RiskOnto: An ontology-driven framework for threat modeling, risk reasoning and cyber defense knowledge integration

We present RiskOnto, an OWL 2 DL ontology-driven framework for automated cybersecurity risk assessment that integrates MITRE ATT&CK, MITRE D3FEND, MITRE CWE, the NIST Cybersecurity Framework (CSF) 2.0, and NIST SP 800-53 Revision 5. RiskOnto comprises 103,906 RDF triples organized around 121 VulnerabilityProfile archetypes that represent recurring vulnerability patterns and serve as semantic anchors for cross-framework reasoning. Offline materialization of 13 global SWRL rule specifications, organized into three functional sublayers, produced 19,671 reusable semantic assertions (from the 8 inference/explanation rules, R1–R4/E1–E4) and 847 VP-level hasJustification links to typed XAI justification/explanation individuals (from the remaining 5, X1–X5). The core-reasoning sublayer infers NIST CSF impacts and propagates ATT&CK mitigation and MITRE D3FEND recommendations. The explainability sublayer generates rule-grounded assertions covering risk, candidate NIST CSF 2.0 framework-outcome associations, mitigations, and defenses, while the structured XAI sublayer links vulnerability profiles to typed justification and recommendation records that support transparent and auditable risk decisions. Risk is represented using an ordinal Impact × Likelihood model informed by NIST SP 800-30 Rev. 1, assigning scores from 1 to 25 across five criticality tiers, from Very Low to Critical, represented by 352 RiskAssessment individuals. A System Under Test (SUT) integrates with the shared knowledge base through a standardized six-step pipeline using a single OWL import declaration and SUT-specific vulnerability-profile links, without modifying RiskOnto. We validate the framework using WebGoat 2025.4-SNAPSHOT, a deliberately insecure Spring Boot application. Four heterogeneous scanner tools generated 273 raw findings, of which 166 were within the current CWE-representable canonicalization scope and consolidated into 43 canonical security findings; 107 findings remained outside the current CWE-based canonicalization scope. All 43 canonical findings activated at least one VulnerabilityProfile, demonstrating complete workflow coverage of the normalized security findings, while not establishing semantic correctness of every association. The case study demonstrates RiskOnto’s ability to consolidate heterogeneous security evidence, perform reusable cross-framework semantic reasoning, identify framework outcomes potentially associated with vulnerabilities, represent risk, and generate traceable cybersecurity recommendations.