An Ontology-based Storage of Security Information

Abstract

The paper suggests an ontology-based approach for design of security data storage. It analyzes heterogeneous security information for construction of the security storage and the statistics of links between various security data sources. The suggested ontological model of the data storage allows connecting both heterogeneous security data and security data of the same type from various sources. The main features the ontological model, its key elements and links between them are described in details. In addition, the authors introduce the developed prototype of the ontological data storage and provide examples of its usage for security evaluation.

A Semantic Model for Security Evaluation of Information Systems

“…All this creates required basis for our ontology of security metrics. We started this research in [8,37] where we aimed to integrate various security data sources, and proceeded it in [9], where we proposed the first upper level ontology for attack goals determination. This paper extends the previous ontology with new security metrics and details it in terms of their interrelations to answer security questions using logical inference.…”

“…As soon as the approach proposed in this paper requires an accurate structuring and detailing security related knowledge, the areas outlined in CyBOK (including software security, network security, malware, and others) and their further detailing can be used as the basis for development of our approach. At the same time, the proposed in this paper approach is based on the set of hierarchically interconnected security metrics for security assessments [6][7][8]. The structure of subject areas introduced in CyBOK will allow one to evaluate what cybersecurity areas are covered with metrics by our approach.…”

“…1. An ontology of security data sources and security data [8]. The difference of ontology proposed in this study consists in extension with a new class of instances, namely, security metrics.…”

“…2. A set of hierarchically interconnected security metrics [8,9]. These metrics allow assessing security of information systems on different stages of their operation and with varying degrees of accuracy depending on the available security data, new knowledge obtained in the process of security assessment, and security assessment goals.…”

Attacker Behaviour Forecasting Using Methods of Intelligent Data Analysis: A Comparative Review and Prospects

“…There are two types of sources: structured data and unspecified data. In [58], we outlined the following open sources of structured data considering objects of information security assessments: vulnerability databases, attack patterns databases, weaknesses databases, software and hardware databases, and so on. For accurate attack forecasting in real time, it is required to add another type of source data, network traffic, and event logs (which is unspecified).…”