Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added Upper Model of OT Artifacts #329

Merged
merged 6 commits into from
Dec 17, 2024
Merged

Added Upper Model of OT Artifacts #329

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
106391d
Added Upper Model of OT ARtifacts
OG3x100 Dec 13, 2024
197fff7
Update Pull Request with new Artifact connections
OG3x100 Dec 17, 2024
69bda16
Merge branch 'd3fend:develop' into d3fend-for-ot
OG3x100 Dec 17, 2024
f07e735
fixed sensor definition
OG3x100 Dec 17, 2024
0f0ea1a
We can mention logic solver on OT Sensor but not Sensor
netfl0 Dec 17, 2024
ba59132
remove broken link
netfl0 Dec 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 81 additions & 3 deletions src/ontology/d3fend-protege.ttl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,11 @@
rdfs:label "claims" ;
rdfs:subPropertyOf :d3fend-catalog-object-property .

:communicates-with a owl:ObjectProperty ;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is a owl:SymmetricProperty, where if x communicates with y then y also communicates with x. Otherwise, perhaps the d3f:connects property is sufficient.

rdfs:label "communicates with" ;
rdfs:subPropertyOf :associated-with ;
:definition "x communicates with y: An entity x sends and receives data by any means of data transferance to an entity y." .

:configures a owl:ObjectProperty ;
rdfs:label "configures" ;
rdfs:subPropertyOf :associated-with,
Expand Down Expand Up @@ -203,6 +208,11 @@ Moving forward different distinctions of kinds of has-part (contains) relationsh
rdfs:subPropertyOf :d3fend-catalog-object-property ;
rdfs:range owl:Thing .

:controls a owl:ObjectProperty ;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think ideally this would be a superproperty of d3f:manages, but I can see why you didn't choose that as the definition there is too specific to relating some thing x to a digital artifact y.

d3f:manages rdfs:subPropertyOf d3f:controls makes sense to me.

I think we should also add the inverse property (d3f:controlled-by).

rdfs:label "controls" ;
rdfs:subPropertyOf :associated-with ;
:definition "x controls y: An entity x that regulate, guide, or manage the behavior of an entity y." .

:copies a owl:ObjectProperty ;
rdfs:label "copies" ;
rdfs:subPropertyOf :creates ;
Expand Down Expand Up @@ -957,6 +967,11 @@ Moving forward different distinctions of kinds of has-part (contains) relationsh
rdfs:isDefinedBy <http://purl.obolibrary.org/obo/BFO_0000056> ;
:definition "x participates-in y: The object x takes part in the event y, signifying that x contributes to or is affected by the event’s occurrence in some way." .

:powered-by a owl:ObjectProperty ;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is a subproperty of d3f:dependsOn, and also needs an inverse (d3f:powers).

rdfs:label "powered by" ;
rdfs:subPropertyOf :associated-with ;
:definition "x is powered by y: An entity x is charged, or given energy or force by an entity y." .

:preceded-by a owl:ObjectProperty ;
rdfs:label "preceded-by" ;
rdfs:subPropertyOf :associated-with ;
Expand Down Expand Up @@ -10680,7 +10695,7 @@ Analyzing the interaction of a piece of code with a system while the code is bei
* Sometimes the malware behavior is triggered only under certain conditions (on a specific system date, after a certain time, or after it is sent a specific command) and can't be detected through a short execution in a virtual environment.

## Implementations
* [Cuckoo Sandbox](https://cuckoosandbox.org)""" ;
* Cuckoo Sandbox""" ;
:kb-reference :Reference-MalwareAnalysisSystem_PaloAltoNetworksInc,
:Reference-UseOfAnApplicationControllerToMonitorAndControlSoftwareFileAndApplicationEnvironments_SophosLtd ;
:synonym "Malware Detonation",
Expand Down Expand Up @@ -13101,7 +13116,7 @@ Georgian Impact Blog. (n.d.). Transfer Learning Part 1. [Link](https://medium.co
:definition """Ensuring that an integer is within a valid range.
""" ;
:kb-article """## How it Works
Integer Range Validation can be done by programmatically checking the value of an integer before or after an operation to determine if the resulting value will be valid.
Integer Range Validation can be done by programmatically checking the value of an integer before or after an operation to determine if the resulting value will be valid.
Checking the value of an integer to ensure it is in a valid range helps prevent integer overflow, wraparound, and logical errors.

## Considerations
Expand Down Expand Up @@ -16249,6 +16264,69 @@ Operating System Monitoring Techniques have varied implementations including bui
owl:onProperty :invokes ;
owl:someValuesFrom :WriteMemory ] .

:OTActuator a owl:Class ;
rdfs:label "OT Actuator" ;
rdfs:subClassOf :OutputDevice ;
rdfs:isDefinedBy <https://csrc.nist.gov/glossary/term/actuator> ;
:definition "An OT actuator is a device for moving or controlling a mechanism or system. It is operated by a source of energy, typically electric current, hydraulic fluid pressure, or pneumatic pressure, and converts that energy into motion. An actuator is the mechanism by which a control system acts upon an environment. The control system can be simple (a fixed mechanical or electronic system), software-based (e.g., a printer driver, robot control system), or a human or other agent." .

:OTController a owl:Class ;
rdfs:label "OT Controller" ;
rdfs:subClassOf :OTEmbeddedComputer,
[ a owl:Restriction ;
owl:onProperty :communicates-with ;
owl:someValuesFrom :OTInputOutputModule ],
[ a owl:Restriction ;
owl:onProperty :controls ;
owl:someValuesFrom :OTActuator ],
[ a owl:Restriction ;
owl:onProperty :monitors ;
owl:someValuesFrom :OTSensor ],
[ a owl:Restriction ;
owl:onProperty :powered-by ;
owl:someValuesFrom :OTPowerSupply ] ;
rdfs:isDefinedBy <https://csrc.nist.gov/glossary/term/controller> ;
:definition "A device or program that operates automatically to regulate a controlled variable." .

:OTEmbeddedComputer a owl:Class ;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs a definition.

rdfs:label "OT Embedded Computer" ;
rdfs:subClassOf :EmbeddedComputer .

:OTInputOutputModule a owl:Class ;
rdfs:label "OT Input Output Module" ;
rdfs:subClassOf :HardwareDevice,
[ a owl:Restriction ;
owl:onProperty :communicates-with ;
owl:someValuesFrom :OTActuator ],
[ a owl:Restriction ;
owl:onProperty :communicates-with ;
owl:someValuesFrom :OTSensor ] ;
rdfs:comment "Rockwell Compact 5000 IO Module",
"There are many types of I/O modules, including: analog input, analog output, HART input, HART output, digital input, digital output, mV input, pulse input, universal I/O, vibration input, and many other types of input or output modules.The functionality of the I/O Module can be embedded in the controller or as a separate module connected via chassis or I/O link." ;
rdfs:isDefinedBy <https://consteel-electronics.com/articles/what-is-IO-module> ;
:definition "An I/O module is a hardware component designed to connect to external devices and sensors, converting analog or digital signals into a format that can be processed by a control system and vice versa." ;
rdfs:seeAlso <https://www.rockwellautomation.com/en-us/support/documentation/technical/i-o/compact-5000-i-o-modules.html> ;
:synonym "IO Module" .

:OTPowerSupply a owl:Class ;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we need a d3f:PowerSupply artifact that an OT Power Supply is a specialization of.

rdfs:label "OT Power Supply" ;
rdfs:subClassOf :PhysicalArtifact ;
rdfs:comment "OT examples include: Phoenix Contact QUINT, Eaton PSG, and many controller-branded power supplies.",
"See following for definition source - IEEE 100: The Authoritative Dictionary of IEEE Standards Terms IEEE STANDARDS DICTIONARY OF ELECTRICAL AND ELECTRONICS TERMS" ;
:definition "An electronic module that converts power from some power source to a form which is needed by the equipment to which power is being supplied." .

:OTSensor a owl:Class ;
rdfs:label "OT Sensor" ;
rdfs:subClassOf :Sensor ;
rdfs:comment "Components of the sensor include a sensing element and may include a power source, display, housing, communication interface or signal processor.",
"Types of sensors include: level, pressure, temperature, and flow measurement devices." ;
rdfs:isDefinedBy <https://csrc.nist.rip/glossary/term/sensor> ;
:definition "An OT sensor is a device that measures a physical quantity and converts it into a signal which can be read by an observer or by an instrument. A sensor is a device, which responds to an input quantity by generating a functionally related output usually in the form of an electrical or optical signal." ;
rdfs:seeAlso <https://emerson.com/en-us/catalog/rosemount-sku-3051-coplanar-pressure-transmitter>,
<https://www.emerson.com/en-us/catalog/rosemount-sku-708-wireless-acoustic-transmitter>,
<https://www.omega.com/en-us/pressure-measurement/pressure-gauges/c/analog-pressure-gauges>,
<https://www.vega.com/en-us/products/product-catalog/level/radar> .

:OutboundInternetDNSLookupTraffic a owl:Class ;
rdfs:label "Outbound Internet DNS Lookup Traffic" ;
rdfs:subClassOf :DNSNetworkTraffic,
Expand Down Expand Up @@ -18808,7 +18886,7 @@ Legitimate emails from a sender may receive a lower trust rating over time if th
rdfs:label "Sensor" ;
rdfs:subClassOf :D3FENDCore,
:DigitalInformationBearer ;
:definition "In the broadest definition, a sensor is a device, module, machine, or subsystem that detects events or changes in its environment and sends the information to other electronics, frequently a computer processor." ;
:definition "In the broadest definition, a sensor is a device, module, machine, or subsystem that detects events or changes in its environment and sends the information to other electronics, frequently a computer." ;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not good, please remove.

rdfs:seeAlso <https://en.wikipedia.org/wiki/Sensor> .

:SeqGAN a owl:Class,
Expand Down
Loading