Improving Interdisciplinary Communication With Standardized Cyber Security Terminology: A Literature Review <s> I. INTRODUCTION <s> Computer system security relies on different aspects of a computer system such as security policies, security mechanisms, threat analysis, and countermeasures. This paper provides an ontological approach to capturing and utilizing the fundamental attributes of those key components to determine the effects of vulnerabilities on a system's security. Our ontology for vulnerability management (OVM) has been populated with all vulnerabilities in NVD (see http://nvd.nist.gov/scap.cfm) with additional inference rules and knowledge discovery mechanisms so that it may provide a promising pathway to make security automation program (NIST Version 1.0, 2007) more effective and reliable. <s> BIB001 </s> Improving Interdisciplinary Communication With Standardized Cyber Security Terminology: A Literature Review <s> I. INTRODUCTION <s> Proceedings of the 11th European Conference on Information Warfare and Security, Laval, France, 5-6 July 2012 <s> BIB002 </s> Improving Interdisciplinary Communication With Standardized Cyber Security Terminology: A Literature Review <s> I. INTRODUCTION <s> This paper addresses a serious impediment to theory and policy for cybersecurity: Trivial as it might appear on the surface, there is no agreed upon understanding of the issue, no formal definition, and not even a consensus on the mere spelling of the terms –– so that efforts to develop policies and postures, or capture relevant knowledge are seriously hampered. In this context, we present a “proof of concept” for a new research strategy based on a close examination of a large corpus of scholarly knowledge, and the extent to which it enables us to generate new knowledge about cybersecurity of relevance to international relations and to national security relevant to the nation’s security and to international relations. Given the new cyber realities, this paper is also a “proof” of how to create new knowledge through automated investigations of the record to date. <s> BIB003 </s> Improving Interdisciplinary Communication With Standardized Cyber Security Terminology: A Literature Review <s> I. INTRODUCTION <s> Developing a domain ontology with concepts and relationships between them is a challenge, since knowledge engineering is a labor intensive process that can be a bottleneck and is often not scalable. Developing a cyber-security ontology is no exception. A security ontology can improve search for security learning resources that are scattered in different locations in different formats, since it can provide a common controlled vocabulary to annotate the resources with consistent semantics. In this paper, we present a bootstrapping method for developing a cyber-security ontology using both a security textbook index that provides a list of terms in the security domain and an existing security ontology as a scaffold. The bootstrapping approach automatically extracts the textbook index terms (concepts), derives a relationship to a concept in the security ontology for each and classifies them into the existing security ontology. The bootstrapping approach relies on the exact and approximate similarity matching of concepts as well as the category information obtained from external sources such as Wikipedia. The results show feasibility of our method to develop a more comprehensive and scalable cyber-security ontology with rich concepts from a textbook index. We provide criteria used to select a scaffold ontology among existing ontologies. The current approach can be improved by considering synonyms, deep searching in Wikipedia categories, and domain expert validation. <s> BIB004 </s> Improving Interdisciplinary Communication With Standardized Cyber Security Terminology: A Literature Review <s> I. INTRODUCTION <s> Intrusion Detection System (IDS) must reliably detect malicious activity. The expansion of web application also exponentially increases cyber threats. Current survey shows that application layer is more vulnerable to web attacks. There are more than 75% of attacks are deployed at application layer and out of that 90% are vulnerable to attacks. In this paper, we address issues of existing IDS i.e. low false positive rate, low false negative rate and data overload. We discuss about use of semantic web in the Intrusion Detection Systems. This article presents a proposition of using Semantic Web and Ontology concepts to define an approach to analyze Security logs with the goal to identify possible security issues. It extracts semantic relations between computer attacks and intrusions in an Intrusion Detection System. Ontology provides to enable, reuse of domain knowledge and it is also easier to understand and update legacy data. <s> BIB005 </s> Improving Interdisciplinary Communication With Standardized Cyber Security Terminology: A Literature Review <s> I. INTRODUCTION <s> Cyber-Physical-Social Systems (CPSSs) integrate various resources from physical, cyber, and social worlds. Efficient interaction of these resources is essential for CPSSs operation. Ontologies do not only provide for semantic operability between different resources but also provide means to create sharable ontology-based context models specified for actual settings. Usage of the context supports situation-driven behavior of CPSSs resources and thus is an enabler for their self-organisation. The present research inherits the idea of context ontologies usage for modelling context in CPSSs. In this work, an upper level context ontology for CPSSs is proposed. This ontology is applied in the domain of self-organising resource network. <s> BIB006 </s> Improving Interdisciplinary Communication With Standardized Cyber Security Terminology: A Literature Review <s> I. INTRODUCTION <s> In this paper we describe an ontology developed for a cyber security knowledge graph database. This is intended to provide an organized schema that incorporates information from a large variety of structured and unstructured data sources, and includes all relevant concepts within the domain. We compare the resulting ontology with previous efforts, discuss its strengths and limitations, and describe areas for future work. <s> BIB007 </s> Improving Interdisciplinary Communication With Standardized Cyber Security Terminology: A Literature Review <s> I. INTRODUCTION <s> As our cyber society develops and expands, the importance of cybersecurity operations is growing in response to cybersecurity threats coming from beyond national borders. Efficient cybersecurity operations require information exchanges that go beyond organizational borders. Various industry specifications defining information schemata for such exchanges are thus emerging. These specifications, however, define their own schemata since their objectives and the types of information they deal with differ, and desirable schemata differ depending on the purposes. They need to be organized and orchestrated so that individual organizations can fully exchange information and collaborate with one another. To establish the foundations of such orchestration and facilitate information exchanges, this paper proposes a reference ontology for cybersecurity operational information. The ontology structures cybersecurity information and orchestrates industry specifications. We built it from the standpoint of cybersecurity operations in close collaboration with cybersecurity organizations including security operation centers handling actual cybersecurity operations in the USA, Japan and South Korea. This paper demonstrates its usability by discussing the coverage of industry specifications. It then defines an extensible information structure that collaborates with such specifications by using the ontology and describes a prototype cybersecurity knowledge base we constructed that facilitates cybersecurity information exchanges among various parties. Finally, it discusses the usage scenarios of the ontology and knowledge base in cybersecurity operations. Through this work, we wish to contribute to the advancement of cybersecurity information exchanges. <s> BIB008
Cyber security is a nascent and exploding field with a growing body of research  ,  . It is rooted in traditional computer science but has recently gained prevalence in other fields such as law and business management, as well as areas of technology that did not originally operate with the Internet, such as smart grids, cars, and other cyber-physical systems, which are experiencing new security vulnerabilities as a result of their newfound connections to it, although cyber-crime can be perpetrated without the Internet [112] . As a new field that sprang out of many old ones and serves as a unifying concern among disparate disciplines, cyber security has been given little attention in developing standards of research, possibly because these disciplines' standards have been specified strictly within their own field, or that the urgency of protecting against cyber-crime outweighs many standards, or perhaps that the field is still relatively new and many may think standardizing too soon could stifle growth -all of which are reasonable assumptions. However, never has it been more urgent for cyber security to be unified as a well-defined and standardized academic discipline. Standardization is commonplace in scientific disciplines, beginning with either systematic nomenclature or otherwise standardized vocabulary  -  . Yet there have been very few efforts in research standardization, all of them government-led  ,  . Herein we argue for and facilitate more formalized research by the global multistakeholder community, especially academia, in cyber security, beginning with facilitating greater communication among the disparate disciplines that concern themselves with this area, through identifying trends in terminology standards. This paper first assesses the state of the field of cyber security with a literature review, covering many of its newer, less traditional aspects. The object of this study was to manually identify significant areas of focus in current academic cyber security research. Papers were selected manually from certain searches using the MIT libraries database. Given the extent of human ability, this manual portion of the study was not intended to construct any detailed ontology of cyber security. Inferences were drawn to identify many current trends, and papers were grouped by broad fields. These broad fields were loosely defined and posited to contain all research areas that were not explicitly identified. Some work on crafting ontologies of cyber security research has been done in the past using both manual and automated techniques  , BIB007 , BIB001 , BIB006 , BIB008 , BIB002 , BIB004 , BIB005 , BIB003 . However, such efforts usually used relatively few inputs, such as starting with a basic phrase of ''cyber security'' and performing automated searches for papers with this term; and therefore these studies may not have covered the entire scope of the field of cyber security. To lay the foundations for standards in cyber security research, a unified terminology is essential. The majority of the body of this paper provides guidelines, metrics, and suggestions for unifying the terminology of cyber security research, using the myriad keywords taken from the literature review as a more ''human-informed'' basis for automated searches to identify trends. The incidence of the keywords as well as the incidence of all keywords from all papers with each of the keywords was recorded from searches on 2 major journal paper databases, Scopus, and IEEE Xplore. Trends were analyzed and, along with linguistic analyses and a test of trends of whether cyber is used as a prefix or as a separate word in journal papers from 1995 to 2005, recommended terminology standards criteria were established and baseline general standards were suggested. Some specific terms were also rigorously defined. This work is intended to serve as a guide to developing more standard terms or a more standardized terminology for cyber security by the academic community or governing bodies in the near future, or to be taken as guidelines for selection of keywords, titles, and proper technical terms in future cyber security research. The manuscript for this work was written to adhere to these terms except in the use of quotes from other papers, which, if conflicting, are indicated with [sic] . The specific contributions of this work are thus fivefold: 1. We identify a large proportion of the emerging trends in cyber security research; 2. We point out a long overdue need for standardization of cyber security terminology; 3. We propose guidelines to consider when selecting terms or standardizing terminology (e.g. prevalence and occurrence of terms, linguistics, governing bodies); 4. We propose and justify some actual terminology standards; 5. We identify the general silos cyber security research falls into, and their associated terminology, and suggest avenues for further research based on our classification.