Ontologies for Security Requirements: A Literature Survey and Classification
---
paper_title: Toward principles for the design of ontologies used for knowledge sharing?

paper_content:

Recent work in Artificial Intelligence is exploring the use of formal ontologies as a way of specifying content-specific agreements for the sharing and reuse of knowledge among software entities. We take an engineering perspective on the development of such ontologies. Formal ontologies are viewed as designed artifacts, formulated for specific purposes and evaluated against objective design criteria. We describe the role of ontologies in supporting knowledge sharing activities, and then present a set of criteria to guide the development of ontologies for these purposes. We show how these criteria are applied in case studies from the design of ontologies for engineering mathematics and bibliographic data. Selected design decisions are discussed, and alternative representation choices and evaluated against the design criteria.
---
paper_title: Revisiting Ontology-Based Requirements Engineering in the age of the Semantic Web

paper_content:

There is a long history of research into utilising ontologies in the Requirements Engineering process. An ontology is generally based upon some logical formalism, and has the benefits for requirements of explicitly modelling domain knowledge in a machine interpretable way, e.g. allowing requirements to be traced and checked for consistency by an inference engine, and software specifications to be derived. With the emergence of the semantic web, the interest in ontologies for Requirements Engineering is on the increase. Whilst efforts have been concentrated upon re-interpreting software engineering techniques for the semantic web, it is interesting to consider what benefits there are to be passed from the semantic web to traditional Software Engineering techniques. In this paper we give an overview of this emerging research field, suggesting directions that could usefully be taken in the field of dependability requirements. We present our work on a dependability ontology compliant with the IFIP Working Group 10.4 taxonomy and discuss how this, and other ontologies, must interact in the course of Dependability Requirements Engineering. In particular we consider the links between the dependability ontology, an ontology for requirements and domain ontologies, identifying the advantages and difficulties of this approach.
---
paper_title: Formalizing information security knowledge

paper_content:

Unified and formal knowledge models of the information security domain are fundamental requirements for supporting and enhancing existing risk management approaches. This paper describes a security ontology which provides an ontological structure for information security domain knowledge. Besides existing best-practice guidelines such as the German IT Grundschutz Manual also concrete knowledge of the considered organization is incorporated. An evaluation conducted by an information security expert team has shown that this knowledge model can be used to support a broad range of information security risk management approaches.
---
paper_title: Assessing the value of IS journals

paper_content:

Using journal citation reports to determine the influence and impact of a variety of journals publishing IS research.
---
paper_title: A Systems Approach to Conduct an Effective Literature Review in Support of Information Systems Research

paper_content:

This paper introduces a framework for conducting and writing an effective literature review. The target audience for the framework includes information systems (IS) doctoral students, novice IS researchers, and other IS researchers who are constantly struggling with the development of an effective literature-based foundation for a proposed research. The proposed framework follows the systematic data processing approach comprised of three major stages: 1) inputs (literature gathering and screening), 2) processing (following Bloom’s Taxonomy), and 3) outputs (writing the literature review). This paper provides the rationale for developing a solid literature review including detailed instructions on how to conduct each stage of the process proposed. The paper concludes by providing arguments for the value of an effective literature review to IS research.
---
paper_title: Security Ontology for Annotating Resources

paper_content:

Annotation with security-related metadata enables discovery of resources that meet security requirements. This paper presents the NRL Security Ontology, which complements existing ontologies in other domains that focus on annotation of functional aspects of resources. Types of security information that could be described include mechanisms, protocols, objectives, algorithms, and credentials in various levels of detail and specificity. The NRL Security Ontology is more comprehensive and better organized than existing security ontologies. It is capable of representing more types of security statements and can be applied to any electronic resource. The class hierarchy of the ontology makes it both easy to use and intuitive to extend. We applied this ontology to a Service Oriented Architecture to annotate security aspects of Web service descriptions and queries. A refined matching algorithm was developed to perform requirement-capability matchmaking that takes into account not only the ontology concepts, but also the properties of the concepts.
---
paper_title: Formalizing information security knowledge

paper_content:

Unified and formal knowledge models of the information security domain are fundamental requirements for supporting and enhancing existing risk management approaches. This paper describes a security ontology which provides an ontological structure for information security domain knowledge. Besides existing best-practice guidelines such as the German IT Grundschutz Manual also concrete knowledge of the considered organization is incorporated. An evaluation conducted by an information security expert team has shown that this knowledge model can be used to support a broad range of information security risk management approaches.
---
paper_title: An ontology description for SIP security flaws

paper_content:

Voice over IP (VoIP) services based on the Session Initiation Protocol (SIP) gain ground as compared to other protocols like MGCP or H.323. However, the open SIP architecture constitutes the provided services vulnerable to various attacks, similar to those currently existing in Internet. The lack of a formal way to describe VoIP vulnerabilities hinders the development of tools that could be utilized for identifying such vulnerabilities or for testing the security level of the offered services, in both cases the tools being independent from a specific implementation. This paper introduces such a formalization for SIP-based VoIP services, utilizing ontologies, facilitating an extensible description of known SIP security vulnerabilities that can be employed in a real environment for testing or intrusion detection purposes.
---
paper_title: Security Attack Ontology for Web Services

paper_content:

Web services (WS) have become a significant part of the Web because of such attractive features as simple to use, platform independence, and XML/SOAP support. However, these features make WS vulnerable to many new and inherited old security threats. Semantic WS, which are capable of publishing semantic data about their functional and nonfunctional properties, add even more security issues. Now, it becomes easier to attack WS because their semantic data is publicly available. To register and prevent these attacks, especially distributed attacks, new distributed firewalls and intrusion detection systems (F/IDS) have to be applied. However, these F/IDS can be developed by different vendors and they do not have the way to cooperate with each other. This problem can be solved if various F/IDS share a common vocabulary, which can be based on ontologies, to allow them to interact with each other. In this paper, we describe WS security threats and state that they have to be analysed and classified systematically in order to allow the development of better distributed defensive mechanisms for WS using F/IDS. We choose ontologies and OWL/OWL-S over taxonomies because ontologies allow different parties to evolve and share a common understanding of information which can be reasoned and analysed automatically. We develop the security attack ontology for WS and illustrate the benefits of using it with an example.
---
paper_title: OWL-S semantics of security Web Services: a case study

paper_content:

The power of Web services (WS) technology lies in the fact that it takes integration to a new level. With the increasing amount of services available on the Web, solutions are needed that address security concerns of distributed Web service applications such as end-to-end service requirements for authentication, authorization, data integrity and confidentiality, and non-repudiation in the context of dynamic WS applications. Semantic Web technology and Semantic Web services (SWSs) promise to provide solutions to the challenges of dynamically composed service-based applications. We investigate the use of semantic annotations for security WS that can be used by matchmakers or composition tools to achieve security goals. In the long-term we aim at establishing a security framework for SWS applications that include security services, authentication and authorization protocols, and techniques to exchange and negotiate policies. In this paper, we report on the first step toward this larger vision: specification, design, and deployment of semantically well-defined security services.
---
paper_title: Security Ontology for Annotating Resources

paper_content:

Annotation with security-related metadata enables discovery of resources that meet security requirements. This paper presents the NRL Security Ontology, which complements existing ontologies in other domains that focus on annotation of functional aspects of resources. Types of security information that could be described include mechanisms, protocols, objectives, algorithms, and credentials in various levels of detail and specificity. The NRL Security Ontology is more comprehensive and better organized than existing security ontologies. It is capable of representing more types of security statements and can be applied to any electronic resource. The class hierarchy of the ontology makes it both easy to use and intuitive to extend. We applied this ontology to a Service Oriented Architecture to annotate security aspects of Web service descriptions and queries. A refined matching algorithm was developed to perform requirement-capability matchmaking that takes into account not only the ontology concepts, but also the properties of the concepts.
---
paper_title: Modeling Computer Attacks: An Ontology for Intrusion Detection

paper_content:

We state the benefits of transitioning from taxonomies to ontologies and ontology specification languages, which are able to simultaneously serve as recognition, reporting and correlation languages. We have produced an ontology specifying a model of computer attack using the DARPA Agent Markup Language+Ontology Inference Layer, a descriptive logic language. The ontology’s logic is implemented using DAMLJessKB. We compare and contrast the IETF’s IDMEF, an emerging standard that uses XML to define its data model, with a data model constructed using DAML+OIL. In our research we focus on low level kernel attributes at the process, system and network levels, to serve as those taxonomic characteristics. We illustrate the benefits of utilizing an ontology by presenting use case scenarios within a distributed intrusion detection system.
---
paper_title: Security in the Semantic Web using OWL

paper_content:

Information assurance, security, and privacy have moved from narrow topics of interest to information system designers to become critical issues of fundamental importance to society. This opens up new requirements and opportunities for novel approaches. Meeting this challenge requires to advance the theory and practice of security, privacy, and trust of Web-based applications and to provide declarative policy representation languages and ontologies together with algorithms to reason about policies. This paper summarizes an ontological approach to enhancing the Semantic Web with security.
---
paper_title: Towards an Ontology of Trust

paper_content:

Trust is a fundamental factor when people are interacting with each other, hence it is natural that trust has been researched also in relation to applications and agents. However, there is no single definition of trust that everybody would share. This, in turn, has caused a multitude of formal or computational trust models to emerge to enable trust use and dependence in applications. Since the field is so diverse, there also exists a confusion of terminology, where similar concepts have different names and, what is more disturbing, same terms are also used for different concepts. To organize the research models in a new and more structured way, this paper surveys and classifies thirteen computational trust models by the trust decision input factors. This analysis is used to create a new comprehensive ontology for trust to facilitate interaction between business systems.
---
paper_title: Ontology Development for Industrial Risk Analysis

paper_content:

Risk analysis is a process dedicated to describe scenarios leading to hazards and potential accidents on an industrial facility. In order to realize a risk analysis, experts refer to different resources (hazard studies, expertise, etc.) which are often difficult to exploit because they are not sufficiently structured and formalized. This paper presents an ongoing project that aims to develop an industrial risk analysis support system. Our approach consists of three main phases. The first is to develop a knowledge base of industrial safety based on ontologies. The second phase is to index safety-related resources by concepts of the developed ontologies, which led to the realization of an information retrieval system. Given the nature of knowledge available at industrial organizations, the third phase aims to develop a case-based reasoning (CBR) system, associated to the developed ontologies, in order to help experts realize risk analysis studies using already existing ones.
---
paper_title: An ontology for secure e-government applications

paper_content:

This paper addresses the issue of accommodating security requirements in application development. It proposes the use of ontologies for capturing and depicting the security experts' knowledge. In this way developers can exploit security expertise in order to make design choices that help them fulfil security requirements more effectively. We have developed a security ontology for two different application scenarios to illustrate its use. To validate the ontology we have used queries.
---
paper_title: An Extended Ontology for Security Requirements

paper_content:

Security concerns for physical, software and virtual worlds have captured the attention of researchers and the general public, thanks to a series of dramatic events during the past decade. Unsurprisingly, this has resulted in increased research activity on topics that relate to security requirements. At the very core of this activity lies the problem of determining a suitable set of concepts (aka ontology) for modeling security requirements. Many proposals for such ontologies exist in the literature. The main objective of this paper is to amalgamate and extend the security ontologies proposed in [1] and [2]. The amalgamation includes a careful comparison of primitive concepts in Problem Frames and Secure Tropos, but also offers a novel account for rather nebulous security concepts, such as those of vulnerability and threat. The new concepts are justified and related to the literature. Moreover, the paper offers a number of security requirements adopted from industrial case studies, along with their respective representation in terms of the proposed ontology.
---
paper_title: Ontologies and Information Systems: A Literature Survey

paper_content:

Abstract : An ontology captures in a computer-processable language the important concepts in a particular domain and the relationships between these concepts. Ontologies are becoming increasingly pervasive in various fields of computer and information science. They are indispensable components of many complex information systems, especially systems in which communication among heterogeneous components is critical. I use the following definition of ontology, which captures the essence of the most widely adopted definitions in the field: an ontology is a specific, formal representation of a shared conceptualisation of a domain. The IO Branch of DSTO's C3ID Division is interested in the possibility of using one or more ontologies to describe computer networks and support automated reasoning about their properties (particularly security properties). This report provides a basic overview of research and development related to ontologies and their use in information systems. The primary goal of the report is to help readers to discover topics of interest and to conduct further investigation of the literature. To this end, besides information about ontologies in general, the report also includes some specific comments about the use of ontologies to model and reason about computer networks and their security.
---
paper_title: An ontology description for SIP security flaws

paper_content:

Voice over IP (VoIP) services based on the Session Initiation Protocol (SIP) gain ground as compared to other protocols like MGCP or H.323. However, the open SIP architecture constitutes the provided services vulnerable to various attacks, similar to those currently existing in Internet. The lack of a formal way to describe VoIP vulnerabilities hinders the development of tools that could be utilized for identifying such vulnerabilities or for testing the security level of the offered services, in both cases the tools being independent from a specific implementation. This paper introduces such a formalization for SIP-based VoIP services, utilizing ontologies, facilitating an extensible description of known SIP security vulnerabilities that can be employed in a real environment for testing or intrusion detection purposes.
---
paper_title: Security Attack Ontology for Web Services

paper_content:

Web services (WS) have become a significant part of the Web because of such attractive features as simple to use, platform independence, and XML/SOAP support. However, these features make WS vulnerable to many new and inherited old security threats. Semantic WS, which are capable of publishing semantic data about their functional and nonfunctional properties, add even more security issues. Now, it becomes easier to attack WS because their semantic data is publicly available. To register and prevent these attacks, especially distributed attacks, new distributed firewalls and intrusion detection systems (F/IDS) have to be applied. However, these F/IDS can be developed by different vendors and they do not have the way to cooperate with each other. This problem can be solved if various F/IDS share a common vocabulary, which can be based on ontologies, to allow them to interact with each other. In this paper, we describe WS security threats and state that they have to be analysed and classified systematically in order to allow the development of better distributed defensive mechanisms for WS using F/IDS. We choose ontologies and OWL/OWL-S over taxonomies because ontologies allow different parties to evolve and share a common understanding of information which can be reasoned and analysed automatically. We develop the security attack ontology for WS and illustrate the benefits of using it with an example.
---
paper_title: Formalizing information security knowledge

paper_content:

Unified and formal knowledge models of the information security domain are fundamental requirements for supporting and enhancing existing risk management approaches. This paper describes a security ontology which provides an ontological structure for information security domain knowledge. Besides existing best-practice guidelines such as the German IT Grundschutz Manual also concrete knowledge of the considered organization is incorporated. An evaluation conducted by an information security expert team has shown that this knowledge model can be used to support a broad range of information security risk management approaches.
---
paper_title: Security Ontology for Annotating Resources

paper_content:

Annotation with security-related metadata enables discovery of resources that meet security requirements. This paper presents the NRL Security Ontology, which complements existing ontologies in other domains that focus on annotation of functional aspects of resources. Types of security information that could be described include mechanisms, protocols, objectives, algorithms, and credentials in various levels of detail and specificity. The NRL Security Ontology is more comprehensive and better organized than existing security ontologies. It is capable of representing more types of security statements and can be applied to any electronic resource. The class hierarchy of the ontology makes it both easy to use and intuitive to extend. We applied this ontology to a Service Oriented Architecture to annotate security aspects of Web service descriptions and queries. A refined matching algorithm was developed to perform requirement-capability matchmaking that takes into account not only the ontology concepts, but also the properties of the concepts.
---
paper_title: Modeling Computer Attacks: An Ontology for Intrusion Detection

paper_content:

We state the benefits of transitioning from taxonomies to ontologies and ontology specification languages, which are able to simultaneously serve as recognition, reporting and correlation languages. We have produced an ontology specifying a model of computer attack using the DARPA Agent Markup Language+Ontology Inference Layer, a descriptive logic language. The ontology’s logic is implemented using DAMLJessKB. We compare and contrast the IETF’s IDMEF, an emerging standard that uses XML to define its data model, with a data model constructed using DAML+OIL. In our research we focus on low level kernel attributes at the process, system and network levels, to serve as those taxonomic characteristics. We illustrate the benefits of utilizing an ontology by presenting use case scenarios within a distributed intrusion detection system.
---
paper_title: Ontology Development for Industrial Risk Analysis

paper_content:

Risk analysis is a process dedicated to describe scenarios leading to hazards and potential accidents on an industrial facility. In order to realize a risk analysis, experts refer to different resources (hazard studies, expertise, etc.) which are often difficult to exploit because they are not sufficiently structured and formalized. This paper presents an ongoing project that aims to develop an industrial risk analysis support system. Our approach consists of three main phases. The first is to develop a knowledge base of industrial safety based on ontologies. The second phase is to index safety-related resources by concepts of the developed ontologies, which led to the realization of an information retrieval system. Given the nature of knowledge available at industrial organizations, the third phase aims to develop a case-based reasoning (CBR) system, associated to the developed ontologies, in order to help experts realize risk analysis studies using already existing ones.
---
paper_title: Towards an Ontology of Trust

paper_content:

Trust is a fundamental factor when people are interacting with each other, hence it is natural that trust has been researched also in relation to applications and agents. However, there is no single definition of trust that everybody would share. This, in turn, has caused a multitude of formal or computational trust models to emerge to enable trust use and dependence in applications. Since the field is so diverse, there also exists a confusion of terminology, where similar concepts have different names and, what is more disturbing, same terms are also used for different concepts. To organize the research models in a new and more structured way, this paper surveys and classifies thirteen computational trust models by the trust decision input factors. This analysis is used to create a new comprehensive ontology for trust to facilitate interaction between business systems.
---

Title: Ontologies for Security Requirements: A Literature Survey and Classification

Section 1: Introduction
Description 1: This section introduces the expanding field of Information Systems (IS) security, defines key concepts, and discusses the need for security ontologies.

Section 2: Methodology of research
Description 2: This section outlines the research methodology used to gather and analyze the literature on security ontologies, including the criteria for selection and classification.

Section 3: Synthesis and Classification
Description 3: This section provides a synthesis of the gathered information and classifies the different security ontologies into various categories and families.

Section 4: Beginning security ontologies
Description 4: This section discusses the early works on merging knowledge bases with information system management and the initial concepts introduced in these studies.

Section 5: Security taxonomies
Description 5: This section explains taxonomies as a form of ontology and provides examples of early security taxonomies and how they contributed to later ontology developments.

Section 6: General security ontologies
Description 6: This section describes ontologies aimed at encompassing all or most aspects of security, detailing major contributions and their components.

Section 7: Specific security ontologies
Description 7: This section categorizes and describes ontologies that address specific domains or aspects of security, such as SIP-VoIP services or computational trust models.

Section 8: Web oriented security ontologies
Description 8: This section covers security ontologies developed for web services and semantic web communities, aimed at enhancing security annotation and resource sharing.

Section 9: Risk based security ontologies
Description 9: This section discusses ontologies developed from a risk analysis perspective, including their contributions to analyzing threats and proposing security measures.

Section 10: (Security) Ontologies for Security requirements
Description 10: This section explains how some ontologies are specifically designed to address security requirements and how they have been used in requirement engineering studies.

Section 11: Security modelling ontologies
Description 11: This section explains ontologies focused on security modeling, detailing their emphasis on relationships and dependency constructs over traditional security concepts.

Section 12: Discussion and evaluation
Description 12: This section compares and evaluates the various security ontologies, assessing their coverage of security aspects and applicability to requirement engineering.

Section 13: Conclusion and perspectives
Description 13: This section summarizes the main findings, discusses the current gaps in the field, and outlines the future research directions in security ontology development for requirement definitions.