## 4 Results: State-of-the-Art Approaches
### Semantic Modeling in IoUT
#### 4.1.2 Semantic Modeling and Cybersecurity
Cybersecurity tools can support the prediction and evaluation of the consequences of a cyber threat, but they should be prepared to examine a huge volume of data. [PERSON] et al. [71] propose a semantic model, i.e., Ontology of Security Metrics [72], to support security evaluation of information systems and to facilitate the work of security tools. The main goal of this ontology is to accurately determine the goal of a cyberattack and allow for more efficient responding to attacks in future. It provides four basic classes, i.e., data sources, security information, infrastructure objects and security metrics and is implemented using OWL. Security of Metrics can answer questions by importing raw data and provide an efficient security evaluation. The main issue, from our perspective, is the inability to counter the probabilistic behavior of this domain, especially in our era, in which cyberattacks are becoming more and more sophisticated (\"zero-day\" attacks, [[https://www.kaspersky.com/resource-center/definitions/zero-day-exploit](https://www.kaspersky.com/resource-center/definitions/zero-day-exploit)]([https://www.kaspersky.com/resource-center/definitions/zero-day-exploit](https://www.kaspersky.com/resource-center/definitions/zero-day-exploit)), accessed on 20 November 2022). Another related approach is presented by [PERSON] et al. [73], developing a cybersecurity vulnerability ontology (CVO). Since the prevention of cybersecurity exploits requires the integration of vulnerability information from multiple resources, including social media, they designed an ontology to represent the vulnerability domain; in fact, except from integrating common vulnerability concepts from various known resources, they also represent knowledge related to the well-known social media platform, Twitter. Furthermore, they have designed a confidentiality, integrity, and authentication (CIA) system which uses the CVO to represent cybersecurity alerts. CIA essentially receives all the information from CVO and external or internal resources, to deduce the alerts. Eventually, they have evaluated both the CVO and the CIA system, concluding that the quality of CIA alerts generated depends on the underlying ontology. The first cybersecurity ontology to support broader and heterogeneous security use cases is the unified cybersecurity ontology (UCO) [74]. Due to its variety of entities, relations, actions, events, intentions and plans, UCO is suitable for reuse and integration, as well as for linking other ontologies in this domain. In their work, the authors present their semantic approach to implement situational awareness to cybersecurity systems; they have reused other known semantic approaches, i.e., CVE [75], CCE [76] and STIX [77] of the same domain to extend the standards and the vocabulary in a single unified ontology. Several classes are included, with the most significant being Means, Consequences, Attack, Attack, AttackPattern, Exploit, Exploit Target, and Indicator; moreover, there are several classes that refer to the network and architecture of the system, such as Network State and Processes. Additionally, it includes instances representing network state and information about an attacker. The main disadvantage of UCO is the inability to integrate information from different sources of the same type. On the contrary, it requires manual implementation for a specific networking system, which emerges as an obstacle to real-time security. Motivated by the fundamental requirement of security when developing a dynamic system and the cons of existing cybersecurity ontologies, the Institute of Computer Science in Poland proposed a semantic approach for observing system components, retrieving up-to-date data about those systems and potential risks; in fact, due to the increasing number of sub-systems, as well as the physical equipment needed, the complexity of system architecture was greatly enhanced.