An Ontology-Centric Approach for Network Security Situation Awareness
Yixuan Wang, Bo Zhao, Weidong Li, Lingzi Zhu · 2023
Nowadays, the network-centric computing environment poses numerous security risks. Network Security Situation Awareness (NSSA) is a crucial action that involves monitoring and preventing ongoing and potential threats to information systems. To support this work, this paper proposes an extended cybersecurity ontology, which can be utilized as the core component of NSSA implementations. Our ontology consists of several modular sub-ontologies, each of which has a specific function that contributes to NSSA. And it is relatively more comprehensive and better organized than existing security ontologies. To demonstrate the applicability and efficiency of our ontology, we applied it to the construction process of a practical knowledge graph. We also conducted experiments in two practical situation awareness scenarios to validate the efficacy of our ontology in monitoring system situations. In the first case we apply our ontology to mine potential ongoing attack behaviors and discover attack scenarios. In the second validation scenario, we obtain the trend of changing situation based on the knowledge graph. The results of these experiments showed that our ontology can be easily used to link available information and perform effectively in practical situation awareness scenarios.