An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> Fuzzy Logic <s> Safety and reliability are essential issues in modern sciences. Modern equipment and systems should meet technical, safety and environmental protection requirements. The risk can appear as personal injury or death, mission degradation, property technical damage or destruction. The risk is a measure of harm or loss associated with the human activity. It is the combination of the likelihood and the consequence of a specified hazard being realized. For decision making we need the opinions of other sciences, sometimes we have to consider moral questions. One of them is to manage risk of human activities. To make reliable decision, the risk of the given system or process should be known correctly. Fuzzy logic is a new mathematical tool to model inaccuracy and uncertainty of the real world and human thinking. This paper will show the possibility of use of the fuzzy logic to assess the risk. <s> BIB001 </s> An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> Fuzzy Logic <s> This paper presents a new model for, or rather a new way of thinking about adaptive, risk–based access control. Our basic premise is that there is always inherent uncertainty and risk in access control decisions that is best addressed in an explicit way. We illustrate this concept by showing how the rationale of the well–known, Bell–Lapadula model based, Multi–Level Security (MLS) access control model could be used to develop a risk-adaptive access control model. This new model is more like a Fuzzy Logic control system [9] than a traditional access control system and hence the name “Fuzzy MLS”. The long version of this paper is published as an IBM Research Report [3]. <s> BIB002 </s> An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> Fuzzy Logic <s> A number of recent studies have adopted risk assessment in access control for healthcare applications, but few of the work is specifically concerned with the risk assessment in the presence of uncertainties, such as uncertain values of risk factors, and consequences of imprecision. This paper presents a fuzzy modeling-based approach that accounts for uncertainty analysis when evaluating the risk. Three inputs -- data sensitivity, action severity, and risk history -- are modeled with fuzzy set and used to calculate the level of risk associated with healthcare information access in a cloud environment. Experiments were conducted and demonstrated that the approach can generate accurate and realistic outcomes in assessing current security risk and predicting the scope and impact of different risk factors. This would lead to a great change of access control from being active to being proactive to security breach, and enhance the security level of eHealth cloud applications. <s> BIB003
Fuzzy logic is a set of mathematical rules for representing the knowledge that based on degrees of membership. It manages degrees of membership and degrees of truth. Moreover, it ensures that we do not neglect human common sense, intuition, and experiences BIB003 . Fuzzy logic and fuzzy set operations enable characterization of defined fuzzy sets of likelihood and consequence severity and the mathematics to combine them using expert knowledge  . A typical fuzzy logic estimation process comprises of three stages: (1) Fuzzification of inputs, (2) Imprecise reasoning using fuzzy rules, and (3) Defuzzification of outputs. Input and output parameters can be either linguistic or numeric. Fuzzification is the process of finding the membership of an input variable with a linguistic term. While the membership function can be either defined by experts or analytically extracted from data, and fuzzy rules are usually defined by experts. Finally, defuzzification provides a crisp number from the output fuzzy set BIB001 . Many researchers are attracted to use the fuzzy logic to estimate the risk in access control models. BIB002 used the fuzzy logic to build a fuzzy Multi-Level Security (MLS) access control model to allow humans to access information from IBM systems. This fuzzy MLS model estimates the risk of the access request based on differences between the subject security level and the object security level. For instance, the larger the difference is, the higher the risk is. The result is described as a real number in the interval [0, 1], where 1 represents an absolute deny (the highest risk), and 0 represents an absolute permit (the lowest risk). The fuzzy MLS model further divides the interval [0, 1] into n subintervals referred to as risk bands. If the risk of an access request is evaluated to a band, then the request is allowed only if the risk mitigation measures associated with the band are applied. Also, BIB003 presented a fuzzy modelling-based approach for evaluating the risk associated with the access request of a healthcare information access. In this model, the risk value that is associated with the data sensitivity, action severity, and risk history is determined as a fuzzy value, which is used to determine appropriate controls of the healthcare information access in a cloud environment. This model showed that the fuzzy logic approach can generate accurate and realistic outcomes in assessing current risk and forecasting the scope and impact of different risk factors. Ni et al. (2010) introduced a fuzzy inference technique to estimate the risk. This approach is used for estimating access risks and develop an enforcement mechanism for the riskbased access control model. The estimated risk is computed by using the object security level and the subject security level. However, the scalability of the fuzzy inference-based access control model faces some issues. The fuzzy inference system needs large time to estimate risks especially when there are tens of parameters and hundreds of fuzzy rules. Furthermore, the access control model may need to serve billions of users. Therefore, a fuzzy inferencebased access control model might be too computationally expensive.