Knowledge of software security is highly complex since it is quite context-specific and can be applied in diverse ways. To secure software development, software developers require not only knowledge about general security concepts but also about the context for which the software is being developed. With traditional security-centric knowledge formats, it is difficult for developers or knowledge users to retrieve their required security information based on the requirements of software products and development technologies. In order to effectively regulate the operation of security knowledge and be an essential part of practical software development practices, we argue that security knowledge must first incorporate features that specify what contextual characteristics are to be handled, and represent the security knowledge in a format that is understandable and acceptable to the individuals. This study introduces a novel ontology approach for modeling security knowledge with a context-based approach, by which security knowledge can be retrieved, taking the context of the software application at hand into consideration. In this paper, we present our security ontology with the design concepts and the corresponding evaluation process.Information 2019, 10, 216 2 of 12 security to methodically classify various security concepts, such as security attacks and vulnerabilities as well as related security prevention mechanisms [5,6]. The knowledge representation of ontology not only integrates knowledge resources at both abstract and semantic levels, but can also be adopted by knowledge sharing services such as advanced knowledge search, knowledge visualization, and therefore, supports the learning process of software security.This paper is part of ongoing research developing a contextual learning environment for software security, in which ontology is used as the kernel knowledge repository in managing contextualized security knowledge. The objective of this research is to support software developers and knowledge users to define and use security knowledge appropriately, adapting to their working context. The ontology we designed integrates application context, security domain knowledge, and contextualized knowledge, allowing contextual inquiry through software scenarios that users would be interested in or familiar with. In this paper, we present our security ontology with the design concepts and the evaluation process.The rest of this paper is organized as follows. Section 2 introduces the background knowledge about the context and knowledge. In Section 3, we describe the design of our ontology. Section 4 presents the evaluation process of the ontology, followed by a discussion in Section 5. We discuss related works in Section 6. Lastly, Section 7 presents the conclusion and our future works.
Context and Knowledge Management