A Survey of Security Assessment Ontologies <s> Survey <s> The paper introduces and advocates an ontological semantic approach to information security. Both the approach and its resources, the ontology and lexicons, are borrowed from the field of natural language processing and adjusted to the needs of the new domain. The approach pursues the ultimate dual goals of inclusion of natural language data sources as an integral part of the overall data sources in information security applications, and formal specification of the information security community know-how for the support of routine and time-efficient measures to prevent and counteract computer attacks. As the first order of the day, the approach is seen by the information security community as a powerful means to organize and unify the terminology and nomenclature of the field. <s> BIB001 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Conducting international e-business requires knowledge about the privacy and consumer protection laws, and regulations that affect transacting parties. To support this requirement, we describe a high-level organization for a Web-privacy ontology composed of a hierarchical organization of formal laws and acts, informal cultural guidelines and standards for business in general, and specific legislation and guidelines for interest groups. A prototype of a Web privacy ontology is built for the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA). The ontology is built upon XML infrastructure. We propose that existing and to-be-designed XML-based P3P tags be incorporated in any regulatory privacy ontology to enable future P3P agents to automatically match not only the business’ privacy policy with the user preference rules, but also to match the business privacy policy with the privacy laws (for a start), and later with commerce and othertype laws, applicable to the stated legal jurisdiction(s) in which the business operates. <s> BIB002 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Trust is a fundamental factor when people are interacting with each other, hence it is natural that trust has been researched also in relation to applications and agents. However, there is no single definition of trust that everybody would share. This, in turn, has caused a multitude of formal or computational trust models to emerge to enable trust use and dependence in applications. Since the field is so diverse, there also exists a confusion of terminology, where similar concepts have different names and, what is more disturbing, same terms are also used for different concepts. To organize the research models in a new and more structured way, this paper surveys and classifies thirteen computational trust models by the trust decision input factors. This analysis is used to create a new comprehensive ontology for trust to facilitate interaction between business systems. <s> BIB003 </s> A Survey of Security Assessment Ontologies <s> Survey <s> A growing interest on the establishment of ontologies has been observed for the most different knowledge domains. This work presents OntoTest – an ontology of software testing, which has been developed to support acquisition, organization, reuse and sharing of testing knowledge. OntoTest has been built with basis on ISO/IEC 12207 standard and intends to explore the different aspects involved in the testing activity. Specifically, we are interested in defining a common well-established vocabulary for testing, which can be useful to develop supporting tools as well as to increase the inter-operability among them. <s> BIB004 </s> A Survey of Security Assessment Ontologies <s> Survey <s> The different environments of human performance need transparent ways to plan and manage related problems for security. There is a significant increase in the complexity project and plan security, it needs that means of manipulation of the information has been adopted. In this paper we present the CoreSec an CoreOntology for the Security domain. Our proposal considers that the security will be more efficient if this will be based on a formal information model of the domain, as an ontology. The architecture presented here intends to be the most generic possible, facilitating the development of security solutions. <s> BIB005 </s> A Survey of Security Assessment Ontologies <s> Survey <s> The paper shows how to apply a new ontology-based approach to the security problem definition (SPD), which is the key stage of the IT security development process compliant with the ISO/IEC 15408 Common Criteria standard. The SPD specifies threats, security policies and assumptions concerning the developed target of evaluation (TOE). On the SPD basis the security objectives (SO) are elaborated expressing the SPD problem solution, being the basis for further implementation works. The paper presents shortly the Specification Means Ontology (SMO), the related knowledge base and their use by the IT security developers while the security problem is formulated and solved. The paper gives some examples concerning a simple firewall, summarizes the results and experiences, and defines the plans of future works. <s> BIB006 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Due to a rapid growth in the use of electronic data processing and networking, an information security management system with a holistic and widespread view becomes more and more important for any kind of organization. The fundamental challenge for such systems is the representation and management of information security knowledge. While information security ontologies already exist, no methods have been proposed to map existing best-practice guidelines or information security standards to an existing ontology. Therefore, this paper presents a method for mapping the information security knowledge of the French EBIOS standard and the German IT Grundschutz Manual to a OWL-DL security ontology. Applying the introduced method allows to reuse existing information security knowledge bases and to map them to open and standardized data structures which can be easily reused by organizations and developers to support their existing information security management systems. <s> BIB007 </s> A Survey of Security Assessment Ontologies <s> Survey <s> We have developed a new security incident ontology that considers organizations and their systems in their entirety, rather than software alone. This includes the corresponding defensive classes to the offensive incident categories, as adverse events should also be considered from the defender's viewpoint taking its goals and specific circumstances into account. We have created a three-layer security architecture comprising the social, logical and physical levels that allows the planning of comprehensive defensive measures with complete and reinforcing attack surfaces that span all levels. These ideas allow a holistic analysis of incidents, including human and physical factors, rather than from a technical viewpoint alone, that can give comprehensive defense-in-depth to prevent, detect or recover from incidents. We will use OWL to give a well-defined semantics to the ontology, which could be used to give a formal basis to security incidents. <s> BIB008 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Software systems have become highly distributed and complex involving independent components working together towards achieving systems' goals. Meanwhile, security attacks against such systems have increased to become more sophisticated and difficult to detect and withstand. In this paper, we argue that the collaboration of a system's constituent components is a better way to detect and withstand this new generation of security attacks including multi-phased distributed attacks and various flooding distributed denial of service attacks. In order to achieve the collaborative intrusion detection and defenses in distributed environments, the system and its constituent components should have a common mechanism to share the collected knowledge about security attacks and counter measures. Thus, we develop and apply security ontologies that will serve as the common vocabulary that is understandable for both humans and software agents to share and analyse the received information. In particular, several security ontologies are introduced including the security attack ontology, the defence ontology, the asset-vulnerability ontology, the algorithm-standard ontology, and the security function ontology. In conclusion, we demonstrate the applicability of our approach with a case study illustrating the Mitnick attack. <s> BIB009 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Currently, it is difficult to answer simple questions such as "are we more secure than yesterday" or "how should we invest our limited security budget." Decision makers in other areas of business and engineering often use metrics for determining whether a projected return on investment justifies its costs. Spending for new cyber-security measures is such an investment. Therefore, security metrics [1] that can quantify the overall risk in an enterprise system are essential in making sensible decisions in security management. <s> BIB010 </s> A Survey of Security Assessment Ontologies <s> Survey <s> The evolution of information technology has facilitated the dissemination of information in the organizational and inter-organizational context. The availability of information and today’s turbulent business environment has resulted in an increased focus on information security issues. While managers realize the need to implement security guidelines, they do not have a clear understanding of what must be protected and how they might go about it. This article presents a general overview of the field of security research, describes distinct related initiatives and highlights the significance of information classification in achieving security goals in the organizational environment. We advocate that organizations can benefit by adopting ontologies as an alternative means of classifying information. The current phase of the research effort has produced results regarding the terminological stage of a domain ontology about security information. We expect to further contribute to the development of other initiatives related to this aspect of Information Science, as well as found the work of the information professionals and managers who drive security projects. <s> BIB011 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Security concerns for physical, software and virtual worlds have captured the attention of researchers and the general public, thanks to a series of dramatic events during the past decade. Unsurprisingly, this has resulted in increased research activity on topics that relate to security requirements. At the very core of this activity lies the problem of determining a suitable set of concepts (aka ontology) for modeling security requirements. Many proposals for such ontologies exist in the literature. The main objective of this paper is to amalgamate and extend the security ontologies proposed in [1] and [2]. The amalgamation includes a careful comparison of primitive concepts in Problem Frames and Secure Tropos, but also offers a novel account for rather nebulous security concepts, such as those of vulnerability and threat. The new concepts are justified and related to the literature. Moreover, the paper offers a number of security requirements adopted from industrial case studies, along with their respective representation in terms of the proposed ontology. <s> BIB012 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Intelligent sensors experience security problems very similar to those inherent to other kinds of IT products or systems. The assurance for these products or systems creation methodologies, like Common Criteria (ISO/IEC 15408) can be used to improve the robustness of the sensor systems in high risk environments. The paper presents the background and results of the previous research on patterns-based security specifications and introduces a new ontological approach. The elaborated ontology and knowledge base were validated on the IT security development process dealing with the sensor example. The contribution of the paper concerns the application of the knowledge engineering methodology to the previously developed Common Criteria compliant and pattern-based method for intelligent sensor security development. The issue presented in the paper has a broader significance in terms that it can solve information security problems in many application domains. <s> BIB013 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Along with the growth of available information on the internet, grows too the number of attacks to the Web systems. The Web applications became a new target to those invaders, due to the popularization of the Web 2.0 and 3.0, as well as the access to the social networks system's API's, the cloud computing models and SaaS. In this context, the identification of an eventual attack to those applications has become an important challenge to the security specialists. This article presents a proposition of using Semantic Web and Ontology concepts to define an approach to analyze Security logs with the goal to identify possible security issues. Keywords-Security; Log Analysis; Ontology <s> BIB014 </s> A Survey of Security Assessment Ontologies <s> Survey <s> This paper discusses an interoperability solution (tool) for the internal management of a policy decision engine located at the level of the authorization layer of a service oriented environment. The tool aims to support federated access control in the context of distributed architectures, in which a local authorization policy is not able to recognize all the attributes in the authorization decision requests. The approach is based on an ontology-based interoperation service (OBIS) whose role is to translate security attributes (name-value pairs) from local security vocabularies into the attributes recognized by the central (Master Policy Decision Point) vocabulary based on a security ontology and its domain-specific extensions which provides semantic reasoning services. The approach is validated in an e-Health scenario for the access of patient data for diabetes patient monitoring and disease management. <s> BIB015 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Measuring security is a complex task and requires a great deal of knowledge. Managing this knowledge and presenting it in a universal way is challenging. This paper describes the Information Security Measuring Ontology (ISMO) for measuring information security. The ontology combines existing measuring and security ontologies and instantiates it through example measures. The ontology provides a solid way to present security measures for software designers and adaptable applications. The software designer can utilise the ontology to provide an application with security measuring capability. Moreover, the adaptable application searches for measures from the ontology, in order to measure a security level in the current run-time situation. The case example illustrates the design and run-time usage of the ontology. The experiment proved that the ontology facilitates the software designer's work, when implementing security measures for applications that are able to retrieve measures from the ontology at run-time. <s> BIB016 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Software systems are often certified to guarantee they satisfy particular functional or non-functional requirements, including safety, security or privacy. In this paper, we propose an approach based on the use of ontologies to support the description of the content of security certificates for services. The work frames in the scope of the ASSERT4SOA project, which investigates the way to dynamically search for services satisfying certain security requirements. The ASSERT4SOA Ontology, the main result of this work, supports the interoperability and comparison of heterogeneous certificates and the run-time verification of the compliance of services with the security requirements asserted in their certificates. <s> BIB017 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Nowadays information systems play a vital role for organizations and individuals, which is why their protection is becoming increasingly important. Often, solutions are developed for very similar problems over and over again. An exchange of knowledge between experts would be desirable in order to prevent developing always the same solutions by independent persons. Such an exchange could also lead to solutions of higher quality, as existing approaches could be advanced, instead of always reinventing the security wheel. This paper examines how machine-readable information security knowledge can be shared between different organizations on the basis of a web portal utilizing Web-Prot\'{e}g\'{e}. It can be shown that through the use of ontologies the domain of information security can be modeled and stored in a human- and a machine-readable format, enabling both human editing and automation (e.g. for risk calculations). The evaluation of the web portal has shown that the most important challenge a tool for knowledge sharing has to face is the aspect of motivating users to participate in a knowledge exchange. <s> BIB018 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Asset information obtained via infrastructure analysis is essential for developing and establishing risk management. However, information about assets acquired by existing infrastructure analysis processes is often incomplete or lacking in detail, especially concerning their interconnected topology. In this paper, we present the Interconnected-asset Ontology, IO, as a step towards a standardized representation of detailed asset information. The utilization of an asset ontology as a machine-readable representation supports the automation of risk management processes and the standardization of asset information reduces redundant acquisition processes that are often found in practice. <s> BIB019 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Information Security Management has been contemporarily confronted by standards covering business aspects related to Information Technology. Different standards map the problem of information security to a set of controls that represent safeguards for different security vulnerabilities. Several procedure-oriented maturity models have been proposed for managing the progress on information security, however, few approaches use quantitative techniques for analyzing the progress on information security. In this paper we propose that the problem of becoming security compliance can be analyzed as a problem of multi-paths where checking different controls means choosing different ways of reaching a security compliance. We identify a set of concepts from security ontologies in order to identify a set of variables influencing these paths. The main contribution is formulating the problem of reaching some standard compliance in the shape of optimization problems, thus existing optimization techniques can be applicable. <s> BIB020 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Summary The semantically structure of cloud computing security knowledge, an ontology based security approaches have been increasingly adopted by several expertise from diverse security domains. Cloud computing usually requires a high level of collaboration amongst security entities. Maintaining consistency within this collaborative framework is a hurdle faced by information security professional’s team. This paper outlines a new approach dealing with this issue through the development of an ontology-driven multi-agent system (MAS) Architecture followed by describing the content of the ontology as well as its usages, potential for extension, technical implementation and tools for working with it. We present publicly available, OWLbased security ontology of Cloud Data Storage (CDS) security which cloud security goals, cloud models, cloud components, cloud assets, cloud threats and their relations. The use of our ontology is proposed as a powerful of MAS Architecture developed by Protege software to tackle the issues of security goals of confidentiality, correctness assurance, availability and integrity to ensure the security of CDS. There are three main steps, 1) domain, purpose and scope setting, 2) important terms acquisition, classes and class hierarchy conceptualization and 3) instances creation. <s> BIB021 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Web services have become a significant part of embedded systems as SCADA and internet applications embedded in RTU, because (WS) was XML/SOAP support, independent to platform and very simple to use, these advantages make (WS) vulnerable to many new and old security attacks. Now, it becomes easier to attack (WS) because their semantic data is publicly accessible in UDDI registry and (WS) use http protocol and the 80 TCP port as an open tunneling as a very big vulnerability. We work for the development of better distributed defensive mechanisms for (WS) using semantic distributed (I/F/AV) bloc, security ontology’s and WS-Security framework accelerated by ECC mixed coordinates cryptography integrated in our global security solution. <s> BIB022 </s> A Survey of Security Assessment Ontologies <s> Survey <s> The Internet of Services (IoS) has become the dominant paradigm for building applications in an ad-hoc, dynamic fashion by composing services from a variety of different providers. While the business value of the IoS is undoubted, security and trustworthiness concerns still constitute an obstacle for uptake. In this paper we argue that security certification is a valid means to address these issues. However, existing certification schemes addressing static systems and environments do not scale to the IoS and, thus, cannot be straightforwardly adapted. We investigate into the reasons for the lack of scale and conclude that three areas need to be addressed: explicit representation, machine readability, and advanced composition support. For each of these areas, we sketch solutions and identify further challenges. <s> BIB023 </s> A Survey of Security Assessment Ontologies <s> Survey <s> paper, we introduce a knowledge-oriented approach for the Security Requirements Engineering phase for developing E-Voting System. The knowledge acquired through the process of eliciting and analyzing secure E-Voting System is represented in the form of UML models; which can be made available to future developers and the dependency towards security experts can be reduced. In this paper we present a set of security requirements and security requirements patterns that were developed based on the aforementioned approach. Security requirements for modelling have been identified by following the Model Oriented Security Requirements Engineering framework for web applications. The security requirements have been designed into security requirements patterns for creating security requirements ontology for an E- Voting System. The ontology allows all concepts of importance and their relationships to be identified. The paper also compares the approach with other relevant methods in the Security Requirements Engineering phase for developing secure applications. <s> BIB024 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Cyber security is an important aspect of National Security and the safekeeping of a Nation’s constituency and resources. In South Africa, the focus on cyber security is especially prominent since many geographical regions are incorporated into the global village in an attempt to bridge the digital divide. This article reflects on current research done in South Africa with regard to a cyber security policy, and proposes the development of methodologies and frameworks that will enable the implementation of such a policy. The focus of this article is the use of an ontology-based methodology to identify and propose a formal, encoded description of the cyber security strategic environment. The aim of the ontology is to identify and represent the multi-layered organisation of players and their associated roles and responsibilities within the cyber security environment. This will contribute largely to the development, implementation and rollout of a national cyber security policy in South Africa. <s> BIB025 </s> A Survey of Security Assessment Ontologies <s> Survey <s> It is found that current ontologies for security often emphasize the security concerns and concepts without their involvement in each of stages of a software development process. This means that the security concerns and concepts will not be actually considered throughout the development process. This leads a lack of approaches to involving security concerns and concepts throughout the development process. In order to overcome the lack, a new security ontology for software development has been defined together with MDA that has been used in software development so that security concerns and concepts can play a role in each of stages of the development process and be included as security components in software. This paper will firstly introduce this new ontology and its semantics, then show how to use it in the development process in terms of four case studies. The results of the case studies have proven that the proposed security ontology could be useful in modeling and design of security concerns and concepts at each of stages of the development process with MDA. <s> BIB026 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Security is the major issue in web applications and it should be carefully considered in all the phases of the software development life cycle. The security requirements should be elicited and analysed in the early stages of requirements engineering. They are elicited from different sources by using security requirements engineering methods. Ontology can be used as one of the sources to specify security requirements knowledge effectively, since it is a 'formal, explicit specification of shared concepts' and is reusable. But there are no standard or only primitive security requirements ontology is available for requirements engineering phase. In this paper, we proposed and created security requirements ontology for web applications. Hence, we can reuse the security requirements knowledge and specify security requirements for developing different web applications. The reusability and effectiveness of security requirements ontology are validated using querying method. <s> BIB027 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Adoption of security standards has the capability of improving the secu- rity level in an organization as well as to provide additional benefits and possibilities to the organization. However mapping of used standards has to be done when more than one security standard is employed in order to prevent redundant activities, not optimal resource management and unnecessary outlays. Employment of security on- tology to map different standards can reduce the mapping complexity however the choice of security ontology is of high importance and there are no analyses on security ontology suitability for adaptive standards mapping. In this paper we analyze existing security ontologies by comparing their general prop- erties, OntoMetric factors and ability to cover different security standards. As none of the analysed security ontologies were able to cover more than 1/3 of security stan- dards, we proposed a new security ontology, which increased coverage of security standards compared to the existing ontologies and has a better branching and depth properties for ontology visualization purposes. During this research we mapped 4 security standards (ISO 27001, PCI DSS, ISSA 5173 and NISTIR 7621) to the new security ontology, therefore this ontology and mapping data can be used for adaptive mapping of any set of these security standards to optimize usage of multiple security standards in an organization. <s> BIB028 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Analysis of computer network security is a serious challenge. Many security metrics has been proposed for this purpose, but their effective use for rapid and reliable security evaluation and generation of countermeasures in SIEM systems remains an important problem. The use of ontologies for security information representation in SIEM systems contributes largely to the success of this task. However, most of works on ontological security data representation does not take into account the ontologies of security metrics. This paper proposes a new approach on using security metrics which is based on their ontological representation and serves for comprehensive security evaluation and subsequent countermeasure generation. The novelty of the proposed approach is that ontology of security metrics is viewed as a core component of a countermeasure decision support system. The proposed solutions are tested on a specific example. <s> BIB029 </s> A Survey of Security Assessment Ontologies <s> Survey <s> We present a security ontology to help non-security expert software designers or developers to: (1) design secure software and, (2) to understand and be aware of main security concepts and issues. Our security ontology defines the main security concepts such as attacks, countermeasures, security properties and their relationships. Countermeasures can be cryptographic concepts (encryption algorithm, key management, digital signature, hash function), security tools or security protocols. The purpose of this ontology is to be reused in numerous domains such as security of web applications, network management or communication networks (sensor, cellular and wireless). The ontology and a user interface (to use the ontology) are available online. <s> BIB030 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Intrusion Detection System (IDS) must reliably detect malicious activity. The expansion of web application also exponentially increases cyber threats. Current survey shows that application layer is more vulnerable to web attacks. There are more than 75% of attacks are deployed at application layer and out of that 90% are vulnerable to attacks. In this paper, we address issues of existing IDS i.e. low false positive rate, low false negative rate and data overload. We discuss about use of semantic web in the Intrusion Detection Systems. This article presents a proposition of using Semantic Web and Ontology concepts to define an approach to analyze Security logs with the goal to identify possible security issues. It extracts semantic relations between computer attacks and intrusions in an Intrusion Detection System. Ontology provides to enable, reuse of domain knowledge and it is also easier to understand and update legacy data. <s> BIB031 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Widespread deployment of the Internet enabled building of an emerging IT delivery model, i.e., cloud computing. Albeit cloud computing-based services have rapidly developed, their security aspects are still at the initial stage of development. In order to preserve cybersecurity in cloud computing, cybersecurity information that will be exchanged within it needs to be identified and discussed. For this purpose, we propose an ontological approach to cybersecurity in cloud computing. We build an ontology for cybersecurity operational information based on actual cybersecurity operations mainly focused on non-cloud computing. In order to discuss necessary cybersecurity information in cloud computing, we apply the ontology to cloud computing. Through the discussion, we identify essential changes in cloud computing such as data-asset decoupling and clarify the cybersecurity information required by the changes such as data provenance and resource dependency information. <s> BIB032 </s> A Survey of Security Assessment Ontologies <s> Survey <s> The emerging trends towards mobility and big data analysis strongly contribute to the success of cloud computing. Despite the numerous advantages cloud computing still has not reached its full potential due to the privacy and security concerns of today's cloud service users. In order to improve trust on clouds, in this paper we propose a cloud ontology which supports assurance and security initiatives. Finally, we show how we implemented the introduced ontology using the widely used Protege tool. <s> BIB033 </s> A Survey of Security Assessment Ontologies <s> Survey <s> Security is an important issue that needs to be taken into account at all stages of information system development, including early requirements elicitation. Early analysis of security makes it possible to predict threats and their impacts and define adequate security requirements before the system is in place. Security requirements are difficult to elicit, analyze, and manage. The fact that analysts’ knowledge about security is often tacit makes the task of security requirements elicitation even harder. Ontologies are known for being a good way to formalize knowledge. Ontologies, in particular, have been proved useful to support reusability. Requirements engineering based on predefined ontologies can make the job of requirement engineering much easier and faster. However, this very much depends on the quality of the ontology that is used. Some security ontologies for security requirements have been proposed in the literature. None of them stands out as complete. This paper presents a core and generic security ontology for security requirements engineering. Its core and generic status is attained thanks to its coverage of wide and high-level security concepts and relationships. We implemented the ontology and developed an interactive environment to facilitate the use of the ontology during the security requirements engineering process. The proposed security ontology was evaluated by checking its validity and completeness compared to other ontologies. Moreover, a controlled experiment with end-users was performed to evaluate its usability. <s> BIB034
The literature review process is based, with adaptations, on the guidelines for performing systematic reviews proposed by Biolchini [9] and Kitchenham  . We present the literature review on "Information Systems Security Assessment" aimed to be used as a supporting resource by researchers in the field. Specifically, we are looking for papers in the literature representing the state of the art in two search fronts. The first front aims to identify papers that systematize and formalize concepts on "Information Security", by means of ontologies. In the second front, we include "Test and Assessment" and the corresponding related keywords. We applied a systematic approach in the search process by: selecting search databases, choosing keywords, defining search strings, and specifying inclusion and exclusion criteria. 80 papers were identified and 47 were selected. Seven databases were selected for this study: IEEE Xplore, ACM Digital Library, Scielo, Proquest, ScienceDirect -Elsevier, SpringerLink, and Google Scholar. In the Search Databases (advanced search), the following parameters were considered: "title", "abstract", "entire document" and their combinations, if available in the search database. Concerning selection criteria, we used: (i) Inclusion criteria: Recent works; Works containing more citations; Works containing important concepts; Works related to the defined research questions. (ii) Exclusion criteria: Works not related to the defined research questions. We have defined keywords and a search string. English is used in the search. Table 1 presents the keywords and the search string. BIB033 ;  ; BIB026 ;  ; BIB027  ; BIB028 ; BIB029 ; BIB030 ;  ; BIB017 ; BIB018 ; BIB019 ; BIB020 ; BIB021 ; BIB022 ; BIB023 ; BIB012 ; BIB013 ; [30] ; BIB014 ; BIB015 ; BIB016 ;  ; [35] ; BIB008 ; BIB009 ; BIB032 ; BIB010 ; BIB011 ;  ; BIB006 ;  ; BIB005 ;  ; BIB005 ;  ; BIB004 ; BIB001 . Generic and abstract proposals (Top-Level Ontologies) can be found in BIB034 , BIB024 , BIB025 ,  , and BIB002 . Specific proposals (Task and Application Ontologies) can be found in BIB031 ,  , and BIB003 . After analysis of the selected works, the following can be highlighted: In BIB001 Raskjn et al. present concepts of the Information Security domain, and also explains how ontologies can be used to support the Information Security field, in order to provide a theoretical basis. In BIB003 Viljanen presents an ontology of Trust, in order to facilitate interoperability between systems. A common vocabulary is proposed to describe facts that should be considered in trust calculation. In  an information security ontology in OWL is presented by Herzog et al.. This work is aimed at modeling the main concepts of the domain. The authors describe content, manner of use, possibility of extension, technical implementation and tools to handle the ontology. In  Fenz & Ekelhart present an ontology of the Information Security domain, focused on Risk Management. The authors use the German IT Grundschutz Manual  and the NIST Handbook  as references. The ontology uses the concepts of threat, vulnerability and control to represent knowledge in the information security domain. In BIB016 Evesti et al. present an ontology to support the process of measuring Information Security, whereas Feledi & Fenz BIB018 present a formalization of information security knowledge, by means of an ontology. According to the authors, we need to make explicit knowledge, so that it can be incorporated and used by both humans (human-readable format) and machines (machine-readable format). A top-level ontology of security requirements is presented in BIB024 by Salini & Kanmani. Based on this ontology, we can design and develop requirements for electronic voting systems (e-voting). The main objective of this work is to propose security patterns to facilitate the process of identifying security requirements for evoting systems. The authors present specific security properties for e-voting systems, namely: anonymity, disclosability, uniqueness, accuracy, transparency, and noncoercibility. In A standard-based security ontology is presented by Ramanauskaite et al. in BIB028 . The authors propose an ontology aimed to cover a larger number of standards. The authors mapped papers Herzog et al.  and Fenz, Pruckner, & Manutscheri BIB007 with the standards ISO 27001  , PCI DSS [59], ISSA 5173  and NISTIR 7621  . In BIB027 Salini & Kanmani present an ontology of security requirements for web applications. This work aims at enabling the reuse of knowledge about security requirements in the development of different web applications. In BIB031 Khairkar et al. present an ontology to detect attacks on Web systems. The authors use semantic web concepts and ontologies to analyze security logs to identify potential security issues. This work aims to extract semantic relationships between attacks and intrusions in an Intrusion Detection System (IDS). In BIB026 Kang & Liang present a security ontology, for use in the software development process. The proposed ontology can be used for identifying security requirements, as a practical and theoretical basis. In BIB033 Koinig et al. present a security ontology for cloud computing and a brief literature review. The authors consider the regulatory requirements contained in standards such as HIPAA (Health Insurance Portability and Accountability Act) [62] , SOX (Sarbanes Oxley Law) [63] , and ISO/IEC 27001  .