1
$\begingroup$

I have been reading the paper Towards a Cognitive System for Decision Support in Cyber Operations. And I have been trying to understand the role of two ontologies proposed here, cyber security ontologies and scenario ontologies.

I have asked a question on CGS SE, What are the practical uses of ontologies? and the role of the ACT-R architecture in this system have become clear to some extent, but the question about the ontologies is that:

Does the cyber security ontologies make the ideas in the TENA's Repo understandable for ACT-R or the ideas that are in the repo has to be represented by an ontology called cyber security ontologies in order to be understandable for the ACT-R architecture?

The Cognitive System realized in the TENA framework:

The Cognitive System realized in the TENA framework

Questions raising from this Figure can be:

  1. What is the difference between the cyber security ontologies and the scenario ontologies?
  2. What kind of knowledge the scenario ontologies represent?
  3. And of course what is the reason that the scenario ontologies are connected to Event data management module instead of TENA's Repo?

ACT-R Architecture:

ACT-R Architecture

TENA Architecture:

TENA Architecture

$\endgroup$
1
+50
$\begingroup$

Some more detail can be found p97. Here "ontologies" are basically encodings of database contents (which represent cyber attacks, incidents, and malicious/ impacted software programs) parseable by external sources, e.g. ACT-R. The event data management system keeps track of (real) attacks/ incidents, or possibly simulated ones. TENA is a Testing and Training Enabling Architecture. In a sense the Cyber Security Ontologies are all the "Nouns", and the Scenario Ontologies are "Verbs" that operate on the Nouns. ACT-R takes these inputs and attempts to create a conceptual linking or model. In a sense the ACT-R is a machine learning system for cyber-attack-related events and entities. It is a framework for outputting a (maybe statistical) analysis that could be used to predict future attacks from the structure of past ones.

The need for controlled vocabularies, taxonomies, and ontologies to make progress toward a science of cyber security is recognized in [26] and [27] as well. In the domain of cyber security, the ontologies would include, among other things, the classification of cyber attacks, cyber incidents, and malicious and impacted software programs. From our point of view, which seeks to accurately represent the human-side of cyber security, we also expand our analysis to: (i) the different roles that system users, defenders and policy makers play in the context of cyber security; (ii) the different jobs and functions that the members of cyber defender team play and the knowledge, skills and abilities needed to fulfill these functions. In order to reduce the level of effort, we will reuse existing ontologies when possible6 and only create new ontologies that support the use cases we select.

$\endgroup$
  • $\begingroup$ Thanks for your answer. Which reference are you mentioning by saying "some more detail can be found p97"? $\endgroup$ – Ali Nfr Jun 16 '15 at 19:29
  • 2
    $\begingroup$ @AliNfr The paper you linked in your question (Towards a Cognitive System for Decision Support in Cyber Operations) starts on pg. 94 of the STIDS Conference Proceedings. I assume he is referring to the 4th page of that document (which is labeled pg. 97). $\endgroup$ – mdxn Jun 16 '15 at 20:03
  • $\begingroup$ @vzn what is your opinion about the question I asked, "Does the cyber security ontologies make the ideas in the TENA's Repo understandable for ACT-R or the ideas that are in the repo has to be represented by an ontology called cyber security ontologies in order to be understandable for the ACT-R architecture?" I have the same question about the scenario ontologies and the event data management system, Are the TENA repo and event data management system providing the instances needed for the ontologies of this system? $\endgroup$ – Ali Nfr Jun 17 '15 at 5:40
  • $\begingroup$ the ontology is a sort of "packaging" for data. the TENA repository/ event data system are not built to interface with ACT-R directly. they have different purposes. the ontologies are a packaging of the data that makes the data consumable by ACT-R. some of this is an abstraction that involves assumptions packaging the data in this way is feasible. $\endgroup$ – vzn Jun 17 '15 at 15:10
  • $\begingroup$ What is the main reason that we need ontology in this system? ,The paper mentions two reasons :" (ii) the flexible behavior required by coupling alternative strategies of response to specific cyber threats, updating and revising strategies when the circumstances of the attack or the environmental conditions evolve;(iv) interacting in a team by building a mental representation of the co-workers as well as of the enemies." $\endgroup$ – Ali Nfr Jun 17 '15 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.