# Ontology-Based System for Dynamic Risk Management in Administrative Domains
## 4 Formalization of the Architecture  
A prototype based on the proposed architecture has been developed. This prototype has been designed to perform measurements and calculations with high regularity in order to obtain risk levels in a near real-time scenario. In terms of programming language, Java was selected because of its integration with ontologies by means of the OWLAPI [20] library. One of the initial tasks to be performed is the formalization of the characterization of the assets defined in the previous section. For this, the prototype analyzes a configuration file, previously created, that contains the attributes that characterize each asset involved in the risk analysis process carried out. From all this information, and making use of OWLAPI, instances of assets are generated in the ontology. From its part, Syslog [21] feed the system by means of threats, which are characterized following the CEF format. Thus, the system is able to collect the following information from the threats: date,  
Figure 3: Overview of the architecture proposed. name of the threat (e.g., Andromeda), type of threat, source IP address, destination URL, severity, region code, and trust level of the detected threat. In addition, the system should perform an enrichment of knowledge about the threat received by using external sources of TI, which enhances its correlation with asset analysis. Making use of INCIBE's AntiBotnet service, offered through the website of the Office of Internet Security (OIS), the system is able to collect information about types of devices affected by any threat. This search is carried out supported by a web scraper searching, which is ready to use keywords such as \"Windows\", \"IoT\", \"Router\", etc. In case any information is unfound, an assignment of affected devices is made based on probabilities defined within the system's configuration file. In both cases, the information is stored in separated databases, one for the threat found, and the other which registers threats for which the TI service used has no information. Figure 4 shows the flowchart that describes this functionality. With all this information, each threat event is modeled in OWL format so that it can be used by the reasoner. Figure 5 shows an example of how a threat instance would look by using Protege. Figure 4: Graphic description of the method of enrichment of knowledge about threats followed in the development of the prototype. Figure 5: Information on a threat represented in an ontology. Once both assets and threats are modeled in OWL format, the SWRL rules can be executed. These cover the whole combination between the different administrative domains, asset types, device types, and devices' operating systems, if applicable. The implemented system has a total of 2508 rules. Figure 6 shows an example of a rule used to analyze the risk of threat. In concrete, this risk was materialized on the servers of a critical company supported by a Windows Server, within the administrative domain of the autonomous community of Aragon. The analysis process described is detailed in Figure 7.  
However, each SWRL rule only makes an instantaneous contribution to the risk of an asset since it only calculates the risk on a specific device or operating system for a specific asset in a specific administrative domain. The system implemented has been applied to the geographical context of Spain, based on two administrative domains, a national level (Spain) and a community level composed of a set of autonomous communities (ACs) with their own identity. So, the system has to analyze the interrelations between all elements. The sum of the values given by the rules concerning an asset in a specific AC will constitute the risk of that asset, without taking into account the threats materialized in the rest of the communities. Therefore, to obtain the risk of such an asset at the national level, it will be sufficient to apply Equation (1), where \(j\) indexes the type of asset, and \(i\) indexes each AC.