COBRA: Cyber Ontology Based Reasoning Architecture

Existing approaches for the ontological modeling of defensive and offensive Cyber operations are either brittle due to their rigid, inflexible structure or provide point solutions, lacking the modular connective glue to enable cross-source or cross-domain reasoning (e.g., MAEC, CybOX, CWE). The development of a standards-based, layered Cyber semantic model or ontology (with extensible data-domain-high level layers) provides users the ability to store, query and manipulate data across semantic layers, delivering the proper level of abstraction based on user needs while enabling dynamic and/or learned semantic model revisions. We plan to integrate many previously developed point solutions while constructing other data or domain ontologies within the Cyber Ontology Based Reasoning Architecture (COBRA) effort. COBRA will apply an innovative multi-level ontological model to efficiently integrate large heterogeneous Cyber datasets. This layered Cyber ontology will enable full first-order logic reasoning and graph query heuristics which assists the characterization of complex Cyber entities and events. An innovative semantic model drift detection approach will be applied in learning new/changed ontological concepts and properties. These innovations within COBRA will lead to a flexible/extensible Cyber semantic model framework which captures information in legacy systems while providing a mechanism to extend to new or changing data sources.