## 4 Results: State-of-the-Art Approaches
### Semantic Modeling in IoUT
#### 4.1.2 Semantic Modeling and Cybersecurity  
In a dynamic environment such as IoUT, real-time cybersecurity is mandatory. Updates and patches, and cybersecurity assessment, must be a continuous process; in fact, this process should be placed in the top priority of actions taken by operations and management teams. To achieve an efficient real-time cybersecurity risk assessment of a large network, several factors should be taken into consideration. Interoperability and communication between all assets are both vital to gather data/information from the whole internal architecture. In addition, connectivity with external sources is significant in order to be able to correlate suspicious behaviors and acts [65]. In related work [68], authors aim to provide high availability of services used by information technology (IT) systems and minimize the impacts of security failures, thus, they developed an ontology for threat assessment and risk analysis. Initially, they identified the security requirements of unmanned autonomous systems and then they modeled how adversaries achieve their objectives. The technology utilized was the free open-source ontology engineering tool Protege, the OWL language, and the well-known open-source vulnerability scanner named OpenVAS ([[https://www.openvas.org/](https://www.openvas.org/)]([https://www.openvas.org/](https://www.openvas.org/)), accessed on 20 November 2022). After the conceptualization and definition of concepts related to the dependencies between risks, threats, vulnerabilities and information assets, the relevant knowledge is extracted from the obtained XML report, allowing intelligent decisions to be made. The semantic modeling and interoperability between cybersecurity solution systems, such as the Intrusion Detection Systems (IDS), should be achieved to be able to integrate all the related data available, towards automating a continuous real-time risk assessment. Based on such an approach, analyzing system activities and identifying known cyberattack patterns is facilitated. Another approach to support ontology-based knowledge sharing and address common and known threats, attacks, and vulnerabilities, is proposed by [PERSON] et al. [69]. Combining semantic technology and standardization of countermeasures, the approach effectively achieves provision of a federation of resources of the cyber security domain and the representation of relationships with other concepts (threats, mitigation techniques, etc.) for two well-known attack cases, i.e., the \"SQL Injection\"([[https://portswigger.net/we](https://portswigger.net/we)]([https://portswigger.net/we](https://portswigger.net/we)) b-security/sql-injection, accessed on 20 November 2022) and the \"Heartbleed\"([[https://heartbleed.com/](https://heartbleed.com/)]([https://heartbleed.com/](https://heartbleed.com/)), accessed on 20 November 2022). The presented model is designed in such a way that enables the combination of resources that either already exist or are future-anticipated, focusing on the attack patterns and supporting them with vulnerabilities, weaknesses, and other various categorizations. Finally, another important feature provided is reasoning, based on relationships (\"exploits by\", \"detectable by\", etc. ), which facilitate the understanding of the whole concept of attack, providing indicators of compromise (IOCs) (pieces of data such as log files, that identify potentially malicious activity in a network or system [70]) and supporting the perception of the attack pattern, i.e., which component was tried to be exploited, which was the exploit, etc. Furthermore, correlation with well-known knowledge databases is supported (MITRE, OWASP, and WASC). Well-managed cybersecurity operations demand rapid and accurate identification of an alert, to be able to counter cyber threats. Moreover, modern information systems are characterized by complexity and integrate a vast number of security metrics, which need to be analyzed.