## 4 Results: State-of-the-Art Approaches
### Semantic Modeling in IoUT
#### 4.1.2 Semantic Modeling and Cybersecurity
Some of these cons include: the attempt to integrate the widest range of domains possible or a very specialized domain affecting scalability, the inability of external knowledge integration, which demands the manual effort of user and the difficulties in integrating dynamic data from real-time auditing. Thus, they propose a cybersecurity framework based on the existing dynamic cybersecurity ontology (DCO), which fills the gaps in current solutions (UCO, CVO, etc.) by implementing automatic data mining mechanisms and aggregation of results from dynamic knowledge sources (Shodan, [[https://www.shodan.io/](https://www.shodan.io/)]([https://www.shodan.io/](https://www.shodan.io/)) 20 November 2022, or Cencys, [[https://censys.io/](https://censys.io/)]([https://censys.io/](https://censys.io/)), accessed on 20 November 2022) in a monitoring system [78]. Focusing on correlation with common vulnerabilities exposure (CVEs) and further integration with the existing ontologies, they achieve real-time data analysis, according to the needs and vulnerabilities of each networking environment. Another cybersecurity challenge involved in IoT, is the distinct security mechanisms of each interconnected domain, which leads to lack of knowledge of basic elements of their components (assets, vulnerabilities, threats, etc.). This issue is tackled in the work of [PERSON] et al. [50]. The existence of numerous and heterogeneous devices in IoT allows adversaries to exploit, very often, common and known vulnerabilities. The basic idea of the authors is the integration of these well-known vulnerabilities in a cybersecurity framework for an existing ontology (IoTSec, [[https://github.com/bruno](https://github.com/bruno)]([https://github.com/bruno](https://github.com/bruno)) mozza/IoTSecurityOntology/blob/master/iotsec.owl, accessed on 20 November 2022), utilizing knowledge reasoning. This ontology-based cybersecurity framework is separated in three layers, i.e., the design time, the run time, and the integration layer used by the two others. In the first layer, existing security services are reused, in order for the user to implement security mechanisms according to the needs of the network environment. In the second layer, monitoring mechanisms gather security alerts from other security tools (firewalls, vulnerability scanners, etc.) and each security alert/incident is evaluated to discover effective solutions to improve or recover, this specific time, the network system. The third layer provides cybersecurity information by deriving information from pre-build cybersecurity services from IoTsec ontology. By implementing the proposed method in a realistic scenario (Wi-Fi vulnerabilities), the ontology identified a service (WPA2--Wi-Fi Protected Access protocol) and proposed specific solutions, based on the SPARQL query. The main issue remained the uncertainty of cybersecurity attacks (\"zero-day\" attacks), which allow adversaries to stay undetected. Real-time security should be preceded by interoperability, especially security updates, because even \"zero-day\" attacks become useless when an operating system is patched (updated to a more secure version); in fact, according to the Ponemon Institute, 80% of successful breaches are due to zero-day vulnerabilities [66]. Implementing semantics related to security patterns [79], and automating the classification of threats and vulnerabilities, as well as countering these attacks via semantic modeling, support the foundation of a robust cybersecurity system.