Protecting digital assets using an ontology based cyber situational awareness system

• Published in: Frontiers in artificial intelligence Vol. 7; p. 1394363
• Main Authors: Almoabady, Tariq Ammar, Alblawi, Yasser Mohammad, Albalawi, Ahmad Emad, Aborokbah, Majed M., Manimurugan, S., Aljuhani, Ahmed, Aldawood, Hussain, Karthikeyan, P.
• Format: Journal Article
• Language: English
• Published: Switzerland Frontiers Media S.A 09.01.2025
• Subjects: anomaly detection; Artificial Intelligence; auto encoder; cyber situational awareness; isolation forest algorithm; structured threat information expression; structured threat information expression; anomaly detection; auto encoder; isolation forest algorithm; cyber situational awareness
• DOI: 10.3389/frai.2024.1394363
• ISSN: 2624-8212

Cyber situational awareness is critical for detecting and mitigating cybersecurity threats in real-time. This study introduces a comprehensive methodology that integrates the Isolation Forest and autoencoder algorithms, Structured Threat Information Expression (STIX) implementation, and ontology development to enhance cybersecurity threat detection and intelligence. The Isolation Forest algorithm excels in anomaly detection in high-dimensional datasets, while autoencoders provide nonlinear detection capabilities and adaptive feature learning. Together, they form a robust framework for proactive anomaly detection. The proposed methodology leverages the Isolation Forest for efficient anomaly identification and autoencoders for feature learning and nonlinear anomaly detection. Threat information was standardized using the STIX framework, facilitating structured and dynamic assessment of threat intelligence. Ontology development was employed to represent knowledge systematically and enable semantic correlation of threats. Feature mapping enriched datasets with contextual threat information. The proposed dual-algorithm framework demonstrated superior performance, achieving 95% accuracy, a 99% F1 score, and a 94.60% recall rate. These results outperformed the benchmarks, highlighting the model's effectiveness in proactive anomaly detection and cyber situational awareness enhancement. The integration of STIX and ontology development within the proposed methodology significantly enhanced threat information standardization and semantic analysis. The dual-algorithm approach provided improved detection capabilities compared to traditional methods, underscoring its potential for scalable and effective cybersecurity applications. Future research could explore further optimization and real-world deployments to refine and validate the approach.