Automating threat modeling using an ontology framework Validated with data from critical infrastruct

• 作 者: Margus Valja Fredrik Heiding Ulrik Franke Robert Lagerstrom
• 机 构: KTH Royal Institute of Technology,100 44 Stockholm,Sweden.;RISE Research Institutes of Sweden,164 40
• 出 处: 网络空间安全科学与技术（英文版）
• 发表日期: 2020年3期
• 关键词: Threat modeling Ontologies Automated modeling Conceptual models Ontology framewo

Threat modeling is of increasing importance to IT security,and it is a complex and resource demanding task.The aim of automating threat modeling is to simplify model creation by using data that are already available.However,the collected data often lack context;this can make the automated models less precise in terms of domain knowledge than those created by an expert human modeler.The lack of domain knowledge in modeling automation can be addressed with ontologies.In this paper,we introduce an ontology framework to improve automatic threat modeling.The framework is developed with conceptual modeling and validated using three different datasets:a small scale utility lab,water utility control network,and university IT environment.The framework produced successful results such as standardizing input sources,removing duplicate name entries,and grouping application software more logically.