Response to the threats ofinformation securityin conditions of modernorganizationwith а largeinafrstructure is an areawithemergencyloaded intensityof the datausage. rFo а successlfu exposureand the preventionof computerattacksthe constructionof complex models of the events is required.ln this work, the question of the applicabllity of ontologicalmodels is examinedfor the descriptionof threats.On the basis of workedout appliedontologies,the modelarchitectureof the knowledgebaseis being oefred, the possiЫe practicalscenariosof its use are being examined.The peculiaritiesof this workare the usage of reasoning on the diferent stages of eventhandling and design of knowledge, not only aboutevents but also aboutan informationinfrastructureand its satfey. Thus, the examined semantic technologiescan Ье а base rfo the completesystem of responseto the threatsof inrfomation security.
An area of information security today is especially relevant: the amount of threats and their destructive capacity grow with every year. Computer attacks are com plicated trigger аЫе operations in that it can involve consideraЫe amount of network nodes now. Intruders use the various techniques of conducting attacks and concealment of their activities, complicating work of defenders at the same. In such circumstances, the development of new methods that would Ье applied in composition with the automated tools of exposure of cyber threats becomes not simply an interesting scientific task, but also а valuaЫe practical result.
The traditional approach for the exposure of threats is based on the use of signatures, namely search of suspicious templates in operating data. The signa ture approach is ublquitously used due to the ease and protfiabllity, orfm the point of view of computing resources. Unfortunately, it has а range of substantial drbawacks: the signature approach requires consideraЫe eforts on maintenance of base of signatures in the actual state not being аЫе to expose new types of threats (zero-day attacks) and does not allow to line up the models of complex attacks.
The most popular alternative ofr the signature approach is the usage of meth ods of machine learning. А search of threats, which is based on the exposure of anomalies, behavioral, and statistical analysis, allows us to find out substan tially more dificult
attacks than the signature approach, but it is not deprived of the defects.
Machine learning algorithms results are often poorly interpretaЫe thus there are dificulties
in localization and threat removing. In addition, such algorithms often require nfie-tuning
under а correct infrastructure and skilled support for the timely account of inevitaЫe changes of external terms. оТ
two indicated approaches we can add and approach on the basis of formal
models. As noted in the work [
their removal. The key advantage of such tools is а higher level of the used abstractions that provides knowledge system atization, decision automation, and allows to ofer to the expert the decisions with the observance of rfomal
response procedures.
One of the proЫems of conceptual models usage in dynamically developing areas is the laboriousness of knowledge base maintenance in the actual state. But the wide usage of open and community-supported standards and taxonomies, such as CVE/NVD 1 or САРЕС 2 allows to avoid the dificulties related to up dating of the knowledge base. On the one side, open and peer-reviewed sources allow where appropriate to specify
the terminological base of ontology and on the other, allow to update the actual filling of the knowledge base regularly.
Another unique advantage of using formal models in cybersecurity is the high development level of industrial systems for collecting information about pro tected objects. In modern organization all required information is already pre sented in inventory databases and SIEM systems 3, that consideraЬly simplifies its integration in the knowledge base.
In spite of the fact
that ontology а long ago and successfully used in many areas, such as genetics and Ьio-medicine, they meet rarely in enterprise solutions providing information security. The purpose of this work is а demonstration of wide possiЬilities of an ontological approach for the development of methods and tools rfo reacting to the security threats of the distributed information infrastruc ture. Central directions of our research are the questions related to applicaЬility and eficiency
of logical reasoning and also questions related to the conceptual representation of knowledge about an information infrastructure.
The brief review of accessiЫe works is given in the second part of this article, the third part contains а scheme description of the model knowledge base, on which in fourth part some possiЬilities of ontological approach are demonstrated. 1 https://cve.mitre.org
and event management) - class of the systems carrying out the centralized collection and analysis of security log
Related Works
The construction of ontological models in information security is conducted al
ready for more than fiteen years. One of the first bright works in this area is
ontology IDS 4, presented in [
Another classic example of the ontological model usage is presented in the
article [
Development of semantic models is directly connected with the use of in
dustry standards and specification s, so in work [
Other example of the successful use of open dictionaries is described in [
Approach allowing to systematize not only information security but also the
development of ontology process, presented in works [
In authors' opinion, ontologies are usually an association of three levels, from
most general, such as DOLCE, at the top level, to the applied ontology [
Ву the natural desire of researchers, that in the total got the embodiment
in а number of works, was to overcome one ontology of all traditional scenarios
of the use of concepts of cybersecurity. Thus in work [
In works [
ln [
The common decision of long-term proЬlem standardization of fo rmats of
cybersecurity-related knowledge lately became language STIX [
In the conclusion of this review, we want to note that in spite of the fact that
ofr the past years substantial results were oЬtained with the area of development
of cybersecurity ontologies many tasks are not solved. PossiЬility of reasoning
is not used even in those works where implementation allows to use them. The
proЫem of extraction of knowledge from the unstructured sources is not fully
resolved although work makes consideraЫe part of analysing such data. Ontolo
gies do not contained concepts for description of information infras tructure in
the meantime the question of cybersecurity prioritization events is continuously
related to such knowledge. А possiЫe way for eficient infrastructure represen
tation presented in recent work [
Knowledge Base Architecture То show the possiЬilities of ontological approach the model knowledge base was implemented. А terminological constituent (Т - Ьох) of knowledge base is on tology of UCO complemented applied with bottom level ontologies. An actual constituent (А- Вох) plugs operating information (events and incidents of cyber security), information about an infrastructure and also information from open dictionaries and taxonomies. 3.1
Ontological Model As said earlier UCO though and is the most complete cybersecurity ontology in pure form tfis badly for practical application and requires adaptation. As such adaptation, additional ontologies for the decision of certain tasks were developed. Ontology of operating information extends and complements such concepts of UCO as action and observaЫe. Its main task is to provide accordance with other objects of knowledge base and Ьу operating inrfomation.
Its key concept is the event. The event is the universal observed object and parent for allother types, which represent events in the real world. ln addition, it plugs in description rules of threats exposure (signatures, anomalies, and others) and sets their accordance with industry standards, such as а matrix of АТТ&СК[lЗ].
Ontology of inrfo mation infrastructure is а clarification
for uco - identity - localidentity that allowsto determine authentication for
internal subjects and also essence set of infrastructure objects for
description of endpoints and applications in an infras tructure (frequently Ьу the subclasses of uco - observaЫe) and their well-known and possiЫe connections. Last from
ontology models is prioritization ontology.
It is а model for concepts ofrm
а conclusion of environmental risk metrics CVSS. lt includes the environmental risk of CVSS. Requirements to confidentia lity, availaЬility, integrity, probaЬility are causing damages that hatch on the basis of data about subject to the risk to the infrastructure. 3.2
ln а model knowledge base operating information appears as events of SIEM because the systems of this class are the main components of the centralized security monitoring in enterprise surroundings. From the point of data view, SIEM events are the records of compatiЫe format, extracted from and security tools aggregated in а single database. The format diferent
logs of records is based on the СуЬох standard (http://cybox.mitre.org), plugged into SТIX. As а model data, the logs of regular subsystem of audit of OS Linux, logs generated Ьу Osquery framework
(https://osquery.io), and logs of firewalls were used. 3.3
lnformation about an infrastructure
appears in two basic types of objects: end point record and network rule. The first type contains information about а certain host, such as the installedsowftare, security policies, criticality of the processed information etc. The second is an object for network availaЬilityde scription and written down like the rules of firewalls (that make the basic lfiling of this part of database) with the only exception that except the standard types of Deny and Allowthe type of Routine is intended for description beforehand of well-known permanent network connections. eW 4 4.1
Use Cases
Attack Classification will consider the mechanism of attack classicfiation with the example of event finding
out reverse shell on the host, detected Ьу the system of trafic analysis. lnitiallyan event is а record of SIEM and rule of sensor associated with it. The task of classification, in this case, can Ье reformulated in terms of conceptual model as а task of search of the most certain concept for this event of SIEM would satisfy description of that. The tree of specicfiation of class for our example is brought around to Fig. 1.
hasRuleGorup:Persistence
hasRule:ReverseShellDetection hasParentProcess: bash hasParentProcess:WeЫogic ProcesslUser:ValidUser ProcessUser:paren!User
ValidUserActivity
WebLogicExplatation
Thus, classicfiation on the basis of reasoning can Ье basis not only for а decision-making Ьу а man, but also for the acceptance of the automated decision. ln our example, such solution is automatic lfitration of false positive. 4.2
Risk Assessment ln our model, а risk level is estimated in accordance with the second version CVSS standard. The standard of CVSS is plugged in itself Ьу three types of met rics: base, temporal, and environmental. The rfist two metrics are descriptions of vulnerability presented in ontology as the property hasCVSSScore and can Ье delivered from the open-source. The third metrics group is intended for bringing resulting amendments taking into account descriptions of the information envi ronment and their calculation makes the most interest. For the calculation of environmental metrics descriptions of the afected objects are used. So relation belongSToystem of class Ednpoint allows denfiing requirements for confidential ity availaЬility and integrity, coming from properties of the system such as а type of processed information and degree of criticism. ProbaЬility of indirect damage settles accounts coming ofrm criticism of the constrained systems and closeness of aims on the basis of amount of hosts on that the vulneraЫe version
Atack Name:WeЫogic Explatation
Use RiskScore
defindeBy EnvironmentalMetrics
Vulnerabllity cvelD: CVE-2020-2283 hasCVSSScore:9.8
Affect extractFrom ----L--
Scope NumberO!Hosts: 15
Endpoint уТре: Server EndpointlD: 1234
BelongTo
System
lnformationLevel: К-2
Criticality: Medium
F inding of related information in our model can Ье materialized on the basis
of rules presenting as SPARQL [
Within the work the modelof knowledgebase was built to support processes of responseto the threats of informationsecurity. Stand tests on the basis of modelscenariosof the use showedpossiЬility ofdeploymentof ontologicalap proach in the processof responseto the incidentsof inrfomation security. The specialattentionat developmentof ontologicalmodelwassparedto description of informationinfrastructure as modernprocessesof providinginrfomation secu rity in large organizationsindissoluЬlyconnectedwith the processesof network control and eventual devices. Despite the fact that the ontologicalmodelhas shownits suitaЬility, there is still а long way to go rfo its full use. Firstly, in work we did not involve the question of possiЬility of thread data processing and, as а result, the productivity questions,includingquestionsthat are related to the choice of optimal dialect of OWL for descriptionof model.Secondly, а fairly primitive modelfor descriЬingnetworkavailaЬility was used, in that the questionof presenceor incommunication,in fact, is takento the presenceof cor respondingrule on the firewall was used.Thirdly, valuaЫe use of the systemis impossiЫewithout seriousexpansionof types of processedeventsand expansion of set of conceptsin ontologiesof application layer. Our global aim is to develop completeontologicalframework rfo support of responseto cyberthreatsand this researchis only the first step on а path to this aim.
Aknowledgements. This work is supervisedЬу Nikolay Skvortsov, dFeeral Research Center Computer Science and Control of the Russian Academy of Sciences(FRC CSC RAS).