A Semantic Approach to Evaluate the Impact of Cyber Actions to the Physical Domain.

Abstract

Evaluating the impact that events within the cyber domain inflict to a military operation and its critical infrastructure is a non-trivial question, which remains unanswered so far in spite of the various research efforts addressing it. The key issue underlying this question is the difficulty in correlating cyber and physical behaviors in an integrated view, thus allowing for real-time task evaluation. This paper addresses the issue with the development of an ontology-based framework in which the cyber and physical behaviors are integrated in a consolidated view, using a combination of open standards protocols and semantic technologies. In our approach, the mission and its physical aspects are modeled using a business process language (e.g., BPMN) and an information infrastructure based on Simple Network Management Protocol (SNMP). In this scheme, changes in the environment are captured using the output of sensor components existing in the infrastructure. In order to ensure a complete and integrated analysis of the accruing data, we have developed a Cyber Situation ontology (in OWL language) and a methodology for mapping the cyber and the physical domains. In this framework, mission data from the environment is retrieved and fused using an engine based on the semantic rule language (SWRL). The output of this process is then presented to an analyst in a way that only the most important information needed to support his/her decisions is shown. To validate our approach, a fictitious air traffic scenario was modeled and many simulated flights were generated in support to our experiments.