## 3 EDAS Prototype Specifications
### The EDAS Platform
#### 3.4.3 Adaptation Engine
\begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Step No.** & **Type: Subject** & **Type: Predicate** & **Type: Object** & **Type: Return** \\ \hline \multirow{2}{*}{Step 1} & **Description:**_identifying a particular threat faced in the ontology_ & & & \\ \cline{2-4}  & Class: & Data Property: & String: & Class Object: \\  & threats & hasThreatID & Threat-ID, e.g., “DOS5001” & a threat object \\ \hline \multirow{2}{*}{Step 2} & **Description:**_listing possible actions that address the threat identified in Step 1_ & & & \\ \cline{2-4}  & Class: & Object Property: & Class Object: & Class Object: \\  & actions & mitigates & threat & action objects \\ \hline \multirow{2}{*}{Step 3} & **Description:**_identifying security mechanisms untilted by actions identified in Step 2_ & & & \\ \cline{2-4}  & Class Object: & Object Property: & Class: & Class Object: \\  & action objects & utilizes & security mechanism & security mechanism objects \\ \hline \multirow{2}{*}{Step 4} & **Description:**_identifying the device facing the threat_ & & & \\ \cline{2-4}  & Class: & Data Property: & String: Device-ID e.g., & Class Object: \\  & devices & hasID & “192.168.1.3” & A Device object. \\ \hline \multirow{2}{*}{Step 5} & **Description:**_extracting only device-supported security mechanisms from those identified in Step 3_ & & & \\ \cline{2-4}  & Class Object: & Object Property: & Class Object: security mechanism objects & Class Object: \\  & a device object & supports & mechanism objects & security mechanism objects \\ \hline \multirow{2}{*}{Step 6} & **Description:**_listing properties that are utilized by mechanism identified in Step 5_ & & & \\ \cline{2-4}  & Class Object: & Object Property: & Class: & Class Object: \\  & security mechanism objects & inherit & security property & security property objects \\ \hline \multirow{2}{*}{Step 7} & **Description:**_selecting properties addressing a particular risk level from the properties identified in Step 6_ & & & \\ \cline{2-4}  & Class Object: & Data Property: & Integer: & & \\ \cline{2-4}  & security property objects & controlsRiskLevel & risk-Level e.g., 1, 2, 3... & security property objects \\ \hline \multirow{2}{*}{Step 8} & **Description:**_extracting utility metrics values for individual property identified in Step 6_ & & & \\ \cline{2-4}  & Class Object: & Data Property: & Integer: & Integer: \\ \cline{2-4}  & security property objects & hasUsabilityUtility, & Utility-value e.g., 1,2,3... & utility-value \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The adaptation action decision process. \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Class** & **Description** & **Example class objects** \\ \hline Device & Monitored devices and their attributes & Sensor, smartphone, desktop \\ \hline Threat & Threats known in the environment & DoS, brute force, malware infection \\ \hline Actions & Mitigation responses to be adapted to & Enforce a CAPTCHA, change cipher, \\  & defend against a threat & change routing algorithm \\ \hline Security mechanism & Methods, tools, algorithms used by an action & DES, AES, XOR, CAPTCHA, password length \\ \hline Security property & Adjustable attributes of a security mechanism & Eight-char password, image CAPTCHA, audio CAPTCHA, 128-bit key \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Classes description in the adaptation process. As the final step (Step 9), a security property object having the maximum weighted utility among those identified in Step 7 is selected as the most optimal property. The corresponding mechanism and action are extracted, and an adaptation request string is constructed. The request is sent to the event source as an optimal response to the faced threat and to be adopted locally. Metrics, such as hasUsabilityUtility, hasReliabilityUtility and hasConfUtility, _etc._, are attributes associated with each security property object. They reflect the property utility in terms of user and service requirements and device capabilities.