task_categories:graph-ml annotations_creators:expert-generated size_categories:100K<n<1M language:en license:mit knowledge-graph rdf owl ontology cybersecurity region:us
---
language:
- en
license: mit
tags:
- knowledge-graph
- rdf
- owl
- ontology
- cybersecurity
annotations_creators:
- expert-generated
pretty_name: D3FEND
size_categories:
- 100K<n<1M
task_categories:
- graph-ml
dataset_info:
  features:
    - name: subject
      dtype: string
    - name: predicate
      dtype: string
    - name: object
      dtype: string
  config_name: default
  splits:
    - name: train
      num_bytes: 46899451
      num_examples: 231842
  dataset_size: 46899451
viewer: false
---

# D3FEND: A knowledge graph of cybersecurity countermeasures

### Overview
D3FEND encodes a countermeasure knowledge base in the form of a
knowledge graph. It meticulously organizes key concepts and relations
in the cybersecurity countermeasure domain, linking each to pertinent
references in the cybersecurity literature. 

### Use-cases
Researchers and cybersecurity enthusiasts can leverage D3FEND to:
- Develop sophisticated graph-based models.
- Fine-tune large language models, focusing on cybersecurity knowledge
  graph completion.
- Explore the complexities and nuances of defensive techniques,
  mappings to MITRE ATT&CK, weaknesses (CWEs), and cybersecurity
  taxonomies.
- Gain insight into ontology development and modeling in the
  cybersecurity domain.

### Dataset construction and pre-processing

### Source:
- [Dataset Repository - 0.13.0-BETA-1](https://github.com/d3fend/d3fend-ontology/tree/release/0.13.0-BETA-1)
- [Commit Details](https://github.com/d3fend/d3fend-ontology/commit/3dcc495879bb62cee5c4109e9b784dd4a2de3c9d)
- [CWE Extension](https://github.com/d3fend/d3fend-ontology/tree/release/0.13.0-BETA-1/extensions/cwe)

#### Building and Verification:
1. **Construction**: The ontology, denoted as `d3fend-full.owl`, was
   built from the beta version of the D3FEND ontology referenced
   above using documented README in d3fend-ontology. This includes the
   CWE extensions. 
2. **Import and Reasoning**: Imported into Protege version 5.6.1,
   utilizing the Pellet reasoner plugin for logical reasoning and
   verification.
3. **Coherence Check**: Utilized the Debug Ontology plugin in Protege
   to ensure the ontology's coherence and consistency.

#### Exporting, Transformation, and Compression:
Note: The following steps were performed using Apache Jena's command
line tools. (https://jena.apache.org/documentation/tools/)
1. **Exporting Inferred Axioms**: Post-verification, I exported
   inferred axioms along with asserted axioms and
   annotations. [Detailed
   Process](https://www.michaeldebellis.com/post/export-inferred-axioms)
2. **Filtering**: The materialized ontology was filtered using
   `d3fend.rq` to retain relevant triples.
3. **Format Transformation**: Subsequently transformed to Turtle and
   N-Triples formats for diverse usability. Note: I export in Turtle
   first because it is easier to read and verify. Then I convert to
   N-Triples.
   ```shell
   arq --query=d3fend.rq --data=d3fend.owl --results=turtle > d3fend.ttl
   riot --output=nt d3fend.ttl > d3fend.nt
   ```
4. **Compression**: Compressed the resulting ontology files using
   gzip.

## Features
The D3FEND dataset is composed of triples representing the
relationships between different cybersecurity countermeasures. Each
triple is a representation of a statement about a cybersecurity
concept or a relationship between concepts. The dataset includes the
following features:

### 1. **Subject** (`string`)
The subject of a triple is the entity that the statement is about. In
this dataset, the subject represents a cybersecurity concept or
entity, such as a specific countermeasure or ATT&CK technique.

### 2. **Predicate** (`string`)
The predicate of a triple represents the property or characteristic of
the subject, or the nature of the relationship between the subject and
the object. For instance, it might represent a specific type of
relationship like "may-be-associated-with" or "has a reference."

### 3. **Object** (`string`)
The object of a triple is the entity that is related to the subject by
the predicate. It can be another cybersecurity concept, such as an
ATT&CK technique, or a literal value representing a property of the
subject, such as a name or a description.

### Usage
First make sure you have the requirements installed:

```python
pip install datasets
pip install rdflib
```

You can load the dataset using the Hugging Face Datasets library with
the following Python code:

```python
from datasets import load_dataset
dataset = load_dataset('wikipunk/d3fend', split='train')
```

#### Note on Format:
The subject, predicate, and object are stored in N3 notation, a
verbose serialization for RDF. This allows users to unambiguously
parse each component using `rdflib.util.from_n3` from the RDFLib
Python library. For example:

```python
from rdflib.util import from_n3
subject_node = from_n3(dataset[0]['subject'])
predicate_node = from_n3(dataset[0]['predicate'])
object_node = from_n3(dataset[0]['object'])
```

Once loaded, each example in the dataset will be a dictionary with
`subject`, `predicate`, and `object` keys corresponding to the
features described above.

### Example

Here is an example of a triple in the dataset:
- Subject: `"<http://d3fend.mitre.org/ontologies/d3fend.owl#T1550.002>"`
- Predicate: `"<http://d3fend.mitre.org/ontologies/d3fend.owl#may-be-associated-with>"`
- Object: `"<http://d3fend.mitre.org/ontologies/d3fend.owl#T1218.014>"`

This triple represents the statement that the ATT&CK technique
identified by `T1550.002` may be associated with the ATT&CK technique
identified by `T1218.014`.

### Acknowledgements
This ontology is developed by MITRE Corporation and is licensed under
the MIT license. I would like to thank the authors for their work
which has opened my eyes to a new world of cybersecurity modeling.

If you are a cybersecurity expert please consider [contributing to
D3FEND](https://d3fend.mitre.org/contribute/).

[D3FEND Resources](https://d3fend.mitre.org/resources/)

### Citation
```bibtex
@techreport{kaloroumakis2021d3fend,
  title={Toward a Knowledge Graph of Cybersecurity Countermeasures},
  author={Kaloroumakis, Peter E. and Smith, Michael J.},
  institution={The MITRE Corporation},
  year={2021},
  url={https://d3fend.mitre.org/resources/D3FEND.pdf}
}
```
