Rethinking Cybersecurity Ontology Classification and Evaluation: Towards a Credibility-Centered Framework

2025-12-01

AI Summary

Cybersecurity ontologies suffer from low adoption rates due to insufficient credibility—a challenge rooted not only in technical shortcomings but, more critically, in the absence of a user-centered trust assessment framework. To address this, this paper proposes a novel ontology classification and evaluation paradigm centered on *credibility*, introducing for the first time a four-dimensional credibility metric encompassing institutional endorsement, academic recognition, empirical validation, and industrial adoption. We formalize this into the Framework for Ontology Credibility (FOC), a practical, operational assessment tool. Through systematic literature review and multi-source empirical analysis, FOC demonstrably enhances alignment between ontology selection and real-world security requirements. Its application in the French–Luxembourgish research project ANCILE confirms its efficacy in optimizing ontology selection decisions within operational cybersecurity contexts. The framework establishes a trustworthy, reusable foundation for knowledge modeling in cybersecurity, bridging the gap between theoretical ontology development and practical deployment.

Technology Category

• Knowledge Representation and Reasoning: Ontologies
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty

Application Category

• Security and Privacy: Large-scale security measurements
• Semantics and Knowledge: Provenance, trust, security and privacy, and ethical issues in managing semantic data
• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity

Abstract

This paper analyzes the proliferation of cybersecurity ontologies, arguing that this surge cannot be explained solely by technical shortcomings related to quality, but also by a credibility deficit - a lack of trust, endorsement, and adoption by users. This conclusion is based on our first contribution, which is a state-of-the-art review and categorization of cybersecurity ontologies using the Framework for Ontologies Classification framework. To address this gap, we propose a revised framework for assessing credibility, introducing indicators such as institutional support, academic recognition, day-to-day practitioner validation, and industrial adoption. Based on these new credibility indicators, we construct a classification scheme designed to guide the selection of ontologies that are relevant to specific security needs. We then apply this framework to a concrete use case: the Franco-Luxembourgish research project ANCILE, which illustrates how a credibility-aware evaluation can reshape ontology selection for operational contexts.

Problem

• Addresses cybersecurity ontology credibility deficit
• Proposes a revised framework for assessing credibility
• Guides selection of ontologies for specific security needs

Innovation

• Proposing a credibility-centered framework for cybersecurity ontology evaluation
• Introducing new credibility indicators like institutional support and adoption
• Applying the framework to guide ontology selection for specific needs