Security Ontology Research Articles

Security Ontology in a Virtual University

Abstract In this paper we propose a cybersecurity ontology model designed for universities, aiming to facilitate the management and protection of sensitive data and information within the context of the growing cybersecurity threats. The proposed ontology includes four distinct hierarchical levels: the basic level, the conceptual level, the instance level and the relationships level. At the basic level, it defines essential terms and principles of cybersecurity, including concepts like vulnerability, threat, cyber-attack, security policies and security rules. At the conceptual level, the ontology categorizes information and cybersecurity systems, embracing domains such as data protection, authentication, authorization, and auditing. At the instance level, the ontology describes specific examples of information and cybersecurity systems used in universities, such as the library management system or the accounting management system. At the relationships level, the ontology establishes links between different categories of information and cybersecurity systems, as well as between these systems and the entities that use them, such as students, professors and administrative staff. By implementing this cybersecurity ontology, universities can improve the management and protection of their sensitive data and information, as well as respond more efficiently to cybersecurity threats.

A framework for automating environmental vulnerability analysis of network services

The primary objective of this paper is to introduce a comprehensive framework designed to automate the assessment of environmental vulnerability status of communication protocols and networked services, within operational contexts. The proposed algorithm leverages the Common Vulnerability Scoring System version 3 (CVSS 3) metrics in conjunction with network security data. The initial step involves the establishment of a network security ontology, which serves to model the environmental attributes associated with the current security posture of communication protocol channels available within an infrastructure. The process commences with the identification and enumeration of all active communication services through a combination of diverse information gathering tools. Subsequently, active network services undergo assessment using a blend of passive scanning and active security analysis tools, which produce the environmental security score. This score can be integrated into vulnerability scoring systems such as CVSS, facilitating the fine-tuning of base CVSS scores, as well as vulnerability mitigation in real-world environments. To validate the proposed framework, we conducted testing across various networks and communication protocols within a controlled environment, thereby offering tangible illustrations for widely-utilized communication protocols.

Ontology-based security modeling in ArchiMate

Enterprise Risk Management involves the process of identification, evaluation, treatment, and communication regarding risks throughout the enterprise. To support the tasks associated with this process, several frameworks and modeling languages have been proposed, such as the Risk and Security Overlay (RSO) of ArchiMate. An ontological investigation of this artifact would reveal its adequacy, capabilities, and limitations w.r.t. the domain of risk and security. Based on that, a language redesign can be proposed as a refinement. Such analysis and redesign have been executed for the risk elements of the RSO grounded in the Common Ontology of Value and Risk. The next step along this line of research is to address the following research problems: What would be the outcome of an ontological analysis of security-related elements of the RSO? That is, can we identify other semantic deficiencies in the RSO through an ontological analysis? Once such an analysis is provided, can we redesign the security elements of the RSO accordingly, in order to produce an improved artifact? Here, with the aid of the Reference Ontology for Security Engineering (ROSE) and the ontological theory of prevention behind it, we address the remaining gap by proceeding with an ontological analysis of the security-related constructs of the RSO. The outcome of this assessment is an ontology-based redesign of the ArchiMate language regarding security modeling. In a nutshell, we report the following contributions: (1) an ontological analysis of the RSO that identifies six limitations concerning security modeling; (2) because of the key role of the notion of prevention in security modeling, the introduction of the ontological theory of prevention in ArchiMate; (3) a well-founded redesign of security elements of ArchiMate; and (4) ontology-based security modeling patterns that are logical consequences of our proposal of redesign due to its underlying ontology of security. As a form of evaluation, we show that our proposal can describe risk treatment options, according to ISO 31000. Finally, besides presenting multiple examples, we proceed with a real-world illustrative application taken from the cybersecurity domain.

A FAIRification Framework for the Findability, Accessibility, Interoperability and Reusability of Cyber Security Ontologies Using FAIR Data Principles.

A FAIRification Framework for the Findability, Accessibility, Interoperability and Reusability of Cyber Security Ontologies Using FAIR Data Principles.

Threat Attribution and Reasoning for Industrial Control System Asset

Due to the widespread use of the industrial internet of things, the industrial control system has steadily transformed into an intelligent and informational one. To increase the industrial control system's security, based on industrial control system assets, this paper provides a method of threat modeling, attributing, and reasoning. First, this method characterizes the asset threat of an industrial control system by constructing an asset security ontology based on the asset structure. Second, this approach makes use of machine learning to identify assets and attribute the attacker's attack path. Subsequently, inference rules are devised to replicate the attacker's attack path, thereby reducing the response time of security personnel to threats and strengthening the semantic relationship between asset security within industrial control systems. Finally, the process is used in the simulation environment and real case scenario based on the power grid, where the assets and attacks are mapped. The actual attack path is deduced, and it demonstrates the approach's effectiveness.

Security Ontology OntoSecRPA for Robotic Process Automation Domain

Robotic process automation (RPA)* based on the use of software robots has proven to be one of the most demanded technologies to emerge in recent years used for automating daily IT routines in many sectors, such as banking and finance. As with any new technology, RPA has a number of potential cyber security weaknesses, caused either by fundamental logical mistakes in the approach or by cyber-human mistakes made during the implementation, configuration, and operation phases. It is important to have an extensive understanding of the related risks before RPA integration into enterprise IT infrastructure. The main asset operated by RPA is confidential enterprise data. Data leakage and theft are the two main threats. The wide application of RPA technology in information security-sensitive sectors makes the protection of RPA against cyber-attacks an important task. Still, this topic is not yet adequately investigated in the scientific press and existing articles mainly concentrate on stating the RPA security importance and describing some threats. In this article, we present a flexible tool, security-oriented ontology OntoSecRPA*, which systematically describes RPA-specific assets, risks, security, threats, vulnerabilities, and countermeasures. To the best of our knowledge, there are currently no ontologies available that are specific to the RPA domain, and existing security ontologies lack RPA-related features. In the future, the proposed ontology can be updated and used in different ways, for example, as a checklist for risk management tasks in RPA solutions and a source of information for an expert system or a concentrated domain-specific source of information, which indicates its wide practical application. The proposed ontology was formally verified by applying ontology completeness assessment and used for risk assessment in a sample scenario.

Towards Real-Time Warning and Defense Strategy AI Planning for Cyber Security Systems Aided by Security Ontology

Cyber security systems generally have the phenomena of passive defense and low-efficiency early warnings. Aiming at the above problems, this study proposes a real-time warning and plans an AI defense strategy for a cyber security system aided by a security ontology. First, we design a security defense ontology that integrates attack graphs, general purpose and domain-specific knowledge bases, and on this basis, we (1) develop an ontology-driven method of early warnings of real-time attacks, which supports non-intrusive scanning attack detection and (2) combine artificial intelligence planning and bounded rationality to recommend and automatically execute defense strategies in conventional defense scenarios. A case study has been performed, and the results indicate that: (1) the proposed method can quickly analyze network traffic data for real-time warnings, (2) the proposed method is highly feasible and has the ability to implement defense strategies autonomously, and (3) the proposed method performs the best, with a 5.4–11.4% increase in defense effectiveness against the state-of-the-art counterparts considering the APT29 attack. Overall, the proposed method holds the potential to increase the defense effectiveness against cyberattacks under high computing resource constraints.

An Ontology-Based Dynamic Attack Graph Generation Approach for the Internet of Vehicles

With the development of automobile intelligence, the security of the Internet of Vehicles has become a key factor that affects the development of intelligent vehicles. However, existing security risk analysis methods for the IoV either focus only on certain levels, such as the component level, or perform only a static analysis. This paper proposes a dynamic attack graph generation method for the IoV to identify and visually display the security risks caused by the associated vulnerabilities in an IoV system. First, using the actual architecture of the IoV, this paper shows how to model the security elements and their relationships in the IoV system and proposes a network security ontology model for this system. Second, it shows how to construct a reasoning rule base according to the causal relationship between the vulnerabilities using the Semantic Web Rule Language Finally, in view of the rapid change in the network topology of the IoV, a dynamic attack graph generation algorithm based on an ontology reasoning engine is proposed, which can effectively reduce the overhead caused by the changes in the attack graph. The effectiveness of the algorithm is demonstrated through an actual security event scenario and a constructed scenario. The experimental results show that the algorithm can dynamically and accurately display the network attack graph of the IoV. The proposed method is helpful in globally analyzing the threat caused by the combined exploitation of the vulnerabilities in an IoV system and risk management.

SecureOnt: A Security Ontology for Establishing Data Provenance in Semantic Web

Security becomes a primary concern during sharing of information over the web. To overcome this problem, many security ontologies have been developed so far. The available security ontologies help to track data provenance and contain different aspects of data security like confidentiality, integrity, data availability, and access control. This paper provides a security ontology for establishing data provenance in the semantic web. The proposed ontology contains a comprehensive knowledge base of data security by consolidating all the available security ontologies and derives data provenance with annotations at the extensional level and thus lower maintenance cost. By this paper, analysts and researchers find a road map, an overview of what exists in terms of security ontologies.

Security Ontology Structure for Formalization of Security Document Knowledge

Cybersecurity solutions are highly based on data analysis. Currently, it is not enough to make an automated decision; it also has to be explainable. The decision-making logic traceability should be provided in addition to justification by referencing different data sources and evidence. However, the existing security ontologies, used for the implementation of expert systems and serving as a knowledge base, lack interconnectivity between different data sources and computer-readable linking to the data source. Therefore, this paper aims to increase the possibilities of ontology-based cyber intelligence solutions, by presenting a security ontology structure for data storage to the ontology from different text-based data sources, supporting the knowledge traceability and relationship estimation between different security documents. The proposed ontology structure is tested by storing data of three text-based data sources, and its application possibilities are provided. The study shows that the structure is adaptable for different text data sources and provides an additional value related to security area extension.

Ontological Representation of Healthcare Application Security Using Blockchain Technology

Blockchain is gaining traction for improving the security of healthcare applications, however, it does not become a silver bullet as various security threats are observed in blockchain-based applications. Moreover, when performing the security risk management (SRM) of blockchain-based applications, there are conceptual ambiguities and semantic gaps that hinder from treating the security threats effectively. To address these issues, we present a blockchain-based healthcare security ontology (HealthOnt) that offers coherent and formal information models to treat security threats of traditional and blockchain-based applications. We evaluate the ontology by performing the SRM of a back-pain patient’s healthcare application case. The results show that HealthOnt can support the iterative process of SRM and can be continually updated when new security threats, vulnerabilities, or countermeasures emerge. In addition, the HealthOnt may assist in the modelling and analysis of real-world situations while addressing important security concerns from the perspective of stakeholders. This work can help blockchain developers, practitioners, and other associated stakeholders to develop secure blockchain-based healthcare applications in the early stages.

Hybrid ontology for safety, security, and dependability risk assessments and Security Threat Analysis (STA) method for industrial control systems

This paper introduces a model-based methodology for hybrid reliability, availability, maintainability, safety, and security (RAMSS) risk assessment management, which extends our previous work of model-based, data-driven, support for engineering mission-critical systems. It represents a hybrid risk assessment ontology, which harmonises basic concepts between dependability, safety and security based on well-known industrial standards. Based on the proposed ontology, we create a cybersecurity risk analysis method, called Security Threat Analysis (STA), for industrial control systems and successfully demonstrate the method. For the demonstration, we introduce a data model for creating a tool-supported data repository for STA, then implement this repository with a commercial-off-the-shelf tool. We use the repository to carry out an exemplary STA of a nuclear fuel pool cooling control system, assessing a cybersecurity-related hazard. The demonstration suggests that the hybrid RAMSS risk assessment ontology and the related STA data model are ready to be tested in industrial use, offering a structured data repository to support assessment and traceability between the created artefacts.

Matching Cyber Security Ontologies through Genetic Algorithm-Based Ontology Alignment Technique

Security ontology can be used to build a shared knowledge model for an application domain to overcome the data heterogeneity issue, but it suffers from its own heterogeneity issue. Finding identical entities in two ontologies, i.e., ontology alignment, is a solution. It is important to select an effective similarity measure (SM) to distinguish heterogeneous entities. However, due to the complex semantic relationships among concepts, no SM is ensured to be effective in all alignment tasks. The aggregation of SMs so that their advantages and disadvantages complement each other directly affects the quality of alignments. In this work, we formally define this problem, discuss its challenges, and present a problem-specific genetic algorithm (GA) to effectively address it. We experimentally test our approach on bibliographic tracks provided by OAEI and five pairs of security ontologies. The results show that GA can effectively address different heterogeneous ontology-alignment tasks and determine high-quality security ontology alignments.

Multi-Source Knowledge Reasoning for Data-Driven IoT Security.

Nowadays, there are different kinds of public knowledge bases for cyber security vulnerability and threat intelligence which can be used for IoT security threat analysis. However, the heterogeneity of these knowledge bases and the complexity of the IoT environments make network security situation awareness and threat assessment difficult. In this paper, we integrate vulnerabilities, weaknesses, affected platforms, tactics, attack techniques, and attack patterns into a coherent set of links. In addition, we propose an IoT security ontology model, namely, the IoT Security Threat Ontology (IoTSTO), to describe the elements of IoT security threats and design inference rules for threat analysis. This IoTSTO expands the current knowledge domain of cyber security ontology modeling. In the IoTSTO model, the proposed multi-source knowledge reasoning method can perform the following tasks: assess the threats of the IoT environment, automatically infer mitigations, and separate IoT nodes that are subject to specific threats. The method above provides support to security managers in their deployment of security solutions. This paper completes the association of current public knowledge bases for IoT security and solves the semantic heterogeneity of multi-source knowledge. In this paper, we reveal the scope of public knowledge bases and their interrelationships through the multi-source knowledge reasoning method for IoT security. In conclusion, the paper provides a unified, extensible, and reusable method for IoT security analysis and decision making.

Malicious Traffic Description: Toward a Data Model for Mitigating Security Threats to Home IoT

With the popularization of the Internet of Things (IoT) in the home environment, security incidents have become more recurrent with end users. Knowledge sharing on incident mitigation with intrusion prevention systems (IPSs) can improve domestic IoT security, but both signa-ture-based and anomaly-based approaches pose challenges of updating, portability, and privacy. Our previous work extended the RFC 8520 functions and proposed the Intra-Network eXposure analyzer Utility (INXU) as a signature-based IPS to address these challenges. The INXU's architecture solves the signature update problem, and its Malicious Traffic Description (MTD) data model solves the portability and privacy issues. However, the referred MTD data model is prone to high false-positive detection rates due to the lack of contextual information for identifying effective threats. Thus, this work proposes an improvement to the MTD data model that reduces the false-positive detection rates. The concepts from an IoT security ontology are incorporated into the MTD data model to insert contextual information for the decision making process. With this, the present work proposes the improved MTD as a standard data model for sharing knowledge about the mitigation of malicious activities through IoT systems. Experiments using a Mirai botnet variant shows the improved performance provided by the solution herein proposed. The infections are reduced by up to 63 percent when compared to RFC 8520, and the false-positive detection is reduced by approximately 27 percent when compared with the original MTD.

Psychological readiness and ontologies in security of digital multilevel distributed systems

Information, computer environments and systems require not only technological, but also psychological, neuro-linguistic support. The evolution of a digital, competency-based society requires the active introduction of information and communication technologies in all key areas (e-government, e-learning, e-business, etc.). There is also a negative impact of such an evolutionary process, for example, the emergence of IT risks and threats to the individual, society and society. It is also possible to strengthen the information confrontation, hybrid war, "Trojan training", etc. It is very important to ensure the security of multilevel distributed information structures of the digital economy. The article discusses the systemic analysis of this problem, explores some specific aspects and tasks, in particular the use of ontologies and formalization. System-synergistic analysis of psychological readiness and its support by ontological approach was carried out. System objectives of network attacks and psychological influences in conditions of evolution of distributed infological system are revealed. A general model of system security ontology in a formal-semantic and infological form is proposed. Everything is implemented based on the semantics of controlled process metadata (Resource Description Framework), metadata prediction languages (Ontology Language), ontology standards, analytics, "parallelization" of knowledge and updating of knowledge bases, Big Data, Data Mining, Social Mining, Data Centers, multi-agent and other systems.

Analysis and Evaluation on the Network Security Defense in Power Marketing Industrial Control System

With the implementation of the energy Internet, ‘Internet+power’, power IOT, and digital transformation and upgrading strategy, the power marketing system has carried out the massive metering acquisition and load control terminals, which are interactive and open accessed. Also, it has enhanced the coordinated operation and control with core power control systems such as power dispatching, transportation inspection. The current protection is mainly based on traditional passive defense concepts and technologies such as isolation protection, which cannot meet the demand of high reliability, high availability, safe and stable operation in the energy Internet environment. Therefore, it is urgent to establish a new generation of industrial control system for power marketing security protection system, which breaks through technologies in control terminal widely safe access, network safe and reliable interaction, system safe and trusted operation. The proactive defense technology brings new inspiration to the research on the security protection theory of the industrial control system for power marketing, including ontology security immune enhancement and pre-warning detection. Moreover, applying the theory of proactive defense to the field of power marketing security can provide a new way to improve the security protection of power marketing system..

Who Is the Citizen in Citizen Security?

This article explores the governing logics and political implications of citizen security in Puebla, Mexico, specifically, the Programa Nacional de Prevención del Delito (National Program for the Prevention of Crime, PRONAPRED). Taking a biopolitical perspective, the article centers on how citizens are produced through the application of citizen security initiatives. This production operates at two levels: the regulation of populations and the molding of subjects. First, vital statistics and risk-related variables highlight those populations that exceed the median for risk. Second, those at-risk groups are targeted for training to reduce their susceptibility to violence. Training focuses on the individual, asking citizens to identify and minimize risk in a manner that emanates from and contributes to security governance. The political ontology of citizen security is this citizen/citizenry coincident with official measures. The democratic aspirations of citizen security are consequently muted, as security governance locates citizens within the confines of state power and, at the same time, holds them separate from this power to produce citizen existence.

Towards a BPMN Security Extension for the Visualization of Cyber Security Requirements

Business process modeling notation (BPMN) is a widely used business model process. The importance of security is apparent, but traditionally, it is considered after the business processes definition. There is a need for integrated tools and a methodology that allows for specifying and enforcing compliance and security requirements for business process-driven enterprise systems. Therefore, it is very important to capture the security requirements at conceptual stage in order to identify the security needs. BPMN is lacking the ability to model and present security concepts. This will increase the vulnerability of the system and make the future development of security for the system more difficult. This article proposes a novel extension to BPMN notation based on cyber security ontologies. The authors incorporate visual constructs for modeling security requirements. In order to provide a commonly usable extension, these enhancements were implemented as BPMN metamodel extension. The authors illustrate capabilities and benefits of extension with a real-life example.

Automated Expert System Knowledge Base Development Method for Information Security Risk Analysis

Information security risk analysis is a compulsory requirement both from the side of regulating documents and information security management decision making process. Some researchers propose using expert systems (ES) for process automation, but this approach requires the creation of a high-quality knowledge base. A knowledge base can be formed both from expert knowledge or information collected from other sources of information. The problem of such approach is that experts or good quality knowledge sources are expensive. In this paper we propose the problem solution by providing an automated ES knowledge base development method. The method proposed is novel since unlike other methods it does not integrate ontology directly but utilizes automated transformation of existing information security ontology elements into ES rules: The Web Ontology Rule Language (OWL RL) subset of ontology is segregated into Resource Description Framework (RDF) triplets, that are transformed into Rule Interchange Format (RIF); RIF rules are converted into Java Expert System Shell (JESS) knowledge base rules. The experiments performed have shown the principal method applicability. The created knowledge base was later verified by performing comparative risk analysis in a sample company.