## 3 Methodology
### Instantiating the Augmented Ontology for AI-Powered Applications  
While MITRE ATLAS proves to be a valuable resource, it is not without practical limitations when serving as the cornerstone of an ontology-based cybersecurity framework that aims to automate the vulnerability assessment in a continuously evolving threat landscape of novel ML attacks and defenses. One notable limitation is that it lacks practical and detailed information about threats and mitigations, especially in a machine interpretable manner. To illustrate, the tactic 'Reconnaissance' (AML.TA0002) includes the technique 'Search for Victim's Publicly Available Research Materials' (AML.T0000) along with the sub-technique 'Journals and Conference Proceedings' (AML.T0000.000). The sub-technique is shown in Appendix B in Listing A4 and is available at [[https://atlas.mitre.org/techniques/AML.T0000.000](https://atlas.mitre.org/techniques/AML.T0000.000)]([https://atlas.mitre.org/techniques/AML.T0000.000](https://atlas.mitre.org/techniques/AML.T0000.000)) (accessed on 23 January 2024). One of the shortcomings is that this body of knowledge remains too high-level to be practically useful for automated reasoning. Indeed, a tactic is the highest-level description of an adversary's behavior, while techniques give a more detailed description of behavior in the context of a tactic, and procedures an even lower-level, highly detailed description in the context of a technique [19]. The STIX representation of MITRE ATLAS is confined to tactics and techniques only, which proves inadequate for encapsulating the core nature of threats posed to ML-based systems and applications. It lacks the incorporation of detailed low-level procedures. In contrast, the YAML representation of ATLAS encompasses 22 case studies that document procedures delineating each step of a specific attack. An example is the 'Evasion of Deep Learning Detector for Malware C&C Traffic' (AML.CS0000) case study,available at [[https://atlas.mitre.org/studies/AMLCS00000/](https://atlas.mitre.org/studies/AMLCS00000/)]([https://atlas.mitre.org/studies/AMLCS00000/](https://atlas.mitre.org/studies/AMLCS00000/)) (accessed on 23 January 2024), which provides associated tactics and techniques. It is noteworthy, however, that these textual descriptions are designed mainly for human analysts or security experts and do not facilitate machine interpretation. Furthermore, a given procedure may contain references to scientific papers or URLs pointing to the associated paper or relevant software code. Unfortunately, instead of citing a scientific paper by its distinctive digital object identifier (DOI), the publication is referenced in plain text, leaving it susceptible to potential textual mismatches. Furthermore, the momentum of adversarial ML is propelled by a surge of conference and journal papers proposing novel attacks and adversarial techniques ranging from simple data manipulations to more sophisticated methods that leverage intricate knowledge of model architectures. Other references lead to blog posts, news articles, or project pages that might lack the essential details required for replicating an attack or devising a new mitigation strategy. As a result, deriving the interconnection between old and new attacks, as well as understanding how novel attacks compromise established defenses, based on just these references is a non-trivial task. Simultaneously, the surge in proposed defense strategies reflects the urgency to mitigate the risks associated with adversarial attacks. Mitigations are also covered in MITRE ATLAS, as depicted in Appendix B in Listing A5 for the 'Model Hardening' (AML.M0003) mitigation. However, the landscape of adversarial ML is marked by an inherent cat-and-mouse game, where the introduction of new defenses often prompts the generation of more sophisticated attacks. This arms race raises questions about the long-term efficacy of existing defenses and emphasizes the need for a continuous reassessment of security measures.