Protecting digital assets using an ontology based cyber situational awareness system

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Data Science

Background:

• Real-time detection and mitigation of cybersecurity threats are crucial.
• Existing methods often lack comprehensive threat intelligence and proactive anomaly detection capabilities.

Purpose of the Study:

• To introduce a comprehensive methodology integrating Isolation Forest and autoencoder algorithms, STIX, and ontology development.
• To enhance cybersecurity threat detection and intelligence through a novel dual-algorithm framework.

Main Methods:

• Utilized Isolation Forest for anomaly identification and autoencoders for feature learning and nonlinear detection.
• Standardized threat information using Structured Threat Information Expression (STIX) framework.
• Employed ontology development for systematic knowledge representation and semantic threat correlation.

Main Results:

• Achieved 95% accuracy, 99% F1 score, and 94.60% recall rate.
• Demonstrated superior performance compared to existing benchmarks in anomaly detection.
• Highlighted the model's effectiveness in enhancing cyber situational awareness.

Conclusions:

• The integrated methodology significantly improved threat information standardization and semantic analysis.
• The dual-algorithm approach offers scalable and effective cybersecurity applications.
• Future work should focus on real-world deployment and further optimization.