Protecting digital assets using an ontology based cyber situational awareness system
IntroductionCyber situational awareness is critical for detecting and mitigating cybersecurity threats in real-time. This study introduces a comprehensive methodology that integrates the Isolation Forest and autoencoder algorithms, Structured Threat Information Expression (STIX) implementation, and...
Saved in:
| Main Authors: | , , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Frontiers Media S.A.
2025-01-01
|
| Series: | Frontiers in Artificial Intelligence |
| Subjects: | |
| Online Access: | https://www.frontiersin.org/articles/10.3389/frai.2024.1394363/full |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1841552011742412800 |
|---|---|
| author | Tariq Ammar Almoabady Yasser Mohammad Alblawi Ahmad Emad Albalawi Majed M. Aborokbah S. Manimurugan Ahmed Aljuhani Hussain Aldawood P. Karthikeyan |
| author_facet | Tariq Ammar Almoabady Yasser Mohammad Alblawi Ahmad Emad Albalawi Majed M. Aborokbah S. Manimurugan Ahmed Aljuhani Hussain Aldawood P. Karthikeyan |
| author_sort | Tariq Ammar Almoabady |
| collection | DOAJ |
| description | IntroductionCyber situational awareness is critical for detecting and mitigating cybersecurity threats in real-time. This study introduces a comprehensive methodology that integrates the Isolation Forest and autoencoder algorithms, Structured Threat Information Expression (STIX) implementation, and ontology development to enhance cybersecurity threat detection and intelligence. The Isolation Forest algorithm excels in anomaly detection in high-dimensional datasets, while autoencoders provide nonlinear detection capabilities and adaptive feature learning. Together, they form a robust framework for proactive anomaly detection.MethodsThe proposed methodology leverages the Isolation Forest for efficient anomaly identification and autoencoders for feature learning and nonlinear anomaly detection. Threat information was standardized using the STIX framework, facilitating structured and dynamic assessment of threat intelligence. Ontology development was employed to represent knowledge systematically and enable semantic correlation of threats. Feature mapping enriched datasets with contextual threat information.ResultsThe proposed dual-algorithm framework demonstrated superior performance, achieving 95% accuracy, a 99% F1 score, and a 94.60% recall rate. These results outperformed the benchmarks, highlighting the model’s effectiveness in proactive anomaly detection and cyber situational awareness enhancement.DiscussionThe integration of STIX and ontology development within the proposed methodology significantly enhanced threat information standardization and semantic analysis. The dual-algorithm approach provided improved detection capabilities compared to traditional methods, underscoring its potential for scalable and effective cybersecurity applications. Future research could explore further optimization and real-world deployments to refine and validate the approach. |
| format | Article |
| id | doaj-art-bdcf8495862f4fea9c16b847edafcb93 |
| institution | Kabale University |
| issn | 2624-8212 |
| language | English |
| publishDate | 2025-01-01 |
| publisher | Frontiers Media S.A. |
| record_format | Article |
| series | Frontiers in Artificial Intelligence |
| spelling | doaj-art-bdcf8495862f4fea9c16b847edafcb932025-01-09T13:43:14ZengFrontiers Media S.A.Frontiers in Artificial Intelligence2624-82122025-01-01710.3389/frai.2024.13943631394363Protecting digital assets using an ontology based cyber situational awareness systemTariq Ammar Almoabady0Yasser Mohammad Alblawi1Ahmad Emad Albalawi2Majed M. Aborokbah3S. Manimurugan4Ahmed Aljuhani5Hussain Aldawood6P. Karthikeyan7Faculty of Computers and Information Technology, University of Tabuk, Tabuk, Saudi ArabiaFaculty of Computers and Information Technology, University of Tabuk, Tabuk, Saudi ArabiaFaculty of Computers and Information Technology, University of Tabuk, Tabuk, Saudi ArabiaFaculty of Computers and Information Technology, University of Tabuk, Tabuk, Saudi ArabiaFaculty of Computers and Information Technology, University of Tabuk, Tabuk, Saudi ArabiaFaculty of Computers and Information Technology, University of Tabuk, Tabuk, Saudi ArabiaNEOM, Tabuk, Saudi ArabiaRV University, Bengaluru, IndiaIntroductionCyber situational awareness is critical for detecting and mitigating cybersecurity threats in real-time. This study introduces a comprehensive methodology that integrates the Isolation Forest and autoencoder algorithms, Structured Threat Information Expression (STIX) implementation, and ontology development to enhance cybersecurity threat detection and intelligence. The Isolation Forest algorithm excels in anomaly detection in high-dimensional datasets, while autoencoders provide nonlinear detection capabilities and adaptive feature learning. Together, they form a robust framework for proactive anomaly detection.MethodsThe proposed methodology leverages the Isolation Forest for efficient anomaly identification and autoencoders for feature learning and nonlinear anomaly detection. Threat information was standardized using the STIX framework, facilitating structured and dynamic assessment of threat intelligence. Ontology development was employed to represent knowledge systematically and enable semantic correlation of threats. Feature mapping enriched datasets with contextual threat information.ResultsThe proposed dual-algorithm framework demonstrated superior performance, achieving 95% accuracy, a 99% F1 score, and a 94.60% recall rate. These results outperformed the benchmarks, highlighting the model’s effectiveness in proactive anomaly detection and cyber situational awareness enhancement.DiscussionThe integration of STIX and ontology development within the proposed methodology significantly enhanced threat information standardization and semantic analysis. The dual-algorithm approach provided improved detection capabilities compared to traditional methods, underscoring its potential for scalable and effective cybersecurity applications. Future research could explore further optimization and real-world deployments to refine and validate the approach.https://www.frontiersin.org/articles/10.3389/frai.2024.1394363/fullanomaly detectioncyber situational awarenessstructured threat information expressionisolation forest algorithmauto encoder |
| spellingShingle | Tariq Ammar Almoabady Yasser Mohammad Alblawi Ahmad Emad Albalawi Majed M. Aborokbah S. Manimurugan Ahmed Aljuhani Hussain Aldawood P. Karthikeyan Protecting digital assets using an ontology based cyber situational awareness system Frontiers in Artificial Intelligence anomaly detection cyber situational awareness structured threat information expression isolation forest algorithm auto encoder |
| title | Protecting digital assets using an ontology based cyber situational awareness system |
| title_full | Protecting digital assets using an ontology based cyber situational awareness system |
| title_fullStr | Protecting digital assets using an ontology based cyber situational awareness system |
| title_full_unstemmed | Protecting digital assets using an ontology based cyber situational awareness system |
| title_short | Protecting digital assets using an ontology based cyber situational awareness system |
| title_sort | protecting digital assets using an ontology based cyber situational awareness system |
| topic | anomaly detection cyber situational awareness structured threat information expression isolation forest algorithm auto encoder |
| url | https://www.frontiersin.org/articles/10.3389/frai.2024.1394363/full |
| work_keys_str_mv | AT tariqammaralmoabady protectingdigitalassetsusinganontologybasedcybersituationalawarenesssystem AT yassermohammadalblawi protectingdigitalassetsusinganontologybasedcybersituationalawarenesssystem AT ahmademadalbalawi protectingdigitalassetsusinganontologybasedcybersituationalawarenesssystem AT majedmaborokbah protectingdigitalassetsusinganontologybasedcybersituationalawarenesssystem AT smanimurugan protectingdigitalassetsusinganontologybasedcybersituationalawarenesssystem AT ahmedaljuhani protectingdigitalassetsusinganontologybasedcybersituationalawarenesssystem AT hussainaldawood protectingdigitalassetsusinganontologybasedcybersituationalawarenesssystem AT pkarthikeyan protectingdigitalassetsusinganontologybasedcybersituationalawarenesssystem |