UMBC ebiquity
Proceedings of the AAAI Workshop on Artificial Intelligence for Cyber Security
UCO: A Unified Cybersecurity Ontology
February 12, 2016
In this paper, we describe the Unified Cybersecurity Ontology (UCO) that is intended to support information integration and cyber situational awareness in cybersecurity systems. The ontology integrates heterogeneous data and knowledge schemas from different cybersecurity systems, as well as the most commonly used cybersecurity standards for information sharing and exchange. The UCO ontology has also been mapped to a number of existing cybersecurity ontologies as well as concepts in the Linked Open Data cloud. Similar to DBpedia, which serves as the core for general knowledge in the Linked Open Data cloud, we envision UCO serving as the core for the cybersecurity domain, evolving and growing over time as additional cybersecurity datasets become available. We also present a prototype system and concrete use cases supported by the UCO ontology. To the best of our knowledge, this is the first cybersecurity ontology mapped to general world ontologies to support broader and more diverse security use cases. We compare the resulting ontology with previous efforts, discuss its strengths and limitations, and outline potential directions for future work.
