Protecting digital assets using an ontology based cyber situational awareness system

• DOI: 10.3389/frai.2024.1394363
• Publication Date: 2025-01-09T06:14:07Z
• Authors: Tariq Ammar Almoa...; Yasser Mohammad A...; Ahmad Emad Albalawi; Majed M. Aborokbah; S. Manimurugan; Ahmed Aljuhani; Hussain Aldawood; P. Karthikeyan
• Keywords: structured threat information expression; Artificial Intelligence; Electronic computers. Computer science; cyber situational awareness; auto encoder; isolation forest algorithm; QA75.5-76.95; anomaly detection

IntroductionCyber situational awareness is critical for detecting and mitigating cybersecurity threats in real-time. This study introduces a comprehensive methodology that integrates the Isolation Forest and autoencoder algorithms, Structured Threat Information Expression (STIX) implementation, and ontology development to enhance cybersecurity threat detection and intelligence. The Isolation Forest algorithm excels in anomaly detection in high-dimensional datasets, while autoencoders provide nonlinear detection capabilities and adaptive feature learning. Together, they form a robust framework for proactive anomaly detection.MethodsThe proposed methodology leverages the Isolation Forest for efficient anomaly identification and autoencoders for feature learning and nonlinear anomaly detection. Threat information was standardized using the STIX framework, facilitating structured and dynamic assessment of threat intelligence. Ontology development was employed to represent knowledge systematically and enable semantic correlation of threats. Feature mapping enriched datasets with contextual threat information.ResultsThe proposed dual-algorithm framework demonstrated superior performance, achieving 95% accuracy, a 99% F1 score, and a 94.60% recall rate. These results outperformed the benchmarks, highlighting the model’s effectiveness in proactive anomaly detection and cyber situational awareness enhancement.DiscussionThe integration of STIX and ontology development within the proposed methodology significantly enhanced threat information standardization and semantic analysis. The dual-algorithm approach provided improved detection capabilities compared to traditional methods, underscoring its potential for scalable and effective cybersecurity applications. Future research could explore further optimization and real-world deployments to refine and validate the approach.