# Ontology-Based System for Dynamic Risk Management in Administrative Domains
## 2 Related Works
The research works presented in [13; 14] represent a clear example of the use of ontologies for knowledge sharing in the field of TI. [PERSON], [PERSON]. et al. proposed in [13] an ontology-based model for sharing alerts between different information security management systems; while [PERSON], [PERSON] et al. detailed in [14] a possible integration of STIXTM and ontologies for situational consciousness, which is a very interesting approach. The authors demonstrate the benefits for different use cases (vulnerabilities associated with PDF readers, suggestions for similar software, etc.) as a very interesting contribution, for example, to the verification of the impact of supplier change. Most recently, [PERSON] et al. proposed in [15] a new dynamic risk management and threat [PERSON] methodology for generating inference rules to be used in different application domains. The feasibility of this research was addressed in [16], where the authors proposed blockchain and Smart contracts as a solution for fostering cyber threat and risk [PERSON] exchange of information. Both works were based on STIXTM and developing a new semantic version of it, and this has been selected as the basis of the present research work. Finally, it is important to underline the use of metrics in cybersecurity decision-making. The use of these metrics allows cybersecurity systems to know the effectiveness and impact of the implemented security controls and policies. We can analyze some research works in this field, such as in [17; 18; 19]. In [17], [PERSON], [PERSON] et al. integrate an ontological concept of information security into the management of risk-related business processes. The ontology developed was based on NIST, and the authors provided subontologies for describing threats, vulnerabilities, and control. Communication between the ontology security web service and the risk-dependent simulation engine was structured by XML documents. In addition, this research work proposed including the threat to human life in case of risk as a key metric in order to improve and extend the classification of threats and subsequent decision making. [PERSON], [PERSON] et al. proposed in [18; 19] an Automatic Intrusion Response System (AIRS) based on ontologies, which infers the optimal answers at the network level. The research works presented so far develop different ontologies to represent knowledge related to some aspects involved in the risk management process, or propose architectures based on security ontologies previously developed. However, these researches present some shortages in terms of dynamism awareness, and with a fuzzy definition of the assets. All the risk assessments are based on a concrete set of assets, but in administrative domains, it is not possible to have a detailed definition of assets. Therefore, for all the above, in this analysis of related works, the research presented in this article has focused on the development of a risk assessment architecture capable of handling dynamic connections in which a knowledge engine will be supported by a new security ontology. Said ontology must consider the characteristics of the administrative domains, i.e., a fuzzy definition of assets and a high degree of dynamism in relation to the assets involved (people and devices), and be capable of processing new risks not contemplated during their implementation (new income risks). In this sense, some concepts of the work developed by [PERSON] in Villagra (2019) have been used for the risk assessment ontology, but the definition of the global ontology for modeling administrative domains and all the security metrics that are instantiated and executed as inference engine rules are a contribution of this article. In addition, the architecture should take into account past threats to determine the final risk by means of a risk history. And finally, unlike the analyzed works, continuous feedback should be carried out in order to be able to offer an accurate risk analysis.