An Ontology to Promote Interoperability between Cyber-physical Security Systems in Critical Infrastructures

Critical infrastructures, like airports and hospitals, provide essential services and are considered huge investments in any country. Ensuring the security of these critical infrastructures is a necessity in every possible aspect. These infrastructures, however, currently make use of different technological solutions with distinct security levels, features and knowledge representation formats which often do not communicate directly with each other, leaving the task of processing the global view of the institution's security to the end-users. In order to have a complete view of the current cybersecurity status of a given system, interoperability between these tools must be addressed. Different ontologies have been proposed to deal with subdomains of cybersecurity. Similarly, these fail to provide a full view of cyber and physical security that would be necessary to achieve a global security approach. In this paper, we explore the current status and activities of cybersecurity as a basis for the development process, propose an integrated ontology for combined cyber and physical security. After that, we suggest several evaluation methods to be applied to the resulting ontology in order to check its usefulness in achieving the interoperability goal. The focus will be on the different systems needed for an integrated security of airports.

I. Introduction

Nowadays, more services are being provided online; and so more potential weak points are available to be exploited. According to [1], more than 200 million records were exposed just in the first half of 2015. A single hacking attack exposed about 78 million of those records. The number rose to more than 15 billion records in 2019 making it the worst recorded year [2]. It is worth mentioning that this problem is a domain-crossing one, as there is not a sector which uses technology that can be considered safe from such threats. Whether it is business, education, health, or even governmental systems, they are all at risk if proper precautions are not taken. With continuously changing and developing technology, infrastructure can easily become unstable and vulnerable. Therefore, any security system needs to be able to quickly react to any changes within its environment. In order to achieve that, information from different resources and systems needs to be collected and integrated to help analyze occurring events, support decision-making, register feedback after applying those decisions, and extract knowledge useful for future incidents prevention [3].