Ontology and Cyber Security May 18 th 2013 Bill Mandrick, PhD - PowerPoint PPT Presentation

Ontology and Cyber Security May 18 th 2013 Bill Mandrick, PhD Senior Ontologist

2 2/12/2013 AGENDA  Ontology of Computer Network Operations  DoD and USG Efforts  Cyber Fast Track  Computer Network Operations (CNO)  Computer Network Defense (CND)  Computer Network Exploitation (CNE)  Computer Network Attack (CNA) Data Tactics Proprietary

4/18/2013 3

4/18/2013 4

Commanders use the operations process to drive the conceptual and detailed planning necessary to understand, visualize, and describe their unique operational environment; make and articulate decisions; and direct, lead, and assess military operations. 4/18/2013 5

7 2/12/2013 Ontology Defined Ontology is the science of representing, defining, and relating the kinds and structures of objects, properties, events, processes and relations in every area of reality. An ontology is an exhaustive classification of entities in some sphere of being, which results in the formulation of robust and shareable descriptions of a given domain. (e.g. Physics, Biology, Medicine, Intelligence, etc.). Data Tactics Proprietary

8 2/12/2013 Information Integration Revolutions Dowding Radar System (1940 Battle of Britain) Coordinated (Massing) Artillery Fires (1910-1940) 1800’s Cartographic *DOTMLPF 8 Revolution Data Tactics Proprietary

Interoperable Semantics (example: Anatomy & Physiology) • Standardized Labels • Anatomical Continuants • Physiological Occurrents • Teachable • Inferencing • Horizontally Integrated • Sharing of Observations • Accumulated Knowledge 9

Authoritative References 4/18/2013 10

Object Aggregates 4/18/2013 11

Events 4/18/2013 12

Events 4/18/2013 13

Organizations & Persons 4/18/2013 14

Information Content Entities 4/18/2013 15

Relations

4/18/2013 17

4/18/2013 18

4/18/2013 19

Computer Network Intrusion (CNI) Detection Report 4/18/2013 20

Destination Source CNI Event Computer Computer Signature Role Role produces CNI designates designates Detection describes Sensor Internet Protocol Computer Address detects CNI Event Network Signature Intrusion Description (CNI) Event facilitates has_part has_part Timestamp Trojan Horse has_part Virus designates CNI Detection Report 21 4/18/2013

4/18/2013 22

23 2/12/2013 Data Tactics Proprietary

Ontology Review Revisions Process with SME’s SME Feedback 24

25 2/12/2013 Publish and Share 25 Data Tactics Proprietary

26 2/12/2013  Need for a Cyber Operations Shared Lexicon  Common Logic Controlled English  Human Readable  Machine Process-able  Requirement for Interoperability Data Tactics Proprietary

27 2/12/2013 Data Tactics Proprietary