Create a reference implementation of Automated Threat Actor Classification (for demonstration purposes)

oasis-open / tac-ontology

OASIS Threat Actor Context (TAC) TC: Creating an ontology for expressing the rich context around Threat Actors. https://github.com/oasis-open/tac-ontology

BSD 3-Clause "New" or "Revised" License

9 stars 4 forks source link

Create a reference implementation of Automated Threat Actor Classification (for demonstration purposes) #53

Closed rhohimer closed 11 months ago

rhohimer commented 1 year ago

To help others see the business value of using graph technology to automate SME logic.

rhohimer commented 1 year ago

I needed to work on the STIX 2.1 JSON to STIX 2.1 Ontology conversion in order to proceed with this issue.

rhohimer commented 1 year ago

I have been working this issue. I now have 99 percent of the apt1.json example converting to apt1.ttl

Key requirements:

Conversion
- STIX 2.1 JSON to STIX.OWL to enable STIX JSON Reports to be converted to STIX Turtle Reports
Characteristic Recognition
- Illustrate object recognition by recognizing assertions of defining characteristics
- Illustrate Description Logics reasoning about defining characteristics

rhohimer commented 1 year ago

I've pushed a new branch to the repository: issue-53-reference-implementation.

There is a new utilities directory that contains the JSON-LD context conversion method and the SPARQL-Anything conversion method. I have elected to pursue the SPARQL-Anything approach but left the context conversion method in case others wish to continue developing it.

There is a new third-party extension. The Healthcare Agent Library contains an ontology (hal-library.owl) that extends the Threat Agent Library. The hal-example.owl file illustrates subclassing of a tal:RecklessEmployee with a hal:CuriousHeathcareWorker

We'll need to make progress on other issues to be ready for the Borderless Cyber conference.

rhohimer commented 11 months ago

I'm closing this issue because it is not really an issue with the ontology, but rather a project to implement an application to highlight the value of the Ontology. It may be that this better approached as a Project.