search

oasis-open / tac-ontology

OASIS Threat Actor Context (TAC) TC: Creating an ontology for expressing the rich context around Threat Actors. https://github.com/oasis-open/tac-ontology
BSD 3-Clause "New" or "Revised" License
9 stars 4 forks source link

Validate that vocabularies and open vocabularies can be used in inferential statements #7

Closed rhohimer closed 1 year ago

rhohimer commented 2 years ago

It has been determined that Vocabularies implemented with custom datatypes are not supported by main stream reasoners. An alternate method of implementation should be used.

The workaround is to implement the vocabulary as string instances in the range of the datatype property.

rhohimer commented 2 years ago

We have verified that the vocabularies when represented as custom datatypes are not supported by some (id not most) COTS reasoners. This means the reasoner interprets the custom datatype as a logical inconsistency and stops. Once stopped, it does no further reasoning.

The solution is to roll back to representing the vocabularies as lists of strings.

rhohimer commented 2 years ago

The custom datatypes for vocabularies have been removed. The assertion of the vocabularies as lists of strings in the range of the associated datatype property has not been been done. This issue should be assigned someone to implement the vocabularies in one of the next working sessions. FYI Tagging: @Vasileios-Mavroeidis @rhohimer

rhohimer commented 1 year ago

@Vasileios-Mavroeidis @mateusdz Reprioritizing the implementation of vocabularies. As noted in this issue custom datatype are not supported by reasoners. Adding Mateusz to the assignees.

rhohimer commented 1 year ago

I have created an issue-7-open-vocabularies branch where I will implement an alternate method on supporting open-vocabularies. Once complete, I'll commit the branch to the origin. We can review it then. Acceptance criteria for this branch is that it must maintain logical consistency for the reasoner to run.

rhohimer commented 1 year ago

I feel poorly about this @mateusdz . I see that you put a lot of work into reestablishing the custom datatypes for all the Open Vocabularies.

rhohimer commented 1 year ago

getting closer to resolution, however, there is still a logical inconsistency involving StixObject and integer... weird image

rhohimer commented 1 year ago

An ObjectProperty whose range includes stix:StixObject needs to be rmoved for the following: image

rhohimer commented 1 year ago

Removed all the someValuesFrom restrictions in the above mentioned files. I was able to successfully run the Description Logics Reasoner and infer Threat Actor Types.

rhohimer commented 1 year ago

image

rhohimer commented 1 year ago

Worked with Tim Casey to document the approach to handling STIX open vocabularies within stix.owl.

https://docs.google.com/document/d/1i206hb64kuqP1UU0Tn8L0UsDLliZkshw9rG_qwUVD0o/edit#

rhohimer commented 1 year ago

I have validated that the approach to using stix:categorizedBy some stix:StixCategoryObject works. Closing this issue and opening an issue for each OpenVocabulary implementation. Starting with AccountTypeOv.