Data-driven risk assessment in infrastructure networks