Elektronika 2009-11.pdf - Instytut Systemów Elektronicznych

Knowledge in ontology is represented by:
• classes - a general concepts;
• properties of these concepts;
• individuals - basic entities of concepts.
Ontology can be created in OWL language, using Protégé
application. There are many tools and software to support ontology
functionalities. Knowledge enrichment can be improved
by rules in SWRL (Semantic Web Rule Language) [11]. Rules
in SWRL applied to OWL ontology give possibility to extend
existing knowledge with new properties. This option enables
individuals to be reclassified and makes process of filling-up
properties of new individuals more automatic. Reasoning
about ontology concepts can be provided by semantic reasoners.
Relevant knowledge is also given by restrictions: relationships
or constraints.
Proposition of the ontology
In this section our ontology approach with special consideration
and emphasis on vulnerabilities is presented. Ontology
has been created in OWL-DL language using Protégé 3.4. application.
SCADA ontology aims at addressing the following key
SCADA issues:
• what are vulnerabilities of special SCADA components, architecture
or protocols,
• how these vulnerabilities affect SCADA resources,
• which threats/attacks may occur and what damage they
can cause?
According to ISO/IEC 13335-1:2004 standard [8] vulnerabilities
are considered as a part of network security system. In
this approach SCADA resources, components have weak
points named vulnerabilities. These vulnerabilities can be exploited
by threats, leading to attacks. This security system is
depicted into a form of classification with properties and relationships
among security issues.
Main concepts, which compose main classes of proposed
ontology following ISO/IEC 13335-1:2004 standard are:
• SCADA systems,
• SCADA resources,
• vulnerabilities,
• threats and attacks,
• source of attacks,
• safeguards.
The proposed hierarchy of ontology classes is presented
in Fig. 1. These classes are connected properties. Properties
show relations, dependence of one class on another or can
represent some attributes. Main classes, named also superclasses
have sub-classes. Sub-classes are specifications of
super-classes and inherit their features.
Going down the hierarchy, lower levels of subclasses
make ontology information more detailed. Properties of “Vulnerabilities”
class created in Protégé are presented in Fig. 2.
Visualization of ontology with some relations between different
classes is presented in Fig. 3. Subclasses of main
classes are also shown there.
Classification of key class of ontology - “Vulnerabilities”
has been based on vulnerability description given in [12]. Thus
SCADA vulnerabilities are grouped into five sub-classes of
“Vulnerabilities” class in proposed ontology:
• network Vulnerabilities,
• platforms Vulnerabilities,
• security and Administration Vulnerabilities,
• data vulnerabilities,
• architecture Vulnerabilities.
These areas of vulnerabilities correspond with particular
system components and can be connected with design, implementation,
misconfiguration and procedural problems. Hi-
Fig. 2. Properties of “Vulnerabilities” class created in Protégé
Rys. 2. Właściwości klasy “Vulnerabilities” stworzone w aplikacji
Protégé
Fig. 3. Main classes visualized in Jambalaya plug-in
Rys. 3. Główne klasy zwizualizowane w zakładce Jambalaya
Fig. 1. Existing class hierarchy
Rys. 1. Istniejąca hierarchia klas
Fig. 4. Proposed vulnerabilities classification
Rys. 4. Proponowana klasyfikacja podatności
36 ELEKTRONIKA 11/2009