Formal framework for an adaptive risk management for the protection of critical infrastructures