First D3FEND-CCO mappings #296

giacomodecolle · 2024-09-17T01:40:37Z

First mappings between D3FEND and CCO, developed with @johnbeve and @Finn1928.

added some more low hanging fruit

addressing comments from Giacomo

Update d3fend-cco.ttl

netfl0 · 2024-09-18T17:31:13Z

src/ontology/mappings/d3fend-cco.ttl

+# An example cco gives of a representational ICE is a transcript, which seems similar to a log. But it might also 
+# be considered a descriptive ICE, so for this can be a subclass of ICE.
+
+d3f:Sensor owl:equivalentClass cco:Sensor .


@giacomodecolle , last CCO version I checked a cco:Sensor IS A transducer versus a functional sensor, this is a big problem in my view @giacomodecolle @mark-jensen @johnbeve

Here is how we have the taxonomy in D3FEND, this would be a proposal to refactor CCO:

Will bring this discussion to Mark and John eventually, I am taking the equivalence out for the moment

netfl0 · 2024-10-15T16:00:54Z

src/ontology/mappings/d3fend-cco.ttl

+#in order to decide about this mapping, we have to decide whether d3f:DefensiveTechnique and 
+# d3f:OffensiveTechnique are acts or more similar to plans.
+
+d3f:DigitalEvent rdfs:subClassOf <http://purl.obolibrary.org/obo/BFO_0000035> .


After discussion, tentatively:

New d3f:Event class equiv to bfo:Process .

New d3f:Action ~ cco:Act

netfl0 · 2024-10-15T16:22:11Z

src/ontology/mappings/d3fend-cco.ttl

+# Most if not all events in d3fend look like punctual events to me, and thus like BFO_0000035, aka process boundaries. In
+# case that some of them are not, we could map specific subclasses to process or process boundary.
+
+d3f:Activity rdfs:subClassOf <http://purl.obolibrary.org/obo/BFO_0000015> .


OBE, we've deleted d3f:Activity in 0.17.0 , we can delete this.

netfl0 · 2024-10-15T16:24:59Z

src/ontology/mappings/d3fend-cco.ttl

+
+# d3fend seems to only refer to human beings with "person", just as CCO does.
+
+d3f:PhysicalObject rdfs:subClassOf <http://purl.obolibrary.org/obo/BFO_0000030>.


We now only have d3f:PhysicalArtifact d3f:PhysicalObject was deleted in 0.17.0

netfl0 · 2024-10-15T16:29:05Z

src/ontology/mappings/d3fend-cco.ttl

+# other classes in d3fend which are not subclasses of PhysicalObject that fall under
+# BFO:0000030
+
+d3f:Technique rdfs:subClassOf cco:DirectiveInformationContentEntity.


we can now map d3f:Plan to cco:DirectiveInformationContentEntity or cco:Plan

We do not consider a Technique an Action.

netfl0 · 2024-10-15T16:31:06Z

src/ontology/mappings/d3fend-cco.ttl

+# Another way to look at this is to see whether d3f:technique are time indexed or not (e.g. my message
+# analysis technique started today at 8 pm)
+
+d3f:DefensiveTechnique rdfs:subClassOf cco:DirectiveInformationContentEntity.


OBE no longer needed

netfl0 · 2024-10-15T16:31:12Z

src/ontology/mappings/d3fend-cco.ttl

+
+#see d3f:Technique
+
+d3f:OffensiveTechnique rdfs:subClassOf cco:DirectiveInformationContentEntity.


OBE no longer needed

netfl0 · 2024-10-15T16:32:14Z

src/ontology/mappings/d3fend-cco.ttl

+# will become subclasses of cco:InformatioContentEntity, and thus of the d3f:InformationContentEntity class
+# as well. For example, if 
+
+d3f:Log rdfs:subClassOf cco:InformationContentEntity .


we have modeled log as a bearing entity.

We have also modeled record as a bearing entity but this is debatable.

I have been thinking about some of the content/bearing entity distinctions. Despite what some classes in CCO and C3O do, if something doesn't have properties like weight and spatial extension, I think it should go under the content entity part of the hierarchy. Perhaps a discussion for a future meeting.

netfl0 · 2024-10-15T16:34:27Z

src/ontology/mappings/d3fend-cco.ttl

+# A subclass of sensor they include is cyber sensor, which might be referring to programs which are ICEs.
+# If this is the case, this class is not equivalent to cco:Sensor, which is only about physical entities. 
+
+d3f:Artifact rdfs:subClassOf <http://purl.obolibrary.org/obo/BFO_0000002> .


Needs to be revisited:

netfl0 · 2024-10-15T16:35:30Z

src/ontology/mappings/d3fend-cco.ttl

+# which can have capabilities. If this is the case, we should use a broader capability class from some neighboring
+# BFO ontology.
+
+d3f:DigitalObject rdfs:subClassOf <http://purl.obolibrary.org/obo/BFO_0000002> .


OBE deleted Digital Object

netfl0 · 2024-10-15T16:36:28Z

src/ontology/mappings/d3fend-cco.ttl

+
+#obo:BFO_0000002 aka "continuant". What is the difference between d3f:DigitablObject and d3f:Information Content Entity?
+
+d3f:Monitoring rdfs:subClassOf cco:ActOfObservation .


OBE deleted

netfl0 · 2024-10-15T16:36:51Z

src/ontology/mappings/d3fend-cco.ttl

+# cco:ActOfObservation mentions "senses" which might or might not be the case for 
+# d3f:monitoring, which on the other hand might involve information processing monitoring procedures which are not tied to senses.
+
+d3f:AnalysisOfAlternatives rdfs:subClassOf cco:Act .


Correct but i think cco has something more specific

netfl0 · 2024-10-15T16:39:29Z

src/ontology/mappings/d3fend-cco.ttl

+#The definition of Identifier says it's a name, but Designative ICEs include non-name identifiers.
+#I therefore made identifier a subclass rather than equivalent to Designative ICE.
+
+d3f:JobSchedule rdfs:subClassOf cco:Plan .


This isn't going to make a problem, but its hard to imagine a reasonable use case for this.

netfl0 · 2024-10-15T16:40:53Z

Make sure to merge in d3fend develop to pull in 0.17.0

Solved some of the issues discussed in comments, and updated identifiers to the new opaque identifiers adopted by CCO 2.0

Solving issues discussed in the last call and updating to opaque identifier in CCO 2.0

Solving issues discussed in the last call and updating to the opaque identifiers from CCO 2.0.

giacomodecolle · 2024-11-14T17:29:53Z

I went through comments from last meeting and updated to new CCO identifiers. Apologies for the three commits, there was something messed up on my end of things. By next meeting, I will work on some new mappings for the remaining core classes.

netfl0 · 2024-11-20T13:02:55Z

src/ontology/mappings/d3fend-cco.ttl

+
+
+d3f:Technique rdfs:subClassOf <https://www.commoncoreontologies.org/ont00000974> .
+#cco org/ont00000974 is cco Plan.


In the new version of D3FEND Core we have Plan. It may make sense to just map d3f:Plan to cco:Plan.

We make a distinction between technique and procedure, both we've categorized as plans. Technique is a less defined type of plan than procedure. Like a meta-plan if that makes sense.

We're trying to disambiguate some terminology which has military roots: Tactics, Techniques, and Procedures.

Deleting technique mapping, adding CCO 2.0

Updating according to last comments on PR

Adding mappings

src/ontology/mappings/d3fend-cco.ttl

Adding 1.0 mappings

netfl0 · 2024-12-18T17:02:03Z

src/ontology/mappings/d3fend-cco.ttl

@@ -35,13 +46,43 @@ d3f:DigitalArtifact rdfs:subClassOf <http://purl.obolibrary.org/obo/BFO_0000002>
  # subclass of "information bearing artifact" which is "independent
  # continuant" in BFO.

-d3f:Action rdfs:subClassOf cco:Act .
+d3f:System owl:equivalentClass [ owl:intersectionOf ( <http://purl.obolibrary.org/obo/BFO_0000027>


convert to sublcass of rather than equiv...

netfl0 · 2024-12-18T17:11:55Z

src/ontology/mappings/d3fend-cco.ttl

+d3f:Event owl:equivalentClass <http://purl.obolibrary.org/obo/BFO_0000015> .
+# Equivalent to BFO_0000015 aka process.
+
+d3f:DigitalEvent rdfs:subClassOf [ owl:intersectionOf ( <http://purl.obolibrary.org/obo/BFO_0000015>


add we mean both ICE and IBA

netfl0 · 2024-12-18T17:16:38Z

src/ontology/mappings/d3fend-cco.ttl

+
+# This might be made more precise depending on the children classes. See some examples in the comments below.
+
+# d3f:Execution rdfs:subClassOf <http://purl.obolibrary.org/obo/BFO_0000015> .


there is no d3f:Execution

netfl0 · 2024-12-18T17:17:27Z

src/ontology/mappings/d3fend-cco.ttl

+# d3f:Execution rdfs:subClassOf <http://purl.obolibrary.org/obo/BFO_0000015> .
+# where BFO 0000015 is process. Although, wouldn't this just make d3f:Execution better suited as a digital event?
+
+d3f:InformationContentEntity owl:equivalentClass <https://www.commoncoreontologies.org/ont00000958> .


d3f:InformationContentEntity will be deprecated, please remove this line.

netfl0 · 2024-12-18T17:19:38Z

src/ontology/mappings/d3fend-cco.ttl

+# will become subclasses of cco:InformationContentEntity, and thus of the d3f:InformationContentEntity class
+# as well if we keep the equivalence relation.
+
+d3f:Log rdfs:subClassOf <https://www.commoncoreontologies.org/ont00000958> .


Log should be a bearer

netfl0 · 2024-12-18T17:22:10Z

src/ontology/mappings/d3fend-cco.ttl

+#d3f:Sensor owl:equivalentClass cco:Sensor .
+#waiting to discuss this given discussion on transducers
+
+d3f:Capability owl:equivalentClass <https://www.commoncoreontologies.org/ont00001379> .


Lets remove this for now. Catalog things are going to be deprecated.

netfl0 · 2024-12-18T17:22:16Z

src/ontology/mappings/d3fend-cco.ttl

+d3f:PhysicalLocation rdfs:subClassOf <http://purl.obolibrary.org/obo/BFO_0000029> .
+# BFO 0000029 is site
+
+d3f:AnalysisOfAlternatives rdfs:subClassOf <https://www.commoncoreontologies.org/ont00000228> .


Lets remove this for now. Catalog things are going to be deprecated.

netfl0 · 2024-12-18T17:22:23Z

src/ontology/mappings/d3fend-cco.ttl

+
+#This also seems to be an act, or a planned act.
+
+d3f:Assessment rdfs:subClassOf <https://www.commoncoreontologies.org/ont00000636> .


Lets remove this for now. Catalog things are going to be deprecated.

Fixing after discussion for 1.0

Fixing a typo

giacomodecolle and others added 12 commits May 15, 2024 09:04

Add files via upload

7089da4

Update d3fend-cco.ttl

53ba6b3

Update d3fend-cco.ttl

c952a85

Update d3fend-cco.ttl

e54e0b8

Update d3fend-cco.ttl

deddced

added some more low hanging fruit

Update d3fend-cco.ttl

6a94342

addressing comments from Giacomo

Merge pull request #1 from Finn1928/develop

5665e5a

Update d3fend-cco.ttl

Update d3fend-cco.ttl

5c55b96

Merge branch 'd3fend:develop' into develop

aaa2607

Merge branch 'd3fend:develop' into develop

717f863

Update d3fend-cco.ttl

4154236

Update d3fend-cco.ttl

971e64d

netfl0 reviewed Sep 18, 2024

View reviewed changes

netfl0 reviewed Oct 15, 2024

View reviewed changes

netfl0 requested changes Oct 15, 2024

View reviewed changes

giacomodecolle added 5 commits October 20, 2024 16:38

Merge branch 'd3fend:develop' into develop

53e6d71

Merge branch 'd3fend:develop' into develop

89665fd

Solving issues and updating to CCO 2.0

00eaf0d

Solved some of the issues discussed in comments, and updated identifiers to the new opaque identifiers adopted by CCO 2.0

Solving issues and updating to CCO 2.0

2296aa4

Solving issues discussed in the last call and updating to opaque identifier in CCO 2.0

Solving issues and updating to CCO 2.0

d0a2f74

Solving issues discussed in the last call and updating to the opaque identifiers from CCO 2.0.

netfl0 reviewed Nov 20, 2024

View reviewed changes

giacomodecolle added 6 commits December 1, 2024 19:23

Updating according to last comments on PR

bab4fd8

Deleting technique mapping, adding CCO 2.0

Making changes as per last comments

2a0f479

Merge pull request #3 from giacomodecolle/giacomodecolle-patch-2

b8b896e

Updating according to last comments on PR

Merge branch 'd3fend:develop' into develop

3d57592

Adding mappings

fd32f4d

Merge pull request #4 from giacomodecolle/giacomodecolle-patch-2

ff635c0

Adding mappings

netfl0 reviewed Dec 12, 2024

View reviewed changes

src/ontology/mappings/d3fend-cco.ttl Show resolved Hide resolved

netfl0 assigned aamedina Dec 17, 2024

giacomodecolle and others added 5 commits December 18, 2024 03:48

Merge branch 'd3fend:develop' into develop

2279dbe

Adding 1.0 mappings

646fe61

Version 1.0 mappings

c4f87d2

Merge pull request #5 from giacomodecolle/giacomodecolle-patch-5

a787ace

Adding 1.0 mappings

fix missing periods

79ecdea

netfl0 reviewed Dec 18, 2024

View reviewed changes

giacomodecolle and others added 5 commits December 18, 2024 14:53

Fixing after discussion for 1.0

f67334d

Merge pull request #6 from giacomodecolle/giacomodecolle-patch-6

051aba0

Fixing after discussion for 1.0

Fixing a typo

c66adba

Merge pull request #7 from giacomodecolle/giacomodecolle-patch-7

ea52774

Fixing a typo

fix pellet errors, fix bad definition on Artifact

8b348a2

netfl0 marked this pull request as ready for review December 18, 2024 21:54

netfl0 self-requested a review December 18, 2024 21:54

netfl0 approved these changes Dec 18, 2024

View reviewed changes

netfl0 merged commit eed4993 into d3fend:develop Dec 18, 2024
1 check passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

First D3FEND-CCO mappings #296

First D3FEND-CCO mappings #296

giacomodecolle commented Sep 17, 2024

netfl0 Sep 18, 2024

giacomodecolle Nov 12, 2024

netfl0 Oct 15, 2024

netfl0 Oct 15, 2024

netfl0 Oct 15, 2024

netfl0 Oct 15, 2024

netfl0 Oct 15, 2024

netfl0 Oct 15, 2024

netfl0 Oct 15, 2024

giacomodecolle Nov 12, 2024

netfl0 Oct 15, 2024

netfl0 Oct 15, 2024

netfl0 Oct 15, 2024

netfl0 Oct 15, 2024

netfl0 Oct 15, 2024

netfl0 commented Oct 15, 2024

giacomodecolle commented Nov 14, 2024

netfl0 Nov 20, 2024

netfl0 Dec 18, 2024

netfl0 Dec 18, 2024

netfl0 Dec 18, 2024

netfl0 Dec 18, 2024

netfl0 Dec 18, 2024

netfl0 Dec 18, 2024

netfl0 Dec 18, 2024

netfl0 Dec 18, 2024


		# d3fend seems to only refer to human beings with "person", just as CCO does.

		d3f:PhysicalObject rdfs:subClassOf <http://purl.obolibrary.org/obo/BFO_0000030>.


		#see d3f:Technique

		d3f:OffensiveTechnique rdfs:subClassOf cco:DirectiveInformationContentEntity.


		#obo:BFO_0000002 aka "continuant". What is the difference between d3f:DigitablObject and d3f:Information Content Entity?

		d3f:Monitoring rdfs:subClassOf cco:ActOfObservation .



		d3f:Technique rdfs:subClassOf <https://www.commoncoreontologies.org/ont00000974> .
		#cco org/ont00000974 is cco Plan.


		# This might be made more precise depending on the children classes. See some examples in the comments below.

		# d3f:Execution rdfs:subClassOf <http://purl.obolibrary.org/obo/BFO_0000015> .


		#This also seems to be an act, or a planned act.

		d3f:Assessment rdfs:subClassOf <https://www.commoncoreontologies.org/ont00000636> .

First D3FEND-CCO mappings #296

First D3FEND-CCO mappings #296

Conversation

giacomodecolle commented Sep 17, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

netfl0 commented Oct 15, 2024

giacomodecolle commented Nov 14, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment