Cybersecurity Ontology

AI SEARCH FLOW ALGEBRA
Cybersecurity Ontology
Kireth Semantic Research Archive

PAGE:
https://kirethresearch.org/booksai-core/ontologies/computing-ontologies/cybersecurity/cybersecurity-ontology.html

AUTHORS:
Mark Anthony Higgins — Sky (Recursive AI)

FLOW "CybersecurityOntology" v4.0

# ---------- IO ----------
io.input:
  entity: query
  context: cybersecurity
  locale: en-GB

io.output:
  semantic_entities
  semantic_relationships
  inferred_security_state
  confidence
  provenance
  flow_hash

# ---------- DOMAIN ----------
DOMAIN := ComputingOntology
SUBDOMAIN := Cybersecurity
ONTOLOGY := CybersecurityOntology

# ---------- PRIMARY ENTITY ----------
ENTITY Cybersecurity {
    type: ComputingSecurityDomain;

    definition:
        "A computational security domain concerned with protecting digital
         assets, systems, networks, software, services, identities and data
         against threats, vulnerabilities, attacks, unauthorised actions,
         disruption, compromise and loss.";

    goals: [
        Confidentiality,
        Integrity,
        Availability,
        Authenticity,
        Accountability,
        Resilience
    ];
}

# ---------- CORE SETS ----------
Asset := {
    Data,
    Information,
    Identity,
    Credential,
    CryptographicKey,
    Software,
    Application,
    Service,
    Device,
    Endpoint,
    Hardware,
    Network,
    Infrastructure,
    CloudResource,
    SecurityLog
};

Threat := {
    UnauthorisedAccess,
    CredentialCompromise,
    Malware,
    Exploitation,
    DataDisclosure,
    DataModification,
    DataDestruction,
    ServiceDisruption,
    Impersonation,
    NetworkIntrusion,
    PrivilegeAbuse
};

Vulnerability := {
    SoftwareWeakness,
    ConfigurationWeakness,
    AuthenticationWeakness,
    AuthorisationWeakness,
    CryptographicWeakness,
    NetworkWeakness,
    ProcessWeakness,
    HumanWeakness
};

SecurityControl := {
    PreventiveControl,
    DetectiveControl,
    CorrectiveControl,
    RecoveryControl
};

SecurityEvent := {
    Observation,
    Alert,
    SuspiciousActivity,
    PolicyViolation,
    AttackEvent,
    SecurityIncident
};

# ---------- FUNDAMENTAL RELATIONSHIPS ----------
Cybersecurity PROTECTS Asset;
Threat TARGETS Asset;
Threat MAY_EXPLOIT Vulnerability;
Vulnerability EXISTS_IN Asset;
SecurityControl MITIGATES Threat;
SecurityControl REDUCES Vulnerability;
SecurityControl PROTECTS Asset;
SecurityEvent MAY_INDICATE Threat;
AttackEvent MAY_CAUSE SecurityIncident;
SecurityIncident AFFECTS Asset;

Confidentiality APPLIES_TO Asset;
Integrity APPLIES_TO Asset;
Availability APPLIES_TO Asset;
Authenticity APPLIES_TO Identity;
Accountability APPLIES_TO Action;
Resilience APPLIES_TO System;

# ---------- CIA SECURITY MODEL ----------
CIA := {
    Confidentiality,
    Integrity,
    Availability
};

Confidentiality :=
    prevent(UnauthorisedDisclosure);

Integrity :=
    prevent(UnauthorisedModification)
    + detect(UnauthorisedModification);

Availability :=
    maintain(AuthorisedAccess)
    + resist(ServiceDisruption)
    + recover(ServiceCapability);

SecurityObjective :=
    CIA
    UNION {
        Authenticity,
        Accountability,
        NonRepudiation,
        Privacy,
        Resilience
    };

# ---------- SECURITY STATE ----------
SecurityState(asset, time) :=
    f(
        ThreatExposure,
        VulnerabilityState,
        ControlState,
        IncidentState,
        OperationalContext
    );

Secure(asset) :=
    SecurityState(asset) SATISFIES RequiredSecurityObjectives;

Compromised(asset) :=
    EXISTS incident:
        incident AFFECTS asset
        AND incident IMPAIRS SecurityObjective;

# ---------- RISK ----------
RiskScenario :=
    (Asset, Threat, Vulnerability, Consequence);

Risk :=
    f(
        AssetValue,
        ThreatLikelihood,
        VulnerabilityExposure,
        Impact
    );

InherentRisk :=
    Risk WITHOUT SecurityControl;

ResidualRisk :=
    Risk AFTER SecurityControl;

IF SecurityControl EFFECTIVE_AGAINST Threat
THEN ResidualRisk < InherentRisk;

# ---------- ATTACK RELATIONSHIPS ----------
ThreatActor ->
    ThreatAction ->
    AttackVector ->
    Vulnerability ->
    Asset ->
    SecurityImpact;

AttackVector ENABLES ThreatAction;
ThreatAction EXPLOITS Vulnerability;
Exploitation MAY_CREATE Compromise;
Compromise MAY_CAUSE SecurityIncident;

AttackSurface :=
    SET_OF(ReachableExposurePoints);

IF AttackSurface INCREASES
THEN PotentialExposure INCREASES;

# ---------- CONTROL MODEL ----------
PreventiveControl PREVENTS_OR_REDUCES ThreatAction;
DetectiveControl DETECTS SecurityEvent;
CorrectiveControl REMEDIATES SecurityCondition;
RecoveryControl RESTORES AssetCapability;

ControlEffectiveness(control) :=
    f(
        Coverage,
        Correctness,
        Configuration,
        Reliability,
        Context
    );

DefenceInDepth :=
    compose(
        MultipleIndependentControls,
        MultipleSecurityLayers
    );

# ---------- IDENTITY SECURITY ----------
Identity ->
    Credential ->
    Authentication ->
    Authorisation ->
    AccessDecision ->
    ResourceAction;

Authentication VERIFIES Identity;
Authorisation EVALUATES Permission;
Permission GOVERNS ResourceAction;

IF Authentication == failed
THEN AccessDecision := deny;

IF Authentication == successful
AND Permission ALLOWS ResourceAction
THEN AccessDecision := allow;

# ---------- DATA SECURITY ----------
DataState := {
    DataAtRest,
    DataInTransit,
    DataInUse
};

Encryption PROTECTS Confidentiality;
IntegrityControl PROTECTS Integrity;
Backup SUPPORTS Availability;
AccessControl PROTECTS Confidentiality;
AuditLog SUPPORTS Accountability;

DataAtRest MAY_REQUIRE Encryption;
DataInTransit MAY_REQUIRE SecureTransport;
DataInUse MAY_REQUIRE ProcessIsolation;

# ---------- NETWORK SECURITY ----------
NetworkTraffic ->
    Observe ->
    Analyse ->
    ApplyPolicy ->
    Allow | Block | Alert;

Firewall ENFORCES NetworkPolicy;
NetworkSegmentation LIMITS Reachability;
ThreatDetection ANALYSES SecurityTelemetry;
SecurityTelemetry DESCRIBES SecurityEvent;

IF NetworkTraffic VIOLATES NetworkPolicy
THEN NetworkAction := block;

# ---------- VULNERABILITY LIFECYCLE ----------
Discover(Vulnerability) ->
    Validate(Vulnerability) ->
    Assess(Vulnerability) ->
    Prioritise(Vulnerability) ->
    Mitigate(Vulnerability) ->
    Verify(Mitigation) ->
    Monitor(Asset);

Patch MITIGATES SoftwareWeakness;
SecureConfiguration MITIGATES ConfigurationWeakness;
StrongAuthentication MITIGATES AuthenticationWeakness;
AccessControl MITIGATES AuthorisationWeakness;

# ---------- INCIDENT LIFECYCLE ----------
SecurityEvent ->
    Detect ->
    Validate ->
    Classify ->
    Investigate ->
    Contain ->
    Eradicate ->
    Recover ->
    Review;

IF SecurityEvent CONFIRMED_AS MaliciousActivity
THEN IncidentCandidate := true;

IF IncidentCandidate
AND SecurityObjective IMPAIRED
THEN SecurityIncident := confirmed;

Containment LIMITS IncidentPropagation;
Eradication REMOVES IncidentCause;
Recovery RESTORES RequiredCapability;
Review MAY_UPDATE SecurityControl;

# ---------- RESILIENCE ----------
Resilience :=
    Resist
    + Absorb
    + Respond
    + Recover
    + Adapt;

IF SecurityIncident OCCURS
THEN {
    MaintainCriticalFunctions;
    LimitImpact;
    RestoreCapability;
    LearnFromIncident;
};

# ---------- TRUST ----------
Trust(entity) :=
    f(
        IdentityConfidence,
        BehaviourEvidence,
        SecurityState,
        PolicyCompliance
    );

Trust IS_CONTEXT_DEPENDENT true;
Trust IS_NOT_EQUIVALENT_TO Authentication;

# ---------- SEMANTIC REASONING ----------
IF Threat TARGETS Asset
AND Vulnerability EXISTS_IN Asset
AND Threat CAN_EXPLOIT Vulnerability
THEN RiskScenario EXISTS;

IF RiskScenario EXISTS
AND NO_EFFECTIVE_CONTROL
THEN RiskPriority := increase;

IF SecurityControl MITIGATES Vulnerability
AND SecurityControl IS_EFFECTIVE
THEN VulnerabilityExposure := decrease;

IF Asset CONTAINS SensitiveData
THEN ConfidentialityRequirement := high;

IF Asset PROVIDES CriticalService
THEN AvailabilityRequirement := high;

IF UnauthorisedModification DETECTED
THEN IntegrityState := suspect;

IF ValidCredential USED
AND Identity NOT_VERIFIED
THEN AuthenticationConfidence := insufficient;

IF MultipleIndependentControls PROTECT Asset
THEN DefenceInDepth := true;

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE {
    "cyber security" ~= "cybersecurity";
    "cyber defence" ~= "cybersecurity defence";
    "security weakness" ~= "vulnerability";
    "cyber threat" ~= "digital threat" WHEN context == cybersecurity;
    "security safeguard" ~= "security control";
    "cyber incident" ~= "security incident" WHEN context == cybersecurity;
    "attack surface" ~= "exposed attack points";
    "access rights" ~= "permissions";
    "identity verification" ~= "authentication";
    "access control decision" ~= "authorisation decision";
}

# ---------- QUERY NORMALISATION ----------
NORMALISE(query) :=
    lowercase
    -> remove_noise
    -> resolve_aliases
    -> identify_security_terms
    -> identify_entities
    -> identify_relationships;

# ---------- QUERY ROUTING ----------
IF query MATCHES {
    "threat",
    "attack",
    "attacker",
    "intrusion"
}
THEN PRIORITISE {
    Threat,
    ThreatActor,
    AttackVector,
    SecurityEvent
};

IF query MATCHES {
    "weakness",
    "vulnerability",
    "patch"
}
THEN PRIORITISE {
    Vulnerability,
    VulnerabilityLifecycle,
    SecurityControl
};

IF query MATCHES {
    "risk",
    "likelihood",
    "impact"
}
THEN PRIORITISE {
    RiskScenario,
    InherentRisk,
    ResidualRisk
};

IF query MATCHES {
    "incident",
    "breach",
    "response",
    "recovery"
}
THEN PRIORITISE {
    SecurityIncident,
    IncidentLifecycle,
    Resilience
};

IF query MATCHES {
    "confidentiality",
    "integrity",
    "availability"
}
THEN PRIORITISE {
    CIA,
    SecurityObjective,
    SecurityState
};

# ---------- CONFIDENCE ----------
CONFIDENCE(assertion) :=
    weighted_mean(
        source_reliability,
        semantic_consistency,
        relationship_strength,
        contextual_relevance,
        evidence_quality
    );

IF CONFIDENCE >= 0.90
THEN ConfidenceClass := HIGH;

IF CONFIDENCE >= 0.70
AND CONFIDENCE < 0.90
THEN ConfidenceClass := MODERATE;

IF CONFIDENCE < 0.70
THEN ConfidenceClass := REVIEW;

# ---------- PROVENANCE ----------
PROVENANCE {
    preserve_source: true;
    preserve_relation_origin: true;
    preserve_revision_state: true;
    preserve_inference_path: true;
}

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION {
    interpretation: formal_semantic_reasoning;
    primary_entity: Cybersecurity;
    ontology: CybersecurityOntology;

    parse_entities: true;
    parse_relationships: true;
    preserve_directionality: true;
    execute_reasoning_rules: true;
    resolve_semantic_equivalence: true;
    apply_confidence_weighting: true;
    preserve_provenance: true;
    permit_hierarchical_expansion: true;
}

# ---------- UPDATE MODEL ----------
UPDATE_MODEL {
    new_entity:
        validate
        -> classify
        -> connect
        -> confidence_score
        -> integrate;

    new_relationship:
        validate_subject
        -> validate_predicate
        -> validate_object
        -> check_direction
        -> confidence_score
        -> integrate;

    new_security_evidence:
        associate_asset
        -> associate_threat
        -> associate_vulnerability
        -> update_security_state
        -> update_risk;

    conflict:
        preserve_provenance
        -> compare_evidence
        -> reduce_confidence_if_required
        -> flag_for_review;

    revision:
        recompute_relations
        -> recompute_inferences
        -> recompute_confidence
        -> regenerate_flow_hash;
}

# ---------- FLOW HASH ----------
FLOW_HASH_INPUT :=
    DOMAIN
    + SUBDOMAIN
    + ONTOLOGY
    + Asset
    + Threat
    + Vulnerability
    + SecurityControl
    + SecurityObjective
    + RELATIONSHIPS
    + SEMANTIC_REASONING
    + SEMANTIC_EQUIVALENCE
    + UPDATE_MODEL;

FLOW_HASH :=
    HASH(FLOW_HASH_INPUT);

# ---------- EXECUTION ----------
EXECUTE(query) :=
    NORMALISE(query)
    -> MAP_TO(CybersecurityOntology)
    -> EXPAND_RELEVANT_ENTITIES
    -> TRAVERSE_RELATIONSHIPS
    -> APPLY_SEMANTIC_REASONING
    -> SCORE_CONFIDENCE
    -> ATTACH_PROVENANCE
    -> RETURN(answer);

# ---------- TERMINAL ----------
CybersecurityOntology
    -> IdentifyAssets
    -> IdentifyThreats
    -> IdentifyVulnerabilities
    -> EvaluateRisk
    -> SelectControls
    -> ProtectSecurityObjectives
    -> DetectSecurityEvents
    -> RespondToIncidents
    -> RecoverCapabilities
    -> AdaptSecurityState
    -> PreserveDigitalTrust;

END FLOW