From 7089da4061d4c66ac922f057b6788804e9213df0 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Wed, 15 May 2024 09:04:36 -0400 Subject: [PATCH 01/21] Add files via upload --- src/ontology/mappings/d3fend-cco.ttl | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index c6343eea..e8c6cf76 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -37,10 +37,17 @@ d3f:DigitalArtifact rdfs:subClassOf d3f:Action rdfs:subClassOf cco:Act . +d3f:DigitalEvent rdfs:subClassOf . +# All digital events in d3fend look like punctual events to me, and thus like process boundaries. In +# case that some of them are not, we could map specific subclasses to process or process boundary + +d3f:Activity rdfs:subClassOf . + # Note: The obo: prefix doesn't resolve in the ROBOT merge, so full IRI specified... # d3f:Weakness rdfs:subClassOf obo:BFO_0000016 . # obo:BFO_0000016 aka "disposition" d3f:Weakness rdfs:subClassOf . + d3f:Agent owl:equivalentClass cco:Agent . # Tentative, see note below. # Note: The cco:Agent definition states that a cco:Agent is "A @@ -59,6 +66,26 @@ d3f:Agent owl:equivalentClass cco:Agent . # Tentative, see note below. # associated with agent-based model of thinking.) +d3f:Organization rdfs:subClassOf cco:Organization. + +# d3fend only allows persons to be members of organizations, while CCO also allows +# other organizations to be part of an orgaization + +d3f:Person owl:equivalentClass cco:Person. + +# d3fend seems to only refer to human beings with "person", just as CCO does + +d3f:PhysicalObject rdfs:subClassOf . + +# BFO 0000030 is "object". The two classes might be equivalent, but there may also be +# other classes in d3fend which are not subclasses of PhysicalObject that fall under +# BFO:0000030 + +d3f:Technique rdfs:subClassOf cco:DirectiveInformationContentEntity + +# techniques seem to be akin to plans or other similar regulatory information artifacts. + + # # Property Mappings # From 53ba6b3b104b5a7b5f1e0e8e99206f79568b8a49 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Wed, 15 May 2024 13:19:40 -0400 Subject: [PATCH 02/21] Update d3fend-cco.ttl --- src/ontology/mappings/d3fend-cco.ttl | 1 + 1 file changed, 1 insertion(+) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index e8c6cf76..6e22661a 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -85,6 +85,7 @@ d3f:Technique rdfs:subClassOf cco:DirectiveInformationContentEntity # techniques seem to be akin to plans or other similar regulatory information artifacts. +d3f:InformationContentEntity owl:equivalentClass cco:InformationContentEntity # # Property Mappings From c952a85a1735af60d938c10d2529703f103a2ce1 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Wed, 15 May 2024 13:24:11 -0400 Subject: [PATCH 03/21] Update d3fend-cco.ttl --- src/ontology/mappings/d3fend-cco.ttl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index 6e22661a..74849fdc 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -85,7 +85,7 @@ d3f:Technique rdfs:subClassOf cco:DirectiveInformationContentEntity # techniques seem to be akin to plans or other similar regulatory information artifacts. -d3f:InformationContentEntity owl:equivalentClass cco:InformationContentEntity +d3f:InformationContentEntity owl:equivalentClass cco:InformationContentEntity. # # Property Mappings From e54e0b8971370e7a08de82beb73a2732a9ae50a4 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Wed, 15 May 2024 13:25:44 -0400 Subject: [PATCH 04/21] Update d3fend-cco.ttl --- src/ontology/mappings/d3fend-cco.ttl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index 74849fdc..0fa8b39a 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -81,7 +81,7 @@ d3f:PhysicalObject rdfs:subClassOf . # other classes in d3fend which are not subclasses of PhysicalObject that fall under # BFO:0000030 -d3f:Technique rdfs:subClassOf cco:DirectiveInformationContentEntity +d3f:Technique rdfs:subClassOf cco:DirectiveInformationContentEntity. # techniques seem to be akin to plans or other similar regulatory information artifacts. From deddced76a5ed17ea9c5815cd87164c1f054cc22 Mon Sep 17 00:00:00 2001 From: Finn1928 <123898795+Finn1928@users.noreply.github.com> Date: Wed, 15 May 2024 19:12:07 -0400 Subject: [PATCH 05/21] Update d3fend-cco.ttl added some more low hanging fruit --- src/ontology/mappings/d3fend-cco.ttl | 55 ++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index 0fa8b39a..2b8303c2 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -87,6 +87,61 @@ d3f:Technique rdfs:subClassOf cco:DirectiveInformationContentEntity. d3f:InformationContentEntity owl:equivalentClass cco:InformationContentEntity. +d3f:Log rdfs:subClassOf cco:RepresentationalInformationContentEntity . + +# An example cco gives of a representational ICE is a transcript, which seems similar to a log. + +d3f:Sensor owl:equivalentClass cco:Sensor . + +d3f:Artifact rdfs:subClassOf . + +#obo:BFO_0000002 aka "continuant". +#like Digital Artifact, it can't be a subclass of Material Artifact or Object for the same reason. +#Though the definition they give of Artifact is cco Material Artifact, which can't be right for this reason. + +d3f:Capability owl:equivalentClass cco:AgentCapability . + +#they say it's defined by dbpedia and linked a definition for capability in 'systems engineering', +#but I didn't find anything in the definition that made it seem like the definition wasn't applicable +#to capability in general. + +d3f:DigitalObject rdfs:subClassOf . + +#obo:BFO_0000002 aka "continuant". +#If this is the place Digital Artifact needs to go, it's also where Digital Object should go, since Digital Artifact is a subclass of Digital Object. + +d3f:Monitoring owl:equivalentClass cco:ActOfObservation . + +#They define monitoring as an act of observing something. They also add that it might involve keeping a record of something. + +d3f:Procedure rdfs:subClassOf cco:DirectiveInformationContentEntity . + +#This seems like a Plan. They don't give a definition of Procedure, and the only subclass is Use Case Procedure. + +d3f:Vulnerability rdfs:subClassOf . + +#obo:BFO_0000016 aka "disposition". +#Like 'Weakness', Vulnerability seems like a disposition. + +d3f:AnalysisOfAlternatives rdfs:subClassOf cco:Act . + +#This might further be a planned act. They don't define this term, so it's difficult to tell. + +d3f:Assessment rdfs:subClassOf cco:ActOfAppraisal . + +#They define it as classifying something according to its worth. + +d3f:Command rdfs:subClassOf cco:DirectiveInformationContentEntity . + +#Command is defined as being a directive to a computer program. + +d3f:Identifier rdfs:subClassOf cco:DesignativeInformationContentEntity . + +#The definition of Identifier says it's a name, but Designative ICEs include non-name identifiers. +#I therefore made identifier a subclass rather than equivalent to Designative ICE. + +d3f:JobSchedule rdfs:subClassOf cco:Plan . + # # Property Mappings # From 6a94342287d1eb952193ac2df501276ec392aeb9 Mon Sep 17 00:00:00 2001 From: Finn1928 <123898795+Finn1928@users.noreply.github.com> Date: Thu, 16 May 2024 11:43:43 -0400 Subject: [PATCH 06/21] Update d3fend-cco.ttl addressing comments from Giacomo --- src/ontology/mappings/d3fend-cco.ttl | 21 ++++++--------------- 1 file changed, 6 insertions(+), 15 deletions(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index 2b8303c2..50f9150a 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -87,12 +87,15 @@ d3f:Technique rdfs:subClassOf cco:DirectiveInformationContentEntity. d3f:InformationContentEntity owl:equivalentClass cco:InformationContentEntity. -d3f:Log rdfs:subClassOf cco:RepresentationalInformationContentEntity . +d3f:Log rdfs:subClassOf cco:InformationContentEntity . # An example cco gives of a representational ICE is a transcript, which seems similar to a log. d3f:Sensor owl:equivalentClass cco:Sensor . +# A subclass of sensor they include is cyber sensor, which might be referring to programs which are ICEs. +# If this is the case, then the two wouldn't be equivalent. + d3f:Artifact rdfs:subClassOf . #obo:BFO_0000002 aka "continuant". @@ -110,18 +113,10 @@ d3f:DigitalObject rdfs:subClassOf . #obo:BFO_0000002 aka "continuant". #If this is the place Digital Artifact needs to go, it's also where Digital Object should go, since Digital Artifact is a subclass of Digital Object. -d3f:Monitoring owl:equivalentClass cco:ActOfObservation . +d3f:Monitoring rdfs:subClassOf cco:ActOfObservation . #They define monitoring as an act of observing something. They also add that it might involve keeping a record of something. - -d3f:Procedure rdfs:subClassOf cco:DirectiveInformationContentEntity . - -#This seems like a Plan. They don't give a definition of Procedure, and the only subclass is Use Case Procedure. - -d3f:Vulnerability rdfs:subClassOf . - -#obo:BFO_0000016 aka "disposition". -#Like 'Weakness', Vulnerability seems like a disposition. +#In case they mean something more specific, just say it's a subclass. d3f:AnalysisOfAlternatives rdfs:subClassOf cco:Act . @@ -131,10 +126,6 @@ d3f:Assessment rdfs:subClassOf cco:ActOfAppraisal . #They define it as classifying something according to its worth. -d3f:Command rdfs:subClassOf cco:DirectiveInformationContentEntity . - -#Command is defined as being a directive to a computer program. - d3f:Identifier rdfs:subClassOf cco:DesignativeInformationContentEntity . #The definition of Identifier says it's a name, but Designative ICEs include non-name identifiers. From 5c55b96f49dddae3226d7fad64beae1b9c5c08d2 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Thu, 16 May 2024 16:17:13 -0400 Subject: [PATCH 07/21] Update d3fend-cco.ttl --- src/ontology/mappings/d3fend-cco.ttl | 31 +++++++++++++++------------- 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index 50f9150a..aeaed4e5 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -38,8 +38,8 @@ d3f:DigitalArtifact rdfs:subClassOf d3f:Action rdfs:subClassOf cco:Act . d3f:DigitalEvent rdfs:subClassOf . -# All digital events in d3fend look like punctual events to me, and thus like process boundaries. In -# case that some of them are not, we could map specific subclasses to process or process boundary +# Most if not all events in d3fend look like punctual events to me, and thus like process boundaries. In +# case that some of them are not, we could map specific subclasses to process or process boundary. d3f:Activity rdfs:subClassOf . @@ -69,11 +69,11 @@ d3f:Agent owl:equivalentClass cco:Agent . # Tentative, see note below. d3f:Organization rdfs:subClassOf cco:Organization. # d3fend only allows persons to be members of organizations, while CCO also allows -# other organizations to be part of an orgaization +# other organizations to be part of an orgaization. Thus the CCO class is slightly broader. d3f:Person owl:equivalentClass cco:Person. -# d3fend seems to only refer to human beings with "person", just as CCO does +# d3fend seems to only refer to human beings with "person", just as CCO does. d3f:PhysicalObject rdfs:subClassOf . @@ -86,15 +86,19 @@ d3f:Technique rdfs:subClassOf cco:DirectiveInformationContentEntity. # techniques seem to be akin to plans or other similar regulatory information artifacts. d3f:InformationContentEntity owl:equivalentClass cco:InformationContentEntity. +# this class seems to be intended to be equivalent to the CCO class. Notice that many other d3f classes +# will become subclasses of cco:InformatioContentEntity, and thus of the d3f:InformationContentEntity class +# as well. I am not sure whether this is a positive outcome. d3f:Log rdfs:subClassOf cco:InformationContentEntity . -# An example cco gives of a representational ICE is a transcript, which seems similar to a log. +# An example cco gives of a representational ICE is a transcript, which seems similar to a log. But it might also +# be considered a descriptive ICE, so for the moment we mapped this into ICE. d3f:Sensor owl:equivalentClass cco:Sensor . # A subclass of sensor they include is cyber sensor, which might be referring to programs which are ICEs. -# If this is the case, then the two wouldn't be equivalent. +# If this is the case, this class is not equivalent to cco:Sensor, which is only about physical entities. d3f:Artifact rdfs:subClassOf . @@ -104,27 +108,26 @@ d3f:Artifact rdfs:subClassOf . d3f:Capability owl:equivalentClass cco:AgentCapability . -#they say it's defined by dbpedia and linked a definition for capability in 'systems engineering', -#but I didn't find anything in the definition that made it seem like the definition wasn't applicable -#to capability in general. +# the question is whether d3f:Capability can be borne by agents, or whether there are broader entities +# which can have capabilities. If this is the case, we should use a broader capability class from some neighboring +# BFO ontology. d3f:DigitalObject rdfs:subClassOf . #obo:BFO_0000002 aka "continuant". -#If this is the place Digital Artifact needs to go, it's also where Digital Object should go, since Digital Artifact is a subclass of Digital Object. d3f:Monitoring rdfs:subClassOf cco:ActOfObservation . -#They define monitoring as an act of observing something. They also add that it might involve keeping a record of something. -#In case they mean something more specific, just say it's a subclass. +# cco:ActOfObservation mentions "senses" which might or might not be the case for +# d3f:monitoring, which on the other hand might involve information processing monitoring procedures which are not tied to senses. d3f:AnalysisOfAlternatives rdfs:subClassOf cco:Act . -#This might further be a planned act. They don't define this term, so it's difficult to tell. +#This also seems to be an act, or a planned act. d3f:Assessment rdfs:subClassOf cco:ActOfAppraisal . -#They define it as classifying something according to its worth. +#Appraisal seems to be akin to classifying ad understood in d3f. d3f:Identifier rdfs:subClassOf cco:DesignativeInformationContentEntity . From 41542366084b1f181843910e71ec2bba469b9f36 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Mon, 16 Sep 2024 21:29:48 -0400 Subject: [PATCH 08/21] Update d3fend-cco.ttl --- src/ontology/mappings/d3fend-cco.ttl | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index aeaed4e5..9dbc7abf 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -36,6 +36,8 @@ d3f:DigitalArtifact rdfs:subClassOf # continuant" in BFO. d3f:Action rdfs:subClassOf cco:Act . +#in order to decide about this mapping, we have to decide whether d3f:DefensiveTechnique and +# d3f:OffensiveTechnique are acts or more similar to plans. d3f:DigitalEvent rdfs:subClassOf . # Most if not all events in d3fend look like punctual events to me, and thus like process boundaries. In @@ -83,17 +85,30 @@ d3f:PhysicalObject rdfs:subClassOf . d3f:Technique rdfs:subClassOf cco:DirectiveInformationContentEntity. -# techniques seem to be akin to plans or other similar regulatory information artifacts. +# techniques seem to be akin to plans or other similar regulatory information artifacts. Nevertheless, +# techniques are currently under "action", which looks like it refers to processes. This boils down to +# whether d3f:technique is meant to refer to the techniques before they are executed or only after they +# are executed. In the first case, they are similar to plans, in the other, they may refer to processes. +# Another way to look at this is to see whether d3f:technique are time indexed or not (e.g. my message +# analysis technique started today at 8 pm) + +d3f:DefensiveTechnique rdfs:subClassOf cco:DirectiveInformationContentEntity. + +#see d3f:Technique + +d3f:OffensiveTechnique rdfs:subClassOf cco:DirectiveInformationContentEntity. + +#see d3f:Technique d3f:InformationContentEntity owl:equivalentClass cco:InformationContentEntity. -# this class seems to be intended to be equivalent to the CCO class. Notice that many other d3f classes +# this seems to be intended to be equivalent to the CCO class. Notice that many other d3f classes # will become subclasses of cco:InformatioContentEntity, and thus of the d3f:InformationContentEntity class -# as well. I am not sure whether this is a positive outcome. +# as well. For example, if d3f:Log rdfs:subClassOf cco:InformationContentEntity . # An example cco gives of a representational ICE is a transcript, which seems similar to a log. But it might also -# be considered a descriptive ICE, so for the moment we mapped this into ICE. +# be considered a descriptive ICE, so for this can be a subclass of ICE. d3f:Sensor owl:equivalentClass cco:Sensor . @@ -108,13 +123,13 @@ d3f:Artifact rdfs:subClassOf . d3f:Capability owl:equivalentClass cco:AgentCapability . -# the question is whether d3f:Capability can be borne by agents, or whether there are broader entities +# the question is whether d3f:Capability can be borne by agents only, or whether there are broader entities # which can have capabilities. If this is the case, we should use a broader capability class from some neighboring # BFO ontology. d3f:DigitalObject rdfs:subClassOf . -#obo:BFO_0000002 aka "continuant". +#obo:BFO_0000002 aka "continuant". What is the difference between d3f:DigitablObject and d3f:Information Content Entity? d3f:Monitoring rdfs:subClassOf cco:ActOfObservation . From 971e64d531ad6e4280136dac640f84a63c4b6287 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Mon, 16 Sep 2024 21:37:03 -0400 Subject: [PATCH 09/21] Update d3fend-cco.ttl --- src/ontology/mappings/d3fend-cco.ttl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index 9dbc7abf..b8772938 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -40,7 +40,7 @@ d3f:Action rdfs:subClassOf cco:Act . # d3f:OffensiveTechnique are acts or more similar to plans. d3f:DigitalEvent rdfs:subClassOf . -# Most if not all events in d3fend look like punctual events to me, and thus like process boundaries. In +# Most if not all events in d3fend look like punctual events to me, and thus like BFO_0000035, aka process boundaries. In # case that some of them are not, we could map specific subclasses to process or process boundary. d3f:Activity rdfs:subClassOf . From 00eaf0d4192028616ac22fdcedd8da04f21e6f25 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Tue, 12 Nov 2024 18:40:46 -0500 Subject: [PATCH 10/21] Solving issues and updating to CCO 2.0 Solved some of the issues discussed in comments, and updated identifiers to the new opaque identifiers adopted by CCO 2.0 From 2296aa4b6fa2558b5103da4552777898b4aeaf76 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Tue, 12 Nov 2024 18:42:45 -0500 Subject: [PATCH 11/21] Solving issues and updating to CCO 2.0 Solving issues discussed in the last call and updating to opaque identifier in CCO 2.0 --- src/ontology/mappings/d3fend-cco.ttl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index cc5ef3ec..35e9bbd1 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -13,7 +13,7 @@ rdf:type owl:Ontology ; owl:imports <../d3fend-protege.ttl#> ; - owl:imports . + owl:imports . # From d0a2f749816b2ea8de9f11cb1c20f526196cfa2e Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Tue, 12 Nov 2024 18:46:14 -0500 Subject: [PATCH 12/21] Solving issues and updating to CCO 2.0 Solving issues discussed in the last call and updating to the opaque identifiers from CCO 2.0. --- src/ontology/mappings/d3fend-cco.ttl | 100 ++++++++++----------------- 1 file changed, 36 insertions(+), 64 deletions(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index 35e9bbd1..a40445ad 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -19,9 +19,11 @@ # # Class Mappings # -d3f:DigitalInformation rdfs:subClassOf cco:InformationContentEntity . +d3f:DigitalInformation rdfs:subClassOf . +#cco ont0000029 is Information Content Entity -d3f:DigitalInformationBearer rdfs:subClassOf cco:InformationBearingArtifact . +d3f:DigitalInformationBearer rdfs:subClassOf . +#cco ont00000798 is Information Bearing Artifact # Note: The obo: prefix doesn't resolve in the ROBOT merge, so full IRI specified. # d3f:DigitalArtifact rdfs:subClassOf obo:BFO_0000002 . # obo:BFO_0000002 aka "continuant" @@ -35,22 +37,21 @@ d3f:DigitalArtifact rdfs:subClassOf # subclass of "information bearing artifact" which is "independent # continuant" in BFO. -d3f:Action rdfs:subClassOf cco:Act . -#in order to decide about this mapping, we have to decide whether d3f:DefensiveTechnique and -# d3f:OffensiveTechnique are acts or more similar to plans. +d3f:Action owl:equivalentClass . +# Equivalent to cco ont00000005 aka Act -d3f:DigitalEvent rdfs:subClassOf . -# Most if not all events in d3fend look like punctual events to me, and thus like BFO_0000035, aka process boundaries. In -# case that some of them are not, we could map specific subclasses to process or process boundary. - -d3f:Activity rdfs:subClassOf . +d3f:Event owl:equivalentClass . +# Equivalent to BFO_0000015 aka process. # Note: The obo: prefix doesn't resolve in the ROBOT merge, so full IRI specified... -# d3f:Weakness rdfs:subClassOf obo:BFO_0000016 . # obo:BFO_0000016 aka "disposition" + d3f:Weakness rdfs:subClassOf . +#aka "disposition" -d3f:Agent owl:equivalentClass cco:Agent . # Tentative, see note below. +d3f:Agent owl:equivalentClass . # Tentative, see note below. +#cco ont00001017 is Agent + # Note: The cco:Agent definition states that a cco:Agent is "A # Material Entity that is capable of performing Planned Acts.". That @@ -68,88 +69,59 @@ d3f:Agent owl:equivalentClass cco:Agent . # Tentative, see note below. # associated with agent-based model of thinking.) -d3f:Organization rdfs:subClassOf cco:Organization. +d3f:Organization rdfs:subClassOf . +#cco ont00001180 is cco Organization # d3fend only allows persons to be members of organizations, while CCO also allows # other organizations to be part of an orgaization. Thus the CCO class is slightly broader. -d3f:Person owl:equivalentClass cco:Person. - +d3f:Person owl:equivalentClass . +#cco ont00001262 is cco Person # d3fend seems to only refer to human beings with "person", just as CCO does. -d3f:PhysicalObject rdfs:subClassOf . - -# BFO 0000030 is "object". The two classes might be equivalent, but there may also be -# other classes in d3fend which are not subclasses of PhysicalObject that fall under -# BFO:0000030 - -d3f:Technique rdfs:subClassOf cco:DirectiveInformationContentEntity. - -# techniques seem to be akin to plans or other similar regulatory information artifacts. Nevertheless, -# techniques are currently under "action", which looks like it refers to processes. This boils down to -# whether d3f:technique is meant to refer to the techniques before they are executed or only after they -# are executed. In the first case, they are similar to plans, in the other, they may refer to processes. -# Another way to look at this is to see whether d3f:technique are time indexed or not (e.g. my message -# analysis technique started today at 8 pm) - -d3f:DefensiveTechnique rdfs:subClassOf cco:DirectiveInformationContentEntity. -#see d3f:Technique +d3f:Technique rdfs:subClassOf . +#cco org/ont00000974 is cco Plan. -d3f:OffensiveTechnique rdfs:subClassOf cco:DirectiveInformationContentEntity. -#see d3f:Technique - -d3f:InformationContentEntity owl:equivalentClass cco:InformationContentEntity. +d3f:InformationContentEntity owl:equivalentClass . +#cco org/ont00000958 is cco information content entity # this seems to be intended to be equivalent to the CCO class. Notice that many other d3f classes # will become subclasses of cco:InformatioContentEntity, and thus of the d3f:InformationContentEntity class -# as well. For example, if - -d3f:Log rdfs:subClassOf cco:InformationContentEntity . - -# An example cco gives of a representational ICE is a transcript, which seems similar to a log. But it might also -# be considered a descriptive ICE, so for this can be a subclass of ICE. - -d3f:Sensor owl:equivalentClass cco:Sensor . +# as well. -# A subclass of sensor they include is cyber sensor, which might be referring to programs which are ICEs. -# If this is the case, this class is not equivalent to cco:Sensor, which is only about physical entities. +d3f:Log rdfs:subClassOf . -d3f:Artifact rdfs:subClassOf . +# Still keeping this under ont00000958 aka InformationContentEntity until further discussion. -#obo:BFO_0000002 aka "continuant". -#like Digital Artifact, it can't be a subclass of Material Artifact or Object for the same reason. -#Though the definition they give of Artifact is cco Material Artifact, which can't be right for this reason. +#d3f:Sensor owl:equivalentClass cco:Sensor . +#waiting to discuss this given discussion on transducers -d3f:Capability owl:equivalentClass cco:AgentCapability . +d3f:Capability owl:equivalentClass . +# ont00001379 is cco AgentCapability . # the question is whether d3f:Capability can be borne by agents only, or whether there are broader entities # which can have capabilities. If this is the case, we should use a broader capability class from some neighboring # BFO ontology. -d3f:DigitalObject rdfs:subClassOf . - -#obo:BFO_0000002 aka "continuant". What is the difference between d3f:DigitablObject and d3f:Information Content Entity? - -d3f:Monitoring rdfs:subClassOf cco:ActOfObservation . - -# cco:ActOfObservation mentions "senses" which might or might not be the case for -# d3f:monitoring, which on the other hand might involve information processing monitoring procedures which are not tied to senses. - -d3f:AnalysisOfAlternatives rdfs:subClassOf cco:Act . +d3f:AnalysisOfAlternatives rdfs:subClassOf . +# 00000228 is cco Act . #This also seems to be an act, or a planned act. -d3f:Assessment rdfs:subClassOf cco:ActOfAppraisal . +d3f:Assessment rdfs:subClassOf . +# ont00000636 is cco ActOfAppraisal . #Appraisal seems to be akin to classifying ad understood in d3f. -d3f:Identifier rdfs:subClassOf cco:DesignativeInformationContentEntity . +d3f:Identifier rdfs:subClassOf . +#cco ont00000686 is cco DesignativeInformationContentEntity . #The definition of Identifier says it's a name, but Designative ICEs include non-name identifiers. #I therefore made identifier a subclass rather than equivalent to Designative ICE. -d3f:JobSchedule rdfs:subClassOf cco:Plan . +d3f:JobSchedule rdfs:subClassOf . +#cco ont00000974 is ccoPlan . # # Property Mappings From bab4fd828b3b2435a8d21bba34faae8660f93ea1 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Sun, 1 Dec 2024 19:23:56 -0500 Subject: [PATCH 13/21] Updating according to last comments on PR Deleting technique mapping, adding CCO 2.0 From 2a0f479c6883098db87a4d4e3d24b1fbfe1c51b4 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Sun, 1 Dec 2024 19:25:25 -0500 Subject: [PATCH 14/21] Making changes as per last comments --- src/ontology/mappings/d3fend-cco.ttl | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index a40445ad..1f6ca2ed 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -13,7 +13,7 @@ rdf:type owl:Ontology ; owl:imports <../d3fend-protege.ttl#> ; - owl:imports . + owl:imports . # @@ -79,15 +79,13 @@ d3f:Person owl:equivalentClass . +d3f:Plan owl:equivalentClass . #cco org/ont00000974 is cco Plan. - d3f:InformationContentEntity owl:equivalentClass . #cco org/ont00000958 is cco information content entity # this seems to be intended to be equivalent to the CCO class. Notice that many other d3f classes -# will become subclasses of cco:InformatioContentEntity, and thus of the d3f:InformationContentEntity class +# will become subclasses of cco:InformationContentEntity, and thus of the d3f:InformationContentEntity class # as well. d3f:Log rdfs:subClassOf . From fd32f4d579ea98721740850d5fd9319f4f471bf5 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Thu, 12 Dec 2024 10:48:48 -0500 Subject: [PATCH 15/21] Adding mappings --- src/ontology/mappings/d3fend-cco.ttl | 41 ++++++++++++++++++++++++---- 1 file changed, 36 insertions(+), 5 deletions(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index 1f6ca2ed..3a3effed 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -19,16 +19,23 @@ # # Class Mappings # +# Note: The obo: prefix doesn't resolve in the ROBOT merge, so full IRI specified... + d3f:DigitalInformation rdfs:subClassOf . #cco ont0000029 is Information Content Entity d3f:DigitalInformationBearer rdfs:subClassOf . #cco ont00000798 is Information Bearing Artifact +# most if not all subclasses of d3f:DigitalInformationBearer look like information content entities to me. Some of them look like digital events (d3f:SystemCall, d3f:UserAction, d3f:Process) # Note: The obo: prefix doesn't resolve in the ROBOT merge, so full IRI specified. -# d3f:DigitalArtifact rdfs:subClassOf obo:BFO_0000002 . # obo:BFO_0000002 aka "continuant" -d3f:DigitalArtifact rdfs:subClassOf . +d3f:Artifact rdfs:subClassOf . +#Where BFO_0000002 is a continuant + +d3f:PhysicalArtifact owl:equivalentClass . +#cco ont00000995 is material artifact +d3f:DigitalArtifact rdfs:subClassOf . # Note: d3f:DigitalArtifact cannot be a subclass of bfo:BFO_0000040 # aka "material entity" nor bfo:BFO_00000030 "object" as it is # parent to both d3f:DigitalIinformation a subclass of "information @@ -43,11 +50,21 @@ d3f:Action owl:equivalentClass . # Equivalent to BFO_0000015 aka process. -# Note: The obo: prefix doesn't resolve in the ROBOT merge, so full IRI specified... +d3f:DigitalEvent owl:equivalentClass [ owl:intersectionOf ( + [ rdf:type owl:Restriction ; + owl:onProperty ; + owl:someValuesFrom + ] + ) ; + rdf:type owl:Class + ] ; -d3f:Weakness rdfs:subClassOf . -#aka "disposition" +# A digital event is an event (BFO 0000015) which has participant (BFO 00000576) +# some Information Content Entity (cco ont00000029) +d3f:Weakness rdfs:subClassOf . +# aka "disposition" +# what is the difference between d3f:Weakness and d3f:Vulnerability? d3f:Agent owl:equivalentClass . # Tentative, see note below. #cco ont00001017 is Agent @@ -72,6 +89,9 @@ d3f:Agent owl:equivalentClass d3f:Organization rdfs:subClassOf . #cco ont00001180 is cco Organization +d3f:AgentGroup owl:equivalentClass . +#cco ont00000300 is cco Group of Agents + # d3fend only allows persons to be members of organizations, while CCO also allows # other organizations to be part of an orgaization. Thus the CCO class is slightly broader. @@ -82,6 +102,14 @@ d3f:Person owl:equivalentClass . #cco org/ont00000974 is cco Plan. +d3f:Goal owl:equivalentClass . +#cco ont00000476 is cco Objective + +#This might be made more precise depending on the children classes. See some examples in the comments below. + +# d3f:Execution rdfs:subClassOf . +# where BFo 0000015 is process. Although, wouldn't this just make d3f:Execution better suited as a digital event? + d3f:InformationContentEntity owl:equivalentClass . #cco org/ont00000958 is cco information content entity # this seems to be intended to be equivalent to the CCO class. Notice that many other d3f classes @@ -102,6 +130,9 @@ d3f:Capability owl:equivalentClass . +# BFO 0000029 is site + d3f:AnalysisOfAlternatives rdfs:subClassOf . # 00000228 is cco Act . From 646fe6132244f39d098c07d146016d193c4e73c7 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Wed, 18 Dec 2024 04:32:07 -0500 Subject: [PATCH 16/21] Adding 1.0 mappings From c4f87d22653506f65acf17090c169563ae2feae4 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Wed, 18 Dec 2024 09:46:54 -0500 Subject: [PATCH 17/21] Version 1.0 mappings --- src/ontology/mappings/d3fend-cco.ttl | 60 +++++++++++++++++----------- 1 file changed, 36 insertions(+), 24 deletions(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index 3a3effed..a0c4b671 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -22,18 +22,20 @@ # Note: The obo: prefix doesn't resolve in the ROBOT merge, so full IRI specified... d3f:DigitalInformation rdfs:subClassOf . -#cco ont0000029 is Information Content Entity +# cco ont0000029 is Information Content Entity d3f:DigitalInformationBearer rdfs:subClassOf . -#cco ont00000798 is Information Bearing Artifact -# most if not all subclasses of d3f:DigitalInformationBearer look like information content entities to me. Some of them look like digital events (d3f:SystemCall, d3f:UserAction, d3f:Process) +# cco ont00000798 is Information Bearing Artifact +# most if not all subclasses of d3f:DigitalInformationBearer look like information content entities to me. +# to discuss moving this to subclass of ICE. +# Some of them look like digital events (d3f:SystemCall, d3f:UserAction, d3f:Process) # Note: The obo: prefix doesn't resolve in the ROBOT merge, so full IRI specified. d3f:Artifact rdfs:subClassOf . -#Where BFO_0000002 is a continuant +# Where BFO_0000002 is a continuant d3f:PhysicalArtifact owl:equivalentClass . -#cco ont00000995 is material artifact +# cco ont00000995 is material artifact d3f:DigitalArtifact rdfs:subClassOf . # Note: d3f:DigitalArtifact cannot be a subclass of bfo:BFO_0000040 @@ -44,13 +46,25 @@ d3f:DigitalArtifact rdfs:subClassOf # subclass of "information bearing artifact" which is "independent # continuant" in BFO. +d3f:System owl:equivalentClass [ owl:intersectionOf ( + [ rdf:type owl:Restriction ; + owl:onProperty ; + owl:someValuesFrom + ] + ) ; + rdf:type owl:Class + ] ; + +# BFO 00000027 is object aggregate. BFO 0000178 is "has continuant part" +# CCO ont00000995 is "material artifact". A d3f:System is an object aggregate of material artifacts. + d3f:Action owl:equivalentClass . # Equivalent to cco ont00000005 aka Act d3f:Event owl:equivalentClass . # Equivalent to BFO_0000015 aka process. -d3f:DigitalEvent owl:equivalentClass [ owl:intersectionOf ( +d3f:DigitalEvent rdfs:subClassOf [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:someValuesFrom @@ -59,8 +73,8 @@ d3f:DigitalEvent owl:equivalentClass [ owl:intersectionOf ( . # aka "disposition" @@ -85,36 +99,34 @@ d3f:Agent owl:equivalentClass # definitely not in Belief-Desire-Intention (BDI) sense highly # associated with agent-based model of thinking.) - d3f:Organization rdfs:subClassOf . -#cco ont00001180 is cco Organization +# cco ont00001180 is cco Organization +# d3fend only allows persons to be members of organizations, while CCO also allows +# other organizations to be part of an organization. Thus the CCO class is slightly broader. d3f:AgentGroup owl:equivalentClass . -#cco ont00000300 is cco Group of Agents - -# d3fend only allows persons to be members of organizations, while CCO also allows -# other organizations to be part of an orgaization. Thus the CCO class is slightly broader. +# cco ont00000300 is cco Group of Agents d3f:Person owl:equivalentClass . #cco ont00001262 is cco Person # d3fend seems to only refer to human beings with "person", just as CCO does. d3f:Plan owl:equivalentClass . -#cco org/ont00000974 is cco Plan. +# cco org/ont00000974 is cco Plan. d3f:Goal owl:equivalentClass . -#cco ont00000476 is cco Objective +# cco ont00000476 is cco Objective -#This might be made more precise depending on the children classes. See some examples in the comments below. +# This might be made more precise depending on the children classes. See some examples in the comments below. # d3f:Execution rdfs:subClassOf . -# where BFo 0000015 is process. Although, wouldn't this just make d3f:Execution better suited as a digital event? +# where BFO 0000015 is process. Although, wouldn't this just make d3f:Execution better suited as a digital event? d3f:InformationContentEntity owl:equivalentClass . -#cco org/ont00000958 is cco information content entity +# cco org/ont00000958 is cco information content entity # this seems to be intended to be equivalent to the CCO class. Notice that many other d3f classes # will become subclasses of cco:InformationContentEntity, and thus of the d3f:InformationContentEntity class -# as well. +# as well if we keep the equivalence relation. d3f:Log rdfs:subClassOf . @@ -141,16 +153,16 @@ d3f:AnalysisOfAlternatives rdfs:subClassOf . # ont00000636 is cco ActOfAppraisal . -#Appraisal seems to be akin to classifying ad understood in d3f. +# Appraisal seems to be akin to classifying ad understood in d3f. d3f:Identifier rdfs:subClassOf . -#cco ont00000686 is cco DesignativeInformationContentEntity . +# cco ont00000686 is cco DesignativeInformationContentEntity . #The definition of Identifier says it's a name, but Designative ICEs include non-name identifiers. -#I therefore made identifier a subclass rather than equivalent to Designative ICE. +# I therefore made identifier a subclass rather than equivalent to Designative ICE. d3f:JobSchedule rdfs:subClassOf . -#cco ont00000974 is ccoPlan . +# cco ont00000974 is ccoPlan . # # Property Mappings From 79ecdea248dea661246f144dc24762bc97e02009 Mon Sep 17 00:00:00 2001 From: Peter Kaloroumakis Date: Wed, 18 Dec 2024 09:10:08 -0700 Subject: [PATCH 18/21] fix missing periods --- src/ontology/mappings/d3fend-cco.ttl | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index a0c4b671..fbf87ebf 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -27,7 +27,7 @@ d3f:DigitalInformation rdfs:subClassOf . # cco ont00000798 is Information Bearing Artifact # most if not all subclasses of d3f:DigitalInformationBearer look like information content entities to me. -# to discuss moving this to subclass of ICE. +# to discuss moving this to subclass of ICE. # Some of them look like digital events (d3f:SystemCall, d3f:UserAction, d3f:Process) # Note: The obo: prefix doesn't resolve in the ROBOT merge, so full IRI specified. @@ -53,7 +53,7 @@ d3f:System owl:equivalentClass [ owl:intersectionOf ( . @@ -101,7 +101,7 @@ d3f:Agent owl:equivalentClass d3f:Organization rdfs:subClassOf . # cco ont00001180 is cco Organization -# d3fend only allows persons to be members of organizations, while CCO also allows +# d3fend only allows persons to be members of organizations, while CCO also allows # other organizations to be part of an organization. Thus the CCO class is slightly broader. d3f:AgentGroup owl:equivalentClass . @@ -148,7 +148,7 @@ d3f:PhysicalLocation rdfs:subClassOf . # 00000228 is cco Act . -#This also seems to be an act, or a planned act. +#This also seems to be an act, or a planned act. d3f:Assessment rdfs:subClassOf . # ont00000636 is cco ActOfAppraisal . From f67334d989e97230b33b74fee58ba7c43f0534ff Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Wed, 18 Dec 2024 14:53:24 -0500 Subject: [PATCH 19/21] Fixing after discussion for 1.0 --- src/ontology/mappings/d3fend-cco.ttl | 69 ++++++++-------------------- 1 file changed, 18 insertions(+), 51 deletions(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index fbf87ebf..dd78b669 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -21,14 +21,11 @@ # # Note: The obo: prefix doesn't resolve in the ROBOT merge, so full IRI specified... -d3f:DigitalInformation rdfs:subClassOf . +d3f:DigitalInformation rdfs:subClassOf . # cco ont0000029 is Information Content Entity d3f:DigitalInformationBearer rdfs:subClassOf . # cco ont00000798 is Information Bearing Artifact -# most if not all subclasses of d3f:DigitalInformationBearer look like information content entities to me. -# to discuss moving this to subclass of ICE. -# Some of them look like digital events (d3f:SystemCall, d3f:UserAction, d3f:Process) # Note: The obo: prefix doesn't resolve in the ROBOT merge, so full IRI specified. d3f:Artifact rdfs:subClassOf . @@ -46,7 +43,7 @@ d3f:DigitalArtifact rdfs:subClassOf # subclass of "information bearing artifact" which is "independent # continuant" in BFO. -d3f:System owl:equivalentClass [ owl:intersectionOf ( +d3f:System rdfs:subClassOf [ owl:intersectionOf ( [ rdf:type owl:Restriction ; owl:onProperty ; owl:someValuesFrom @@ -64,17 +61,22 @@ d3f:Action owl:equivalentClass . # Equivalent to BFO_0000015 aka process. -d3f:DigitalEvent rdfs:subClassOf [ owl:intersectionOf ( - [ rdf:type owl:Restriction ; - owl:onProperty ; - owl:someValuesFrom - ] - ) ; - rdf:type owl:Class - ] . +d3f:DigitalEvent rdfs:subClassOf [ owl:intersectionOf ( + [ rdf:type owl:Restriction ; + owl:onProperty ; + owl:allValuesFrom [ rdf:type owl:Class ; + owl:unionOf ( + + ) + ] + ] + ) ; + rdf:type owl:Class + ] + +# A digital event is an event/process (BFO 0000015) which has participant (BFO 0000057) +# some Information Content Entity (cco ont000000958 or Information Bearing Artifact (cco 00000798). More precise axioms can be added in the future. -# A digital event is an event/process (BFO 0000015) which has participant (BFO 00000576) -# some Information Content Entity (cco ont00000029). More precise axioms can be added in the future. d3f:Weakness rdfs:subClassOf . # aka "disposition" @@ -101,7 +103,7 @@ d3f:Agent owl:equivalentClass d3f:Organization rdfs:subClassOf . # cco ont00001180 is cco Organization -# d3fend only allows persons to be members of organizations, while CCO also allows +# d3fend only allows persons to be members of organizations, while CCO also allows # other organizations to be part of an organization. Thus the CCO class is slightly broader. d3f:AgentGroup owl:equivalentClass . @@ -117,53 +119,18 @@ d3f:Plan owl:equivalentClass d3f:Goal owl:equivalentClass . # cco ont00000476 is cco Objective -# This might be made more precise depending on the children classes. See some examples in the comments below. - -# d3f:Execution rdfs:subClassOf . -# where BFO 0000015 is process. Although, wouldn't this just make d3f:Execution better suited as a digital event? - -d3f:InformationContentEntity owl:equivalentClass . -# cco org/ont00000958 is cco information content entity -# this seems to be intended to be equivalent to the CCO class. Notice that many other d3f classes -# will become subclasses of cco:InformationContentEntity, and thus of the d3f:InformationContentEntity class -# as well if we keep the equivalence relation. - -d3f:Log rdfs:subClassOf . - -# Still keeping this under ont00000958 aka InformationContentEntity until further discussion. - #d3f:Sensor owl:equivalentClass cco:Sensor . #waiting to discuss this given discussion on transducers -d3f:Capability owl:equivalentClass . -# ont00001379 is cco AgentCapability . - -# the question is whether d3f:Capability can be borne by agents only, or whether there are broader entities -# which can have capabilities. If this is the case, we should use a broader capability class from some neighboring -# BFO ontology. - d3f:PhysicalLocation rdfs:subClassOf . # BFO 0000029 is site -d3f:AnalysisOfAlternatives rdfs:subClassOf . -# 00000228 is cco Act . - -#This also seems to be an act, or a planned act. - -d3f:Assessment rdfs:subClassOf . -# ont00000636 is cco ActOfAppraisal . - # Appraisal seems to be akin to classifying ad understood in d3f. d3f:Identifier rdfs:subClassOf . # cco ont00000686 is cco DesignativeInformationContentEntity . - #The definition of Identifier says it's a name, but Designative ICEs include non-name identifiers. # I therefore made identifier a subclass rather than equivalent to Designative ICE. - -d3f:JobSchedule rdfs:subClassOf . -# cco ont00000974 is ccoPlan . - # # Property Mappings # From c66adba8c9549a46c1e1427c4a0122d1de16e2a9 Mon Sep 17 00:00:00 2001 From: Giacomo De Colle <117365623+giacomodecolle@users.noreply.github.com> Date: Wed, 18 Dec 2024 15:20:10 -0500 Subject: [PATCH 20/21] Fixing a typo --- src/ontology/mappings/d3fend-cco.ttl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ontology/mappings/d3fend-cco.ttl b/src/ontology/mappings/d3fend-cco.ttl index dd78b669..9a0400ed 100644 --- a/src/ontology/mappings/d3fend-cco.ttl +++ b/src/ontology/mappings/d3fend-cco.ttl @@ -72,7 +72,7 @@ d3f:DigitalEvent rdfs:subClassOf [ owl:intersectionOf ( Date: Wed, 18 Dec 2024 14:52:55 -0700 Subject: [PATCH 21/21] fix pellet errors, fix bad definition on Artifact --- src/ontology/d3fend-protege.ttl | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/src/ontology/d3fend-protege.ttl b/src/ontology/d3fend-protege.ttl index 40947851..4a46aac1 100644 --- a/src/ontology/d3fend-protege.ttl +++ b/src/ontology/d3fend-protege.ttl @@ -43,8 +43,6 @@ :addressed-by a owl:ObjectProperty ; rdfs:label "addressed-by" ; rdfs:subPropertyOf :associated-with ; - rdfs:domain :Resource ; - rdfs:range :Identifier ; owl:inverseOf :addresses ; :definition "x addressed-by y: Relates a resource x (e.g., network host, peripheral device, disk sector, a memory cell or other logical or physical entity) to a discrete address y in an address space that points to it." . @@ -52,8 +50,6 @@ rdfs:label "addresses" ; skos:altLabel "points-to" ; rdfs:subPropertyOf :associated-with ; - rdfs:domain :Identifier ; - rdfs:range :Resource ; :definition "x addresses y: Relates a pointer x to a digital artifact y located in the address space to which x points. The address space is part of some digital store, whether it be in memory, an image, or a persistent storage device." ; rdfs:seeAlso , ; @@ -2440,8 +2436,7 @@ Wikipedia. (n.d.). Autoregressive-moving-average model. [Link](https://en.wikipe :Artifact a owl:Class ; rdfs:label "Artifact" ; rdfs:subClassOf :D3FENDCore ; - :definition "A man-made object taken as a whole.", - ; + :definition "A man-made object taken as a whole." ; rdfs:seeAlso , . @@ -31612,7 +31607,7 @@ This patent describes ensuring that a driver associated with the agent is initia :Reference-IntroducingFirefoxNewSiteIsolationArchitecture a :InternetArticleReference, owl:NamedIndividual ; rdfs:label "Reference - Introducing Firefox's new Site Isolation Architecture" ; - :has-link "https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture/" ; + :has-link "https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture/"^^xsd:anyURI ; :kb-abstract "" ; :kb-author "Anny Gakhokidze" ; :kb-mitre-analysis "" ; @@ -32313,7 +32308,7 @@ Powershell can be used to hide monitored command line execution such as: :Reference-PrivateApplicationAccessWithBrowserIsolation a owl:NamedIndividual, :PatentReference ; rdfs:label "Reference - Private application access with browser isolation" ; - :has-link "https://patents.google.com/patent/US20210250333A1" ; + :has-link "https://patents.google.com/patent/US20210250333A1"^^xsd:anyURI ; :kb-reference-of :Application-basedProcessIsolation ; :kb-reference-title "Private application access with browser isolation" . @@ -32378,7 +32373,7 @@ Powershell can be used to hide monitored command line execution such as: :Reference-ProtectingWebApplicationsFromUntrustedEndpointsUsingRemoteBrowserIsolation a owl:NamedIndividual, :PatentReference ; rdfs:label "Reference - Protecting web applications from untrusted endpoints using remote browser isolation" ; - :has-link "https://patents.google.com/patent/US11477248B2/" ; + :has-link "https://patents.google.com/patent/US11477248B2/"^^xsd:anyURI ; :kb-reference-of :Application-basedProcessIsolation ; :kb-reference-title "Protecting web applications from untrusted endpoints using remote browser isolation" . @@ -32853,7 +32848,7 @@ Logon events are Windows Event Code 4624 for Windows Vista and above, 518 for pr :Reference-SiteIsolationDesignDocument a :InternetArticleReference, owl:NamedIndividual ; rdfs:label "Reference - Site Isolation Design Document" ; - :has-link "https://www.chromium.org/developers/design-documents/site-isolation/" ; + :has-link "https://www.chromium.org/developers/design-documents/site-isolation/"^^xsd:anyURI ; :kb-abstract "" ; :kb-mitre-analysis "" ; :kb-organization "The Chromium Projects" ;