Ontology-based approach to real-time risk management and cyber-situational awareness

Abstract

The requirement of continuous risk assessment and management is attracting growing attention because of the need of keeping risk under control. Over the years, companies are dealing with a growing number of malicious actions coming from heterogeneous sources, so risk management must be dynamic in real-time to define action strategies and validate the effectiveness of the safeguards in place. This exposure makes it imperative to use sensor-based systems to detect anomalies or to have an updated catalog of vulnerabilities to understand the situation in which the system finds itself and its level of risk. Such a wealth of heterogeneous information has led to the use of ontologies to organize data, as they allow the extraction of new concepts and behaviors, for instance, measuring the risk level of a system or generating metrics for decision support systems. This paper presents an ontology to describe different types of anomalies, merged with previously developed models for Cyber-Threat Intelligence, becoming a proposal to define real-time risk management in a converged secure environment with physical and logical elements, using these ontologies and SPARQL Rules to infer knowledge and calculate dynamically the risk level of the system.