The rapid growth in magnitude and complexity of cyber-security information and event management (CSIEM) has ignited a trend toward security automation and information exchange standards. Making Security Measurable (MSM) references a collection of open community standards for the common enumeration, expression and reporting of cyber-security-related information. While MSM-related standards are valuable for enabling security automation; insufficient vocabulary management and data interoperability methods as well as domain complexity that exceeds current representation capabilities impedes the adoption of these important standards. This paper describes an Agile, ontology architecture-based approach for improving the ability to represent, manage, and implement MSM-related standards. Initial cross-standard analysis revealed enough common concepts to warrant four ontologies that are reusable across standards. This reuse will simplify standards-based data interoperability. Further, early prototyping enabled us to streamline vocabulary management processes and demonstrate the ability to represent complex domain semantics in OWL ontologies.
Through its Making Security Measurable [
While MSM-related standards are valuable for enabling security automation;
insufficient vocabulary management and data interoperability methods as well as
domain complexity that exceeds current representation capabilities impedes the
adoption of these important standards. This paper describes an Agile Development
[1], ontology architecture-based approach for improving the ability to represent,
manage, and implement MSM-related standards. The Cyber-Security Ontology
Architecture is a loosely-coupled, modular representation that is resilient to rapid
change and complexity. Architecture-based services and applications are free to
combine and extend architecture components at implementation time to fit
application-specific contexts without having to implement a single monolithic model.
The result is improved ability to support security automation, vocabulary
management, and data interoperability. Initial cross-standard analysis revealed
enough common concepts to warrant four ontologies that are reusable across
standards. This reuse is one way that this approach will simplify standards-based data
interoperability. Further, early prototyping enabled us to streamline vocabulary
management processes and demonstrate the ability to represent complex domain
semantics in OWL ontologies that are difficult or not possible to represent using the
Relational Database (RDB) and XML Schema (XSD) [
This section provides background descriptions of ontology architecture and controlled vocabulary in the context of this paper.
An ontology architecture is a conceptual information model comprised of a
looselycoupled federation of modular ontologies that form the structural and semantic
framework of an information domain. Ontology architectures have been used to relate
upper ontologies to their middle and domain level extensions [
The vocabulary of complex, dynamic domains such as cyber-security often include atypical linguistic expressions such as acronyms, idioms, and numeric codes. It is important to recognize that although these linguistic expressions are not standard language terms, they form an accepted vocabulary in the context of the domain. This perspective of what constitutes a vocabulary calls for a broad definition of controlled vocabulary (CV). In this context, a controlled vocabulary is a collection of linguistic expressions that is vetted by an authority (e.g. a community) according to a set of criteria. All of the MSM standards maintain some form of a controlled vocabulary. These vocabularies were developed independently of each other, and are at various stages of maturity that range from a few months to ten years of active development. 3
The three major obstacles inhibiting the widespread adoption of the MSM-related standards are:
Unsustainable vocabulary management processes: Vocabulary management
involves thousands of manually developed and managed value enumerations and
vocabulary representations that are mostly encoded in XSD. The MSM-related
standards are growing rapidly in number, volume and complexity. Some of the
standards are adding hundreds to thousands of enumeration entries per month. A
semantic approach to vocabulary management would streamline the vocabulary
management process and reduce human error.
2. Ineffective data interoperability methods: Data interoperability activities are
largely driven by the SCAP Validation program, which among other things,
requires security tool vendors to translate proprietary output to a common
expression and reporting form in order to achieve SCAP compliance [
Rapidly evolving, complex domain semantics that exceed the representation capability of the RDB and XSD technologies in which the standards are currently implemented: Domain complexity issues such as how to represent the behavioral aspects of malware, and relating numerous software versioning schemes, call for a more semantic representation than either XSD or RDB technologies alone can readily provide. The semantics of these technologies are currently represented mostly in human interpretable documentation, which is not automatable or machine processable.
The following sections of this document describe how a well-designed ontology
architecture coupled with a semantic technology-based approach to information
management could improve the productivity and efficiency of MSM-related standards
development, management and implementation [
We take an Agile Development approach (Agile approach), to ontology architecture design, development, and implementation [1]. Agile Development begins with an envisioning phase in which we rapidly collect and prioritize user needs, perform coarse grained architecture modeling, and roughly estimate scope. Then we implement the architecture by building incremental capability in short design and development cycles called sprints. The intent is to allow the architecture to gradually evolve based on emerging stakeholder requirements and lessons learned from each sprint [1]. When fully mature, the Cyber-Security Ontology Architecture will represent a comprehensive, standards-based family of ontologies. 4.1
We gathered high level requirements from domain experts, which are expressed as obstacles to adoption in Section 3 of this document. Then we developed a coarse model of the CSIEM lifecycle to provide a rough estimate of scope. We mapped the current MSM-related controlled vocabularies (CVs) to the CSIEM lifecycle model to produce a CV architecture as illustrated in Figure 1. Acronym expansions for the standard names in Figure 1 are located in the References section, reference numbers 1,2,3,4,5,6,7,12,14,18, and 29.
Finally, we performed a vocabulary analysis, identifying gaps and overlaps while
extracting common concepts for reuse across vocabularies. Results are illustrated in
the first draft Cyber-Security Ontology Architecture as illustrated in Figure 2
[
The lowest tier of the architecture designates the standards value-level CV content
followed by the CV representations in the third tier. These two CV tiers are the
sources for the upper two ontology-level architecture tiers. Above the CV tiers, the
third tier contains ontologies that are specific to the cyber-security domain. Finally the
upper-most tier contains common ontologies that emerged from vocabulary overlap
analysis. Development of the first draft Cyber-Security Ontology Architecture marks
the end of the envisioning phase of development and the beginning of Sprint 1
implementation. The ontologies that are encircled with red ovals are those that have
been developed or adopted during the Sprint 1 implementation phase. We adopt or
derive from existing ontologies where possible. The ontologies are encoded in the
Web Ontology Language (OWL) [
Sprint 1 focused on improving the vocabulary management process and produced five
ontologies. Four of these are common ontologies, including: an OWL (Web Ontology
Language) representation of the Dublin Core metadata standard [
Acknowledgement Thank you to MITRE subject matter experts Matthew Wojcik, Jonathan Baker and David Mann for their valuable contributions to this research.