Ontology in information security: a useful theoretical foundation and methodological tool

ABSTRACT

The paper introduces and advocates an ontological semantic approach to information security. Both the approach and its resources, the ontology and lexicons, are borrowed from the field of natural language processing and adjusted to the needs of the new domain. The approach pursues the ultimate dual goals of inclusion of natural language data sources as an integral part of the overall data sources in information security applications, and formal specification of the information security community know-how for the support of routine and time-efficient measures to prevent and counteract computer attacks. As the first order of the day, the approach is seen by the information security community as a powerful means to organize and unify the terminology and nomenclature of the field.

REFERENCES

• 1: Mikhail J. Atallah , Victor Raskin , Michael Crogan , Christian Hempelmann , Florian Kerschbaum , Dina Mohamed , Sanket Naik, Natural Language Watermarking: Design, Analysis, and a Proof-of-Concept Implementation, Proceedings of the 4th International Workshop on Information Hiding, p.185-199, April 25-27, 2001
• 2: Seymour Bosworth , Michel Kabay , M. E. Kabay, Computer Security Handbook, John Wiley & Sons, Inc., New York, NY, 2002
• 3: Pfitzmann, A., and Köhntopp, M. Anonymity, unobservability, and pseudonymy---A proposal for terminology, Position paper for a symposium on anonymity at IHW-01, 2001. http://www.koehntopp.de/marit/pub/anon/ihw/Anon_Terminology_IHW.pdf.
• 4: Mikhail J. Atallah , Craig J. McDonough , Victor Raskin , Sergei Nirenburg, Natural language processing for information assurance and security: an overview and implementations, Proceedings of the 2000 workshop on New security paradigms, p.51-65, September 18-21, 2000, Ballycotton, County Cork, Ireland [doi>10.1145/366173.366190]
• 5: Steven J. Templeton , Karl Levitt, A requires/provides model for computer attacks, Proceedings of the 2000 workshop on New security paradigms, p.31-38, September 18-21, 2000, Ballycotton, County Cork, Ireland [doi>10.1145/366173.366187]

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Information flow controls

Additional Classification:
  F. Theory of Computation
  F.3 LOGICS AND MEANINGS OF PROGRAMS
      F.3.2 Semantics of Programming Languages
          Subjects: Operational semantics

  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)
          Subjects: Natural language

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Unauthorized access (e.g., hacking, phreaking)

General Terms:
Design, Languages, Security

Keywords:
documentation, human factors, languages, security, standardization, theory