A two-level model of knowledge organization in ontology-based cybersecurity systems

In the context of improving the effectiveness of knowledge management in intelligent cyber defense systems (ICDS), the task at hand is to organize knowledge based on a cyber-threat ontology using the MITRE ATT&CK and MITRE CAPEC taxonomies, as well as datasets from the European Repository of Cyber Incidents (EuRepoC). The relevance of this is driven by the need for rapid integration of the growing volumes of cyberattack data into the existing semantic core of the ICDS. Moreover, existing approaches to the unification and formalization of heterogeneous data in the cybersecurity domain do not ensure the rapid and controlled integration of new knowledge into the semantic core for the full-fledged formation of a single coherent, semantically interoperable knowledge space; but instead focus exclusively on the superficial consolidation of ontological resources from individual vendors, accompanied by limited scalability and a high level of abstraction, which complicates the representation of cause-and-effect relationships between elements of cyber threats. In this regard, a model of a two-level ontology-based knowledge organization in ICDS has been developed. The essence of the proposed model lies in formalizing the process of controlled integration of dynamic streams of fragmented data from the cyber defense domain through a procedure of contextual consistency between the dynamic and static levels based on the calculation of a comprehensive knowledge candidate readiness index. The effectiveness of the proposed model was evaluated through the automated sequential input of 36,824 data vectors from 4 datasets (MITRE and EuRepoC). As a result, 23,830 new entities were added to the ontology with an average formalization readiness index of 0.76 and an overall ontology consistency index of 99%, indicating that the ontology retains its ability to support the formation of logical inferences within the current context while significantly enriching its factual content.