Cybersecurity Ontology Research Articles

Security Ontology in a Virtual University

Abstract In this paper we propose a cybersecurity ontology model designed for universities, aiming to facilitate the management and protection of sensitive data and information within the context of the growing cybersecurity threats. The proposed ontology includes four distinct hierarchical levels: the basic level, the conceptual level, the instance level and the relationships level. At the basic level, it defines essential terms and principles of cybersecurity, including concepts like vulnerability, threat, cyber-attack, security policies and security rules. At the conceptual level, the ontology categorizes information and cybersecurity systems, embracing domains such as data protection, authentication, authorization, and auditing. At the instance level, the ontology describes specific examples of information and cybersecurity systems used in universities, such as the library management system or the accounting management system. At the relationships level, the ontology establishes links between different categories of information and cybersecurity systems, as well as between these systems and the entities that use them, such as students, professors and administrative staff. By implementing this cybersecurity ontology, universities can improve the management and protection of their sensitive data and information, as well as respond more efficiently to cybersecurity threats.

Cybersecurity knowledge graphs construction and quality assessment

Cyber-attack activities are complex and ever-changing, posing severe challenges to cybersecurity personnel. Introducing knowledge graphs into the field of cybersecurity helps depict the intricate cybersecurity landscape and provides technical support for threat identification and situational awareness. However, during the process of constructing knowledge graphs, inevitable noise and conflicts may be introduced, leading to misleading inferences and decisions. This paper aims to address the issues of constructing and assessing the quality of cybersecurity knowledge graphs. We manually constructed a dataset of cybersecurity knowledge graphs (CS13K) and expanded the existing cybersecurity ontology, building a more versatile ontology applicable to existing data features. Building upon this, we utilized Neo4j to construct the cybersecurity knowledge graph. Furthermore, we propose an AttTucker model, based on Transformer, for assessing the quality of knowledge graphs. By employing numerous self-attention heads, this model captures latent information among entities and relations. While reducing the dimensionality of knowledge embeddings, the model achieves evaluation results comparable to high-dimensional embeddings. Finally, we incorporate the path-level information between entities in the knowledge graph into the evaluation of knowledge graph quality based on the AttTucker model. Experimental analysis on both generic datasets and cybersecurity datasets demonstrates that our model significantly improves F1 value and accuracy in knowledge graph quality assessment tasks, outperforming other models.

Building a self-evolving iMonsters board game for cyber-security education

ABSTRACT In this paper, to handle the problem of the quick evolution of cyber-security attacks, we developed the iMonsters board game and proposed the attack and defense knowledge self-evolving algorithm. Three versions of the iMonsters were launched in 2013, 2017, and 2019, respectively. Accordingly, the cyber-security ontology can be refined by the ontology fusion-or-splitting procedure for the newly collected cyber-security incidents, as well as the roles and rules of the iMonsters can be refined by the gaming portfolio mining procedure for the collected portfolio. Furthermore, we conducted game-based learning (GBL), a quasi-experiment of pre/post-testing, and concept map testing using the iMonsters board game in a children’s summer camp. The experimental results indicate that the students can acquire up-to-date cyber-security knowledge with the iMonsters better than students who learn in a traditional classroom setting, and the students’ satisfaction with acquiring cyber-security knowledge with the instructional design of the iMonsters is better compared with learning in a traditional classroom setting. Satisfaction with the new version has continuously increased. Besides, the results of the in-depth interviews show that the new version was easier to learn. Thus, we may conclude that using the self-evolving iMonsters can improve learning effectiveness and participation in GBL.

Matching Cybersecurity Ontologies on Internet of Everything through Coevolutionary Multiobjective Evolutionary Algorithm

Since Internet of Everything (IoE) makes all the connections that come online more relevant and valuable, they are subject to numerous security and privacy concerns. Cybersecurity ontology is a shared knowledge model for tackling the security information heterogeneity issue on IoE, which has been widely used in the IoE domain. However, the existing CSOs are developed and maintained independently, yielding the CSO heterogeneity problem. To address this issue, we need to use the similarity measure (SM) to calculate two entities’ similarity value in two CSOs and, on this basis, determine the entity correspondences, i.e., CSO alignment. Usually, it is necessary to integrate various SMs to enhance the result’s correctness, but how to combine and tune these SMs to improve the alignment’s quality is still a challenge. To face this challenge, this work first models CSO matching problem as a Constrained Multiobjective Optimization Problem (CMOOP) and then proposes a Coevolutionary Multiobjective Evolutionary Algorithm (CE-MOEA) to effectively address it. In particular, CE-MOEA uses the multiobjective evolutionary paradigm to avoid the solutions’ bias improvement and introduces the coevolutionary mechanism to trade off Pareto Front’s (PF’s) diversity and convergence. The experiment uses Ontology Alignment Evaluation Initiative’s (OAEI’s) bibliographic track and conference track and five real CSO matching tasks to test CE-MOEA’s performance. Comparisons between OAEI’s participants and EA- and MOEA-based matching techniques show that CE-MOEA is able to effectively address various heterogeneous ontology matching problems and determine high-quality CSO alignments.

Cybersecurity ontology and defense solutions: the POC platform

The paper presents the Platform Ontology of Cybersecurity (POC) as developed by the Pragmema team for big data analytics and early detection of cybersecurity incidents as needed in operational defense systems. The modeling of knowledge representation for threat intelligence, info sharing, and incidents reports is based on the theoretical assumptions provided by general linguistics (specifically text linguistics and pragmalinguistics), semantics and cognitive psychology in an AI perspective and turned into neural networks DDBB.

Multi-Source Knowledge Reasoning for Data-Driven IoT Security.

Nowadays, there are different kinds of public knowledge bases for cyber security vulnerability and threat intelligence which can be used for IoT security threat analysis. However, the heterogeneity of these knowledge bases and the complexity of the IoT environments make network security situation awareness and threat assessment difficult. In this paper, we integrate vulnerabilities, weaknesses, affected platforms, tactics, attack techniques, and attack patterns into a coherent set of links. In addition, we propose an IoT security ontology model, namely, the IoT Security Threat Ontology (IoTSTO), to describe the elements of IoT security threats and design inference rules for threat analysis. This IoTSTO expands the current knowledge domain of cyber security ontology modeling. In the IoTSTO model, the proposed multi-source knowledge reasoning method can perform the following tasks: assess the threats of the IoT environment, automatically infer mitigations, and separate IoT nodes that are subject to specific threats. The method above provides support to security managers in their deployment of security solutions. This paper completes the association of current public knowledge bases for IoT security and solves the semantic heterogeneity of multi-source knowledge. In this paper, we reveal the scope of public knowledge bases and their interrelationships through the multi-source knowledge reasoning method for IoT security. In conclusion, the paper provides a unified, extensible, and reusable method for IoT security analysis and decision making.

Zero-shot fine-grained entity typing in information security based on ontology

The field of information security suffers from the lack of labelled entities. This study proposes a zero-shot hybrid approach, combining a clustering algorithm with a method for representing category labels, to classify fine-grained entity typing based on unified cybersecurity ontology (UCO) to address this issue. However, certain category labels in UCO do not have distinct domain features, while certain abbreviations cannot be obtained directly from word embedding using Word2vec. Thus, we propose a new method, referred to as mixed entities and hierarchy of UCO (MEHC), to represent the category labels. Moreover, to further improve the performance of fine-grained entity typing we propose the triClustering algorithm to re-cluster coarse-grained classification results or determine corresponding types for new entities, based on the theorem that the sum of two sides of a triangle is greater than the third. The experimental results prove that our triClustering algorithm can effectively shorten the computation time and that the proposed hybrid method is superior to other baselines for information security applications.

P-007. Are there differences in the decidualizing endometrial secretome in women with recurrent pre-eclampsia?

The field of information security suffers from the lack of labelled entities. This study proposes a zero-shot hybrid approach, combining a clustering algorithm with a method for representing category labels, to classify fine-grained entity typing based on unified cybersecurity ontology (UCO) to address this issue. However, certain category labels in UCO do not have distinct domain features, while certain abbreviations cannot be obtained directly from word embedding using Word2vec. Thus, we propose a new method, referred to as mixed entities and hierarchy of UCO (MEHC), to represent the category labels. Moreover, to further improve the performance of fine-grained entity typing we propose the triClustering algorithm to re-cluster coarse-grained classification results or determine corresponding types for new entities, based on the theorem that the sum of two sides of a triangle is greater than the third. The experimental results prove that our triClustering algorithm can effectively shorten the computation time and that the proposed hybrid method is superior to other baselines for information security applications.

Cybersecurity Ontology for Dynamic Analysis of IT Systems

Today’s IT systems are characterized by a high complexity and the increasing number of sub-systems, as well as the physical equipment needed. That raises the problem of keeping the whole architecture secure, as it has been revealed in recent years by numerous scandals related to data leaks from inadequately secured systems. Several ontology-based approaches tied to the cybersecurity domain have been developed aiming at solving the problem of identifying vulnerabilities in real world systems. Unfortunately, these approaches do not address the essential problem: since real IT system architectures are dynamic and highly variable, it is necessary to enable real-time inventory and observation of all system components, as well as to retrieve up-to-date data about those systems and potential risks. The current paper has a threefold purpose. First, we examine the existing cybersecurity ontologies and identify the deficiencies that prevent us from using them in real, dynamic IT systems. Next, we introduce and propose a framework based on the Dynamic CyberSecurity Ontology, which fills the existing gaps in current solutions. Finally, we outline a monitoring system based on the developed ontology, which implements automatic data mining mechanisms that aggregate results from dynamic knowledge sources, such as Shodan or Censys. As a result, the ontological examination of systems over time becomes possible.

Reachability Matrix Ontology: A Cybersecurity Ontology

ABSTRACTIn this paper, we describe the Reachability Matrix Ontology (RMO). RMO aims to describe the networks and the cybersecurity domain in order to compute the reachability information (reachability matrix). Reachability Matrix determines if a node can reach another node (via ISO/OSI layers protocol).To achieve this objective RMO describes the network’s elements, the network connectivity information, and the access control policies. RMO also provides some SWRL rules able to calculate the Reachability Matrix. Besides RMO and SWRL rules, there are also a set of SPARQL queries to refine the computation of the Reachability Matrix.To the best of our knowledge, RMO represents an innovative approach to the computation of the reachability matrix. Following we will describe our approach based on a strategy that exploits a combination of OWL, description logic rules and SPARQL queries.