DCO: Bridging the Gap Between Real-Time External Scanning and Semantic Cybersecurity Analysis

TL;DR

In the era of microservices and ephemeral containers, static security documentation is effectively a "dead" asset. This paper introduces a Dynamic Cybersecurity Ontology (DCO) framework that automates the ingestion of live scan data (from Shodan/Censys) into a semantic model. It allows security administrators to run complex SPARQL queries to identify vulnerabilities in real-time, effectively automating the discovery of unpatched systems across vast, fluctuating networks.

Problem & Motivation: The "Static" Crisis in a Dynamic World

Traditional cybersecurity management relies heavily on ontologies like UCO (Unified Cybersecurity Ontology) or STIX. While these are excellent for categorization and information sharing, they suffer from a terminal flaw: data latency.

In modern IT environments:

• Complexity is exponential: Distributed architectures and microservices change their state daily.
• Data is non-semantic: Tools like Shodan provide massive amounts of JSON data, but these "data lakes" lack the relational depth (the "why" and "how") needed for automated reasoning.
• The "Inventory Gap": Many organizations do not even have an accurate list of their public-facing assets, making it impossible to map them to known CVEs (Common Vulnerabilities and Exposures).

The authors realized that for an ontology to be useful, it must not just describe the domain; it must describe the current instance of the world by pulling data automatically.

Methodology: The Dynamic Cybersecurity Ontology (DCO)

The core contribution is a framework that treats external security search engines as dynamic knowledge sources.

1. Architecture Overview

The system acts as a semantic wrapper. It takes the JSON output from scanners, maps it to the DCO, and exposes a SPARQL endpoint. This allows an admin to ask a single question: "Which of my active IPs are running a version of Apache susceptible to CVE-2018-1283?" and get an answer derived from live internet data.

(Note: Figure 1 illustrates the integration between external scanners, the DCO mapping, and the end-user SPARQL interface.)

2. The Ontology Schema

The DCO is structured around six core pillars:

• Organization: Aggregates scan results by ISP, Hostname, and ASN.
• Service: Details the specific scanned port and protocol.
• Vulnerability: Links services to specific CVE IDs and risk levels.
• Exploit: Connects vulnerabilities to actual exploit code/results.
• CVE: A MITRE-compatible entry format.
• Product: Tracks versions and vendors to maintain a historical "software lineage."

Experiments & Real-World Use Cases

The authors validated their framework using the infrastructure of the University of Maria Curie-Sklodowska (UMCS).

Use Case: Automated Vulnerability Hunting

By running a SPARQL query against the university’s IP range, the system automatically:

1. Identified all active Apache HTTP Server versions.
2. Cross-referenced these versions with the CVE database.
3. Flagged specific IPs (e.g., 212.182.61.157) running outdated software like Apache 2.4.6, susceptible to known risks.

The Power of "Temporal" Analysis

One of the most impressive features discovered was the ability to track lineage. By storing periodic scans in the ontology, administrators can see exactly when a vulnerable version was introduced to the system—a critical requirement for forensic auditing.

Table: The framework tracks the evolution of software versions (e.g., Apache 2.4.20 to 2.4.25) over years, providing an automated "IT archeology" tool.

Critical Analysis & Future Outlook

Takeaway

The DCO framework successfully demonstrates that the main hurdle in cybersecurity isn't a lack of information, but the lack of automated integration. By turning "dumb" JSON scan results into "smart" semantic data, they enable a higher level of situational awareness.

Limitations & Future Work

• Unstructured Data: Current version relies on structured scanner outputs. The authors plan to integrate NLP to ingest data from hacker forums and security blogs to predict "zero-day" threats before they are indexed in Shodan.
• Temporal Logic: Future iterations will align with the General Formal Ontology (GFO) to provide more rigorous mathematical modeling of how systems change over time.

In conclusion, this work paves the way for a "self-aware" IT infrastructure that can automatically report its own vulnerabilities as soon as they appear in the public domain.