerabilities. Thus, improving current access control mechanisms is still necessary. Risk is an effective tool used for decision-making in economics. In this paper, we design a new model for risk assessment in ubiquitous environment and use risk as a key component in decision-making process in our access control model. This solution makes access control management more dynamic and precise
---
paper_title: Game-based adaptive security in the Internet of Things for eHealth

paper_content:

The Internet of Things (IoT) is enabling the deployment of distributed applications based on ubiquitous computing and convergent networks. Due to its heterogeneous structure, it introduces new security challenges and requirements. Particularly, the security mechanisms implemented in the IoT should adapt to the dynamic context. This paper proposes a game-based model for adaptive security in the IoT, with an emphasis on eHealth applications. We use the trade-off between security-effectiveness and energy-efficiency to evaluate adaptive security strategies. We also present the results of simulation experiments to assess the performance of the proposed model. We show that our model allows extending the lifetime of the smart things by 47% compared to existing models.
---
paper_title: A Vertical Handoff Method via Self-Selection Decision Tree for Internet of Vehicles

paper_content:

Vehicles often communicate among different networks in Internet of Vehicles (IoVs). However, existing unstable network statuses and different user preferences result in vehicle frequent vertical handoffs (VHOs). In this paper, we propose a novel VHO method based on a self-selection decision tree for IoVs. We first establish the respective handoff probability distribution of vehicles according to network attributes and movement trend. Then, based on handoff probability distributions and defined user preferences, we propose a novel handoff method by the self-selection decision tree for IoVs. Finally, we also present a feedback decision method according to the feedback of vehicle handoff, to improve next handoff quality when vehicle movement trend and vehicle service status change. Simulation results show that the proposed method not only supports the VHO among Wireless Access in Vehicular Environments, Worldwide Interoperability for Microwave Access, and third-generation cellular but also reduces switching times and ensures the network update rate and the vehicles’ service quality.
---
paper_title: Monte Carlo simulation applied to support risk-based decision making in electricity distribution networks

paper_content:

Risk management, as a decision-making process, is a key enabler in successful asset management for asset intensive industries such as electricity network companies. With the introduction of PAS55 and more recently the ISO55000 for asset management, there is an increasing need for probabilistic risk modelling tools. In this paper the methodology of Monte Carlo Simulation (MCS) has been adopted and the potential utilization of this for risk-based asset management decision-making purposes has been investigated for a Dutch Distribution System Operator (DSO), Stedin. Several case studies with the focus on the prediction of customer interruptions in the electrical distribution networks are performed with the main focus on medium voltage (MV) cables and cable joint failures. The MCS is performed for 12 MV radial feeder systems. For each cable section and cable joint separate failure distribution models have been used to characterize the failure behavior on the basis of historical data and statistical life data analysis. This information is used as input for the MCS. On the whole, it can be concluded that all historical actual occurred outages for these 12 feeder systems were possible outcomes from the MCS simulations. This implies that the amount of customer outages could have been predicted through the MCS. Therefore, on the basis of this work, the utilization of MCS for risk based decision-making for DSOs as part of their asset management system is recommended.
---
paper_title: Toward an Access Control Model for IOTCollab

paper_content:

Abstract The increase in Internet-connected physical devices offers new possibilities and opportunities. This Internet of Things (IoT) fosters the development of new platforms, services and applications that connect the physical world (represented by physical objects) to the virtual world (represented by the Internet). The work presented here proposes a study of role and attribute-based access control models that tackle the security concerns of our already developed data sharing framework. The framework introduced a formal theoretical model, the IOTCollab domain specific language, and an integrated development environment that implements this model. We have extended this framework by completing the formal theoretical model with access control capabilities.
---
paper_title: Federated Identity and Access Management for the Internet of Things

paper_content:

We examine the use of Federated Identity andAccess Management (FIAM) approaches for the Internet ofThings (IoT). We look at specific challenges that devices, sensorsand actuators have, and look for approaches to address them.OAuth is a widely deployed protocol -- built on top of HTTP -- forapplying FIAM to Web systems. We explore the use of OAuth forIoT systems that instead use the lightweight MQTT 3.1 protocol.In order to evaluate this area, we built a prototype that usesOAuth 2.0 to enable access control to information distributed viaMQTT. We evaluate the results of this prototyping activity, andassess the strengths and weaknesses of this approach, and thebenefits of using the FIAM approaches with IoT and Machine toMachine (M2M) scenarios. Finally we outline areas for furtherresearch.
---

Title: An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things

Section 1: INTRODUCTION
Description 1: Introduce the growth of IoT, its challenges, and the need for dynamic access control models, particularly focusing on risk-based access control and its risk estimation process.

Section 2: ACCESS CONTROL MODELS
Description 2: Discuss various access control models, differentiating between traditional and dynamic models, with a focus on the need for dynamic models in IoT environments.

Section 3: RISK-BASED ACCESS CONTROL MODEL
Description 3: Explain the concept of risk in access control, including the risk analysis process, and describe the architecture and components of the risk-based access control model.

Section 4: RISK ESTIMATION TECHNIQUES
Description 4: Provide a detailed overview of different risk estimation techniques used in existing risk-based access control models, including fuzzy logic, risk assessment, game theory, decision tree, Monte Carlo simulation, and expert judgment.

Section 5: RISK ESTIMATION TECHNIQUE FOR THE IoT
Description 5: Discuss the specific requirements of IoT systems that impact the choice of risk estimation techniques, such as dynamic interaction, scalability, limited resources, and data availability.

Section 6: CONCLUSIONS
Description 6: Summarize the challenges of implementing risk-based access control in IoT, review the discussed risk estimation techniques, and outline future directions for empirical comparison and data collection.