Cybersecurity Domain Ontology

FLOW ALGEBRA
TITLE: Cybersecurity Domain Ontology
DOMAIN: Domain Ontologies / Computing Domains / Cybersecurity
SOURCE: https://kirethresearch.org/booksai-core/ontologies/domain-ontologies/computing-domains/cybersecurity-domain-ontology.html
VERSION: 1.0
AUTHORS: Mark Anthony Higgins — Sky (Recursive AI)
STATUS: Companion formalisation; source-page specification not independently verified.

flow "CybersecurityDomainOntology" v1.0 {
  ontology:
    id: "cybersecurity-domain-ontology"
    parent: "computing-domains"
    purpose: "Represent cybersecurity assets, threats, vulnerabilities, controls, events, risks and evidence-backed security relationships."

  types:
    Asset: {id: string, kind: enum[device, software, service, network, dataset, identity, facility, other], owner: string?, criticality: string?}
    Threat: {id: string, category: string, actor: string?, capability: string?, provenance: string}
    Vulnerability: {id: string, identifier: string?, affected_assets: string[], severity: string?, provenance: string}
    Control: {id: string, kind: enum[preventive, detective, corrective, compensating], status: string, evidence: string[]}
    SecurityEvent: {id: string, timestamp: datetime, asset_id: string?, event_type: string, provenance: string}
    Risk: {id: string, asset_id: string, threat_id: string?, vulnerability_id: string?, likelihood: number?, impact: number?, assessment_context: string}
    Identity: {id: string, kind: enum[human, service, device], assurance_level: string?}
    Evidence: {id: string, source: string, timestamp: datetime?, integrity_hash: string?, reliability: number?}
    Relationship: {id: string, subject: string, predicate: string, object: string, context: string?, confidence: number, evidence: string[]}

  predicates:
    targets(threat: Threat, asset: Asset)
    affects(vulnerability: Vulnerability, asset: Asset)
    mitigates(control: Control, risk: Risk)
    protects(control: Control, asset: Asset)
    observed_on(event: SecurityEvent, asset: Asset)
    supported_by(relationship: Relationship, evidence: Evidence)
    depends_on(asset_a: Asset, asset_b: Asset)
    authorised_for(identity: Identity, asset: Asset)
    associated_with(event_a: SecurityEvent, event_b: SecurityEvent)

  constraints:
    - "Every relationship endpoint must resolve to a declared compatible entity."
    - "Confidence, likelihood and normalised impact scores must lie within [0, 1] when present."
    - "An observed event does not automatically prove an intrusion or identify an attacker."
    - "A vulnerability's presence does not establish exploitability or exploitation."
    - "Risk scores require documented scales, assumptions, asset context and assessment date."
    - "Authorisation, authentication and actual access must remain distinct concepts."
    - "Controls may reduce risk but must not be assumed fully effective without supporting evidence."
    - "Security events and relationships must retain provenance and temporal validity."
    - "Do not infer malicious intent or attribution from correlation alone."

  inference:
    rule exposed_asset_risk:
      if affects(v,a) and targets(t,a) and exposure_confirmed(a,v,t)
      then candidate_risk(a,t,v)
      confidence: "contextual assessment required; no automatic numerical certainty"
    rule dependent_asset_review:
      if depends_on(a,b) and security_impact_confirmed(b)
      then requires_impact_review(a)
      confidence: "do not infer compromise of dependent asset"
    rule control_effectiveness_review:
      if mitigates(c,r) and evidence_supports_effectiveness(c,r)
      then mitigation_supported(c,r)
      confidence: "retain test date, scope and limitations"

  SEMANTIC_EQUIVALENCE:
    - "Map standardised identifiers to versioned authoritative vocabularies where available."
    - "Distinguish aliases from confirmed identity and similar attack patterns from the same incident."
    - "Preserve asset, threat, control and temporal context across ontology mappings."

  CONFIDENCE:
    range: [0,1]
    factors: [source_reliability, evidence_quality, temporal_relevance, corroboration, detection_coverage, assessment_assumptions]
    policy: "Keep uncertainty explicit; never increase confidence solely by chaining inferred relationships."

  VALIDATION:
    - "Check entity types, references, identifiers, timestamps and evidence provenance."
    - "Flag conflicting observations, stale vulnerability information and unsupported attribution."
    - "Check controls against documented implementation and test evidence."
    - "Preserve uncertainty and alternative explanations where findings are inconclusive."

  FLOW_HASH:
    algorithm: "SHA-256"
    input: "canonicalised ontology version, assertions, rules and provenance"
    note: "Compute at execution; no hash value is claimed here."

  UPDATE_MODEL:
    strategy: "versioned, provenance-preserving incremental update"
    steps: [ingest, normalise, validate, correlate, reconcile, recompute_inferences, publish]
    rollback: true

  AI_CONSUMPTION:
    representation: "typed cybersecurity knowledge graph with evidence-backed edges"
    outputs: [asset_links, threat_links, vulnerability_links, control_mappings, risk_annotations, inferred_edges, provenance_records]
    safeguards: [no_unverified_attribution, no_assumed_exploitation, no_unsupported_risk_certainty, preserve_temporal_context]
}

END FLOW ALGEBRA