An End-to-End Framework for Cybersecurity Taxonomy and Ontology Generation and Updating
Anna Kougioumtzidou, Angelos Papoutsis, Dimitrios Kavallieros, Thanassis Mavropoulos, Theodora Tsikrika, Stefanos Vrochidis, Ioannis Yiannis Kompatsiaris · 2024
Effective cyber-defense practices often require the use of structured knowledge representations, such as taxonomies and ontologies, to organise vast amounts of data and facili-tate knowledge representation and reasoning. To this end, we present an Artificial Intelligence (AI)-assisted framework for the construction and update of cybersecurity taxonomies and ontologies. The proposed framework can be divided into three main phases: Taxonomy Construction, Ontology Construction, and Taxonomy/Ontology Update, each phase consisting of both information extraction and semantic knowledge representation components. For information extraction, we employ a variety of techniques originating from Natural Language Processing (NLP), particularly Transformer Neural Networks. For constructing ontologies, we propose a conceptual ontology schema based on the STIX 2.1 standard for modeling information related to attacks, threats, and vulnerabilities, and use the Owlready2 Python library. Overall, our framework effectively builds cybersecurity taxonomies and ontologies and updates existing knowledge of both the generated and open-source taxonomies and ontologies.