Tahia Infantes Morris

A perceptually-relevant model-based cyber threat prediction method for enterprise mission assurance

Cyber attacks remain elusive and are increasingly effective. Information security professionals regularly monitor network resources and cyber security websites with an interest in understanding how such threats expose their enterprises vulnerabilities and dependencies. However, information must be persistently and purposefully examined from a multitude of resources in order to establish context and situational awareness. This in turn, enables organizations to perceive, anticipate and counteract threats before they occur and helps assure their ability to accomplish their missions. Global information must be transformed into timely and local actionable knowledge. To achieve this, cyber event data coupled with knowledge of the semantic interrelationships between other location, object, agent, and event entities need to be factored to facilitate a clearer understanding of the total cyber landscape. In this work, we introduce an ontology driven framework comprising of a dynamic knowledge base, a functional and self-updating mission model, and the associated information and complex event processing capabilities. We focus the description of the system on cyber mission information needs, whereby collection, processing, management and mission model updates are based on cyber-related information from a variety of resources including commercial news, blogs, wikis, and social media sources. The result is a dynamic capability for cyber mission management that provides proactive, on demand cyber information to analysts, professionals, policy makers, and support personnel.

An Application of Security Access and Control to Semantic Metadata Management

It is envisioned that future architectures will maximize the use of Semantic Technologies and information sharing to improve efficiency and automation, support multi-source information aggregation for advanced analysis, eliminate needless data duplication, and improve adaptability of data sources to new dissemination requirements. In this paper, the authors present a semantic-level solution for enforcing flexible, role-based access and editing policies in support of ontologies, as well as, the underlying data content. The authors describe an implementation method for a security policy with distinctive user roles. A repository of semantically-rich information is used to simultaneously permit access by users with differet security clearances and deny access to unauthorized users. Finally, in the context of a real world example, the authors demonstrate how the application of the security scheme seamlessly integrates with third party semantic applications and visualization tools.