National intelligence agencies face the challenge of data overload as they analyse vast amounts of information to address national security threats. To help analysts manage this complexity and ensure decision-making compliance, the Threat Intelligence Decision Ontology (TIDO) was developed. However, a major limitation of TIDO is the absence of a formal representation for the inherent uncertainties in threat intelligence (TI) data, which stems from imperfect sources, biases, and incomplete information. This ongoing PhD research addresses this critical gap by investigating how to integrate a suitable uncertainty representation into the TIDO framework.
One of the main tasks of national intelligence agencies is to investigate and act against
organizations or persons that could pose a threat to the national security. During such investigations,
analysts must interpret and analyse incoming data and act accordingly. However, similar to other
data-driven domains, technological advances have created new sources of information that can be
used during investigations, increasing the amount of information available for decision making, and
in turn increasing the risk of data-overload [
A major limitation of the TIDO ontology is in its current form, is that there is no specific representation for the uncertainties involved in the decision making process. AI solutions and human experts will always have biases or imperfect models, sources might be poor, or misleading, and data-sharing might be limited for operational, strategic or legal reasons. Consequently, at each step of Threat https://ritten11.github.io/ (R. Roothaert) CEUR
ceur-ws.org
Intelligence Hybrid Workflow (TIHW), the analyst must revise this limited and uncertain information
and recommend actions [
Uncertainty representation is a broad and complicated field, ranging from quantitative representations,
often expressed using probabilities, to qualitative representations, often expressed in natural language,
and ordinal representations, which are used to express that one statement is more likely to be true that
another. For expressing the uncertainties in the TIDO ontology, we focus on the quantitative uncertainty
representations as we aim to propagate uncertainties throughout the TIHW using a formalized and
sound theoretical background, capable of expressing how much more likely one statement is over
another. Here, a pure probabilistic-based perspective would work well when high quality and complete
information is available. However, this assumption generally doesn’t hold in the domain of TI [
Ethical considerations The author is aware of the sensitivity of the subject and the potential implications with respect to the privacy of citizens. The motivation, though, is not to collect new data but to provide a vocabulary to enrich and structure data already obtained by the intelligence services. This enables the decision makers to make their assumptions and considerations explicit, increasing their accountability and improving the testability of their decisions with respect to compliance with legislation and internal policies. The proposed research does not provide intelligence agencies with additional capabilities, nor justifications, to collect more data, and therefore, does not impact the privacy of citizens.
Approach and goals To determine which uncertainty representation is most suitable for the TI domain, we split the problem into four research questions: (RQ1) What are the characteristics of the data used for decision making within the domain of TI? (RQ2) What are the benefits and limitations of the selected uncertainty representations? (RQ3) How can the data characteristics identified in RQ1 be captured by the representations analysed in RQ2? And finally, ( RQ4) what tooling is available for the analysed uncertainty representations? RQ1 is assessed through a literature analysis, in combination with findings derived from a focus group with domain experts. RQ2 will be assessed solely though a literature analysis, and RQ3 will be addressed by means of a comparison between the answers of RQ1 and RQ2. The final question, RQ4, is briefly touched upon in Section 3.4, but we hope to obtain additional suggestions during the discussions at the RuleML+RR doctoral consortium. Organisation Section 2 introduces the TIDO ontology, and explains the core functionalities of the ontology using an example of a common decision made within the TI domain. Section 3 provides an analysis of the characteristics of the data used within the TI domain, along with an in indication on how these characteristics manifest themself within the TIDO ontology, or how a future iteration of TIDO could capture these characteristics. Section 4 provides an overview of the current progress and individual contributions of the student attending this doctoral consortium, as well as brief description of the potential impact of the overall project.
The Threat Intelligence Decision Ontology (TIDO) was developed to provide a vocabulary that can be used to describe the decision processes within the TI domain, together with the information that was used to come to those decisions. This ontology is an ongoing work, and at the moment of submission of this doctoral consortium paper, the paper accompanying the TIDO ontology is under review at the Thirteenth International Conference on Knowledge Capture (K-CAP 2025). Therefore, this introduction for the TIDO ontology will not focus on the development of the ontology, but instead focus on the main ideas and provide an intuitive explanation on how the ontology can be used to describe decision process in the TI domain. In section 4, this example will also be used to describe our current ideas on how to extend the TIDO ontology to allow for the expression of uncertainty.
Figure 1 depicts the TIDO ontology. This ontology is an extension of the PROV ontology [
TIDO-Sense: The sense-making module provides a vocabulary to describe the relationship between in@base: https://w3id.org/tido# rdfs: http://www.w3.org/2000/01/rdf-schema# prov: http://www.w3.org/ns/prov# urref: http://eturwg.c4i.gmu.edu/files/ontologies/URREF_v5_dev.owl# :was:SwealesEctxeedcBuytedBy :hasConsideration :Cost :Goal :Resolution :Case :investigates [1..N]
:questions <<rdfs:subPropertyOf>>
:supports :providesInsightsInto
:disputes <<rdfs:subPropertyOf>> :Evidence :answers :RQ ⊥ :Hypothesis : a s s u m e s :informs
:Option :Consideration prov:wasGeneratedBy [1..1] prov:wasGeneratedBy [1..1] prov:wasGeneratedBy [1..1] prov:wasGeneratedBy [1..1] :wasRecalledBy
:Orientation :contributesTo [1..N] prov:Activity :Evaluation :Activity prov:Collection prov:wasMemberOf [1..N] :hasContext :PieceOfInformation
prov:Entity urref:Information
:Agent
formation, evidence and hypotheses. Here, the class :PieceOfInformation adopts the very broad
interpretation of information in the URREF ontology [
TIDO-Option: The option module provides the vocabular to describe which options in the decision process were considered, which considerations are associated with each option, and which option was selected during a :Resolution step. Note that both the :Option and :Consideration classes are subclasses from the :PieceOfInformation class, meaning that instances of either class can also be used to provide insights into instances of the :Hypothesis class. TIDO-Case: The case module is used do describe what is being investigated. Here, the :Case class, modelled as a sub-class of prov:Collection, is a collection which contains all the pieces of information that bear some degree of relevance to the investigation. The :RQ class contains all the research questions that are investigated in the decision process.
Figure 2 provides an example of how the TIDO ontology can be used to describe a decision process
in the TI domain. This example concerns the start of an investigation by the Dutch Civil Intelligence
and Security Service (CISS) into a potential threat and is derived from the first episode of a podcast that
was co-produced by the CISS [
prov:wasInformedByprov:wasGeneratedByprotvid:woa:asnInsfwoermrsedBpyrov:wasGeneratedByprov:wasInformedBpyrov:wasGeneratedBy "A report was received by the CISS front-office" "The report originates rdf:value
from acitcizoennc"erned rdf:value "The concerned citizen
teaecnhgeinsecehreinmgi"cal rdf:value "During a practical, the noctiocnecdetrhnaetdocnietizoefnhis rdf:value students was asking many questions about substances that could be used to create an explosive"
rdf:value "Should we be concerned?" i:tttrrvsoapbuedoTAw ttiiddoo::ssuuppppoortrittdsso:supportstido:supportsi:tttrrvsapuboedoTAw itt:trrvspoabuedoTAw prov:wasAttributedTo rd lf:rdeu l:frvdaeu it:trsspopuo it:trssopupdo
d v a l:f v a u e "There is a direct cause of concern" "This situation could eventually lead to a cause of concern."
"There is not sufficient reason to be concerned" having read the presented evidence, agent 2 drafts the question that he or she will try to answer. In 3, a set of potential hypotheses is drafted that could answer , and either supporting or disputing connections are made between the pieces of evidence in set and the hypotheses in set . In the final step ( 4), agent 2 uses his or her common sense and expert knowledge to draft a set of considerations ( ) that also either support or dispute the hypotheses in .
The TIDO ontology provides a vocabulary to represent the pieces of information, activities and agents
that are part of a decision process in the TI domain. However, as mentioned in Section 1, the TIDO
ontology does not have a dedicated vocabulary to expressing uncertainties associated with the decisions
made within a TIHW. In order to determine which uncertainty representation is most appropriate,
Section 3.1 first address RQ1 and characterize the data used within the TI domain. This analysis was
primarily derived from Miller [
Miller states that ‘intelligence’ in the TI domain is an epistemic product of some process of analysis
and evaluation of information that is done with respect to diferent criteria, including the likelihood that
it is true, its importance, and relatedly, the reliability of the source. These evaluation criteria are less
concrete and inherently contain some degree of subjectivity, complicating their formalisation. Starting
with the ‘likelihood of information being true’, a distinction should be made according to the multiple
ways a ‘likelihood’ can be interpreted. This is important as the meaning of likelihood in our specific
context determines how it should be represented in a model. Using an inappropriate categorization
may result in a under- or overestimation of the risk or threat [
First, a distinction should be made in the nature of the uncertainty, where aleatoric uncertainty is the uncertainty that originates from a random process (e.g. a coin toss), and epistemic uncertainty is the uncertainty that originates from a lack of knowledge (e.g. limited sensor observability). In the TI domain, both types occur, with human behaviour begin a good example for a source of aleatoric uncertainty, and missing information concerning a target’s current location being a good example for a source of epistemic uncertainty. Here, the uncertainty regarding the location of the target can be resolved by gathering more intelligence regarding the location of the target, whereas the behaviour of the target will always contain some element of randomness, regardless of the quality of the analyst’s prediction.
Secondly, there are diferent ways in how uncertainty is derived. The objective approach uses models to calculate the uncertainty, which are generally grounded by data from past events. Generally, these models focus on representing the aleatoric component of uncertainty, but they are also capable of integrating epistemic uncertainty, such as some imperfections of sensors, as long as this uncertainty can be quantified. The subjective approach is, as the name already suggests, a less well-defined way of quantifying the uncertainty and is usually performed by domain experts, leaving room for multiple interpretations. Generally, this type of uncertainty quantification is associated with epistemic uncertainty as such quantifications are generally made when no suficiently accurate model exists, or when data from past events is missing. However, the subjective approach can also be used to express forms of aleatoric uncertainty, such as the previously mentioned example of predicting human behaviour. Again, in the TI domain, both types of uncertainty quantification are used. For instance, the uncertainty of an image classification algorithm may be expressed using a objective approach, whereas the motives of a target are better suited to be represented using a subjective approach.
Third, there is the way the uncertainty is interpreted. The probabilistic interpretation focusses on
representing uncertainty as the probability of a specific event occurring. Here, probability is defined as
‘the fraction of times an event A occurs if the situation considered were repeated an infinite number of times ’
[
The fourth dimension is whether the uncertainty is ergodic or non-ergodic. Here, ergodicity refers to whether the true (aleatoric) uncertainty of the system can be measured by taking the average deviation of the mean value over time. In an ergodic system, the value of system parameters (and their variance) does not vary over time or the phase of the system. This implies that the uncertainty derived from the analysis of past observations also generalizes to the current state of the system. Within the domain of TI, most uncertainties are expected to be to some extent non-ergodic. For example, the behavioural patterns of individuals or organisations might change over time, for instance by the discovery of a new strategy or the rise of new technologies. The previously mentioned image classifier would be an example of an ergodic uncertainty, provided that the target variable remains constant2.
Besides the ‘likelihood of being true’, Miller mentions that information should also be evaluated
according to its importance. Here, it is helpful to make a distinction between importance and relevance.
The diference between intelligence and information is that intelligence is considered to be ‘information
or data (expressible as a statement or, more likely, structured set of statements) that are acquired
for various institutional purposes’[
The final evaluation criteria mentioned by Miller is reliability of the source. Again, no operationalized description of the term ‘reliability’ is given, but we interpret it as the degree or probability with which can be assumed that the information received from this source is correct. Referring back to the example given in Figure 2, the set of evidence is provided to agent 2 by agent 1. If 2 has past experiences or background information that could indicate that evidence provided by 1 could have been manipulated or misrepresented, agent 2 could adjust a reliability score of the agent 1. In turn, this reliability score 2If an image classifier is used to classify pictures containing cars, the interpretation of the concept ‘car’ should not change. If at some point in the future flying cars are invented, changing our interpretation of what a car should look like, the uncertainty associated with our car-classifier is no longer ergodic. could be used as a discount or correction factor to the degree of uncertainty associated with the evidence set .
The previous formalisations focussed on representing the characteristics of the data used within the
TI domain. However, what is missing is which data is useful for experts in the TI domain. To address
this element, we re-analysed the competency questions (CQs) of the TIDO ontology [
Broadly speaking, there are two main ‘schools’ in uncertainty representation, diverting in how
uncertainty is interpreted. There are those that adopt the ‘probability’ perspective and aim to map every
type of uncertainty to the well-defined ‘frequentist’ interpretation of uncertainty. This has the benefit
of being compatible with the powerful Bayesian uncertainty aggregation/reasoning paradigm, but the
downside that every expression of uncertainty must be quantified in some form of a frequency
distribution which is often dificult and sometimes impossible. The other school adopts a ‘non-probabilistic’
perspective, which has a less rigid representation of uncertainty and can therefore be considered more
expressive. However, the downside here is that a custom uncertainty reasoning/aggregation paradigm
is needed, depending on the expressivity required for the application. Each of these ‘schools’ have
diferent flavours and providing a complete overview is well beyond the scope of this paper. Instead,
we will focus on the main characteristics of some variants that are particularly relevant for the task of
risk analysis. Additionally, we will focus only on uncertainty representations where the possible values
of a random value of interest can be described using a discrete set of elements. For a more detailed
description of the discussed uncertainty representations, along with how they might be applied to
continuous variables, we refer to [
Probability theory adopts the frequentist perspective on uncertainty and assumes that all variables
within the system can be described by a probability distribution function (PDF) ( ) ∶ Ω → [
Example. —- Unfortunately, an example for a potential extension to TIDO using general probability theory is still ongoing work —
Benefits:
• It is relatively simple to implement and explain [
Interval probabilities, a form of imprecise probabilities, address the previously mentioned limitation that probabilities need to be assigned the to possible values ∈ Ω of discrete random variable as a single numerical value. Instead, the likelihood of a subset ⊆ Ω being true is represented using a lower probability () and an upper probability () , creating a probability interval [ (), ()] where 0 ≤ () ≤ () ≤ 1 . The diference Δ () = () − () is referred to as the imprecision in the representation of . The single valued probabilities are the same as the special case when () = () such that Δ () = 0 .
Example. —- Unfortunately, an example for a potential extension to TIDO using interval probabilities is still ongoing work —
Benefits:
• Imprecise probabilities are still relatively simple to implement and explain [
Limitations:
• The imprecision, i.e. the diference between the upper and lower bound on the uncertainty, can
grow very quickly, creating an increasingly more conservative estimate as arithmetic operations
are applied to the imprecise probabilities [
Belief Function Theory (BFT), also known as evidence theory or Dempster-Shafer theory [14, 15], is
intended for situations where there is more information available than what can be used for interval
probabilities, but not enough information to a specific probability distribution function [
In BFT, uncertainty is represented using a basic probability assignment (BPA) in the form of a mass
distribution () over all sets in the power set () , where is the set of possible values a variable
might take. This representation of uncertainty satisfies the following requirements:
∶ () → [
∑ () = 1 ∈ () Using this representation, the belief, plausibility and commonality measures are defined by () = ∑ (), () = ⊆
∑ (), () =
∩≠∅
∑ (),
⊇
∀ ∈ ()
(2)
(3)
(4)
(5)
Example. To give an explanation on how to interpret these measures, let us have another look at the
example given in Figure 2. Let us assume that in this example, the answer to is the variable that we
wish to evaluate, and is the set of possible values the answer to might take. Then, we can define
a mass function ∶ ( ) → [
To summarize, the mass function (⋅) would take the following values: () = ⎧0.2, if = ⎪⎪0.3, if = {ℎ 1, ℎ2}
0.4, if = {ℎ 2} ⎨ ⎪0.1, if = {ℎ 3} ⎪ ⎩0, otherwise
Now, let us revisit the belief, plausibility and commonality measures defined in 3. In the current example, belief ((⋅) ) is interpreted as the degree of certainty to which the analyst believes that, based on the available evidence in set and his considerations in set , the true answer to is assigned to the set or a subset of . The plausibility measure ( (⋅) ) can be interpreted as the degree of certainty to which evidence and considerations assign the answer for to any set in () that overlaps with . Finally, the commonality measure ((⋅) ) interpreted as the degree of certainty to which evidence and considerations assign the answer for to or a superset of .
Combining 3 with 4, we get the following values for the belief, plausibility and commonality functions: ({ℎ ({ℎ ({ℎ ( ) = 1, 1, ℎ2}) = 0.9, 1, ℎ3}) = 0.1, 2, ℎ3}) = 0.4, ({ℎ ({ℎ ({ℎ
Looking at the values in 5, we see that out of the singleton values ℎ1, ℎ2 and ℎ3, the belief, plausibility and commonality measures for ℎ2 are the highest, indicating that ℎ2 would most likely be the best answer to . However, there is still a gap between ({ℎ 2}) and ({ℎ 2}), indicating that there is still a relatively high degree of epistemic uncertainty associated with ℎ2. Therefore, an analyst might decide to first investigate the case further to lower his or her degree of epistemic uncertainty before making a definitive decision on what he or she considers to be the best answer to .
Benefits:
• The BPA can be constructed with almost any kind of data. For instance, regular probabilities
can be assigned to the singleton values in , and complete ignorance can be modelled by setting
() = 1 [
• Again, it is relatively simple to implement [
Limitations:
• When combining multiple BPAs, not only should you be cautious of dependencies between the
used evidence, the shape of the mass functions should also be considered when selecting an
appropriate combination rule. For instance, one of the most popular rules to do so, Dempster’s
rule, produces unintuitive results when faced with contradicting mass functions [
The presented work in the previous section provides a preliminary idea of how a potential uncertainty representation might be integrated into the TIDO ontology, focussing on how the uncertainty of hypotheses derived within a TIHW could be represented. We consider this to be the first step answering RQ3, but other steps are still to be taken. We have roughly divided the required extensions to TIDO into five steps, as depicted in Figure 3, and we plan on addressing these steps one at the time.
We believe that the expression over the uncertainty over the available hypotheses should be the first
point addressed in the uncertainty representation of TIDO as this represents how the analyst has
interpreted the available information and provides the foundation for follow-up actions. Being certain
about a hypothesis, or a group of hypotheses, being true could be used as an argument for mitigating
actions, where as a high degree of uncertainty could be used as an argument to investigate further. The
example provided in Section 3.2.3 provides an indication of what an uncertainty representation for the
hypothesis set might look like. However, the following points should also be addressed before step 1
can be considered finished:
Finish examples: As of yet, only the example for BFT has been worked out. Before a proper
comparison can be made between BFT and basic probability theory and interval probabilities, the
examples for these cases will need to be worked out as well. Alternatively, we could focus our
attention on the probability bound analysis (PBA) paradigm, which combines basic probability
theory with interval probabilities [
Expert elicitation: For the example in Section 3.2.3, educated guesses were made on what a possible mass function could look like given the data depicted in Figure 2. However, if the TIDO ontology is to be used by domain experts, a quantified degree of belief over the available hypothesis must be derived from the experts’ input. For the elicitation of mass functions, many methodologies exist, such as the audit risk model [21], the Analystical Hierachy Process (AHP) [22], a pair-wise ranking based procedure [23], and a methodology using Likert-scales [24]. Expert elicitation techniques for obtaining subjective probabilities or probability intervals still need to be investigated. The feasibility of implementing a suitable elicitation methodology should also play an important role in the selection of the uncertainty representation for TIDO.
Representation in a knowledge graph: In order to capture the data, it must somehow be stored in a database. As the TIDO ontology is based on the Web Ontology Language (OWL), it is important to think about how the uncertainty can represented such that it is compatible with the OWL syntax, or more specifically the Resource Description Framework (RDF). For example, directly implementing BFT would require mass values associated not only with the singletons in the set of hypotheses , but also with the elements in the powerset of . Worst case scenario, every element in the powerset of H would need a unique node in the graph, resulting in an exponential growth in the amount of nodes in the KG with respect to the size of . Not only could this substantially increase the required storage capacity, it might also make it more dificult to retrieve this information from the graph using SPARQL queries. Some OWL ontologies already exist to represent uncertainties, and before designing a custom extension to TIDO, potential mappings from TIDO to these ontologies should be investigated. For probability theory, PR-OWL [25] could be an option and for BFT, BeliefOWL [26] could be an option. No OWL ontology was found for probability intervals.
Once step 1 is completed, there is an uncertainty representation that allows a TI expert to represent their belief about the uncertainties associated with the hypotheses in , which, ideally, the expert derives Stepphhhhr2oaaaavssssiIIIIdmmmm?ei:tttrrvsopabuedoTAwppppspooooCttriirrrrddoottttooaaaavn::nnssnnidduuccccippeteeeeippso????ooCntrri"ttdassSoc?oolhn:?psnodpurcrudirpoetlfodip:vrovvnoiawndreiltdueasdetee?lisbd?s"CoeC:soounpndpdio?tirittoisoi:tttrrvsoapuebdoTAwnna?al?i:tttrrsvoapbuedoTAwl? hi:tttrrvsopabuedoTAwhahhasaaPsssCCrCoeeebrrratttaaabiiininnlhihthtttyyayaya???s?shsCUaPosplaBmpueemslriiBebofionl?iuatylf:rvdaeulni?tdl:frvdauey??l:frveuad i:ttrssuopop it:trssopupod??"ecTc"v?ahaTeuiuhsnsseteseurieatooulflifayscctoilaooennnadccdiecreeortroncnut."la"d
d hasLowerBound? ?suff"iTciheenrtereisansoont to ? hasVariance? be concerned" ?
? tido:Evidence from the pieces of evidence in and the considerations in . However, there is no vocabulary for the expert to precisely express how these pieces of evidence and considerations influence the uncertainty associated with the elements in . This information could be very useful when determining to what degree each piece of evidence or consideration contributed to the uncertainty distribution over the hypothesis, and consequently, the final decision. The TIDO ontology does provide the opportunity for the expert to express whether pieces of information support (using tido:supports) or dispute (using tido:disputes) a hypothesis, but the efect of using these relations on the uncertainty associated with the hypotheses in is not formalized. To formalize this relationship, some form of a conditional probability distributions ( (|⋅) ) or conditional belief masses ( (|⋅) ) would be needed, where ∈ ( ) and ⋅ would be a piece of information relevant for answering research question .
To implement this step, the same points need to be addressed as for step 1: What would a working example look like for each of the selected uncertainty representations? How would we elicit the needed numerical values from the experts? And how could this be represented in a KG? As of yet, these points have not been investigated, although we expect to encounter challenges when addressing the dependencies that exist within the available information. For example, the pieces of evidence 3 and 4 depicted in figure 2 show a clear dependency as 3 provides an indication that ‘concerned citizen’ in 4 is knowledgeable about explosive substances, increasing the degree to which 4 provides an indication for hypothesis ℎ1.
In Section 3.1 we discussed that we use the term relevance for refer to the relevance of pieces of information to the case investigation, and the term importance to describe the relevance of a piece of information with respect to the research question. Therefore, we can use formal representations of relevance to model our notion of importance. For example, we can capture this context dependence by introducing a distance measure, as it is commonly done in frameworks that need to deal with diferent levels of relevance [27, 28]. In our case, we could define a distance between the pieces of information used within the analysis and the research question.
Several options exist for accounting for the reliability of the source in a potential uncertainty
representation for TIDO. The author of [
The final step that warrants investigation is the representation of uncertainty over the evidence set . Both the hypotheses set and the consideration set are generated by agent 2, implying that agent 2 is also responsible for providing the uncertainties associated with the elements in and . However, the elements in are provided by a diferent agent 1. In theory, this agent could represent the uncertainties associated with the pieces of information completely diferent from how 1 would represent these uncertainties. For example, 1 could use interval probabilities to express its uncertainties, whereas 2 could us BFT. If 2 is to use the uncertainties provided by 1 to make assessments about the hypotheses in , the uncertainties from 1 would need to be translated to a representation compatible with the uncertainty representation of 2. Following this line of reasoning, it would make sense for 2 to use the most expressive form of uncertainty representation, but the possibility utilizing some form of a translation function should be investigated as well.
Start of the
PhD
Current position
End of the
PhD Stage 1
Stage 2
Stage 3 March 2023
March 2024
March 2025
March 2026
March 2027 Familiarisation with the domain: - Understanding the threat intelligence domain - Determining a suitable use case - Getting familiar with semantic technologies Reasoning over uncertain data: - Characterise uncertainty in TI domain - Determine suitable uncertainty representation - Extend previously developed ontology
Vocabulary adaptation to selected use case: - Requirement analysis - Ontology development - Ontology validation
As mentioned in Section 1, our overview of the available tooling to represent and reason over uncertainties is limited, and we hope to obtain interesting leads during the doctoral consortium. So far, with respect to modelling probabilistic ontologies, we have found PR-OWL [25] and BayesOwl [31], which both represent the uncertainties in the form of Bayesian networks. While either of these frameworks appear to be suitable if we opt to represent the uncertainties in TIDO using standard probability theory, these frameworks do not appear to be compatible with interval probabilities or BFT. With respect to BFT, we only found a single position paper introducing the core concepts of BeliefOWL [26], but a complete implementation of this ontology appears to be absent. For interval probabilities, we were not able to find an published OWL-based ontology. Instead, we could investigate the usage of the pba-for-python Python package [32] if we do not wish to implement such an ontology ourselves.
The aim of the presented research is to develop a vocabulary capable of representing a Threat Intelligence Hybrid Workflow (TIHW). The contribution of the student to this work is summarized in three stages: (1) The start-up of the project, where the main goal is to get familiar with the domain, (2) the adaptation of available vocabularies to a use-case identified during the first phase, and (3) the integration of an uncertainty reasoning paradigm into the ontology developed in the second phase. A timeline of these phases is shown in Figure 4.
The first two phases can be considered as completed with the development of the TIDO ontology described in Section 2. The remainder of the work presented in this consortium paper represents the ifrst steps towards the third phase. In this phase, the student extended the domain analysis of the TI domain with a characterisation of the data used within this domain, as presented in Section 3.1. Afterwards, three diferent uncertainty representations, general probability theory, interval probabilities and belief function theory, are analysed in Section 3.2. Based on this analysis, a first step is made in the integration of an uncertainty representation into the TIDO ontology in Section 3.3.
Up until now, our focus has mainly been on belief function theory, but the upcoming time will be spend on drafting similar examples for the general probability theory and interval probability implementations. Afterwards, we will investigate how to integrate conditional probabilities and belief functions, our notion of importance with respect to the research question, the reliability of the source, and the uncertainty representation for information originating from external sources. Additionally, we still wish to investigate what tooling is available that allows for reasoning over uncertain information using the formalisms we previously analysed.
As for the potential achievements of this research, we believe that incorporating a suitable uncertainty representation into the TIDO ontology would substantially improve its ability to accurately capture the TIHW. As the decision processes within the TI domain are greatly influenced by the uncertainties associated with the information used within these processes, an accurate representation of these uncertainties would not only allow an analyst to make a better assessment of the situation, but also allow for the reconstruction of the perceived uncertainties during an audit of such a TIHW.
This PhD project is supervised by Professor Fabio Massacci, and co-supervised by Associate Professor Stefan Schlobach and Assistant Professor Lise Stork. Additionally, the author would like to thank Daira Pinto Pietro for her discussions on how to possible integrations of belief function theory into the TIDO ontology. Finally, we gratefully acknowledge the funding support by the Nederlandse Organisatie voor Wetenschappelijk Onderzoek (NWO) under the KIC HEWSTI Project with grant no. KIC1.VE01.20.004.
During the preparation of this work, the authors used Gemini 2.5 Flash in order to: Paraphrase and reword, Grammar and spelling check. After using this tool, the authors reviewed and edited the content as needed and take full responsibility for the publication’s content.