Skip to content

UCO Issue 651: Use time-aligning concepts in Spear Phishing example #152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Mar 21, 2025
Merged

UCO Issue 651: Use time-aligning concepts in Spear Phishing example #152

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f04d449
Spear Phishing: Map unmapped concepts TemporalInterval and intervalIn
ajnelson-nist Mar 20, 2025
5cdd38c
Regenerate Make-managed files
ajnelson-nist Mar 20, 2025
c92ec61
Add example-specific classes to align Perdurant and time mapping
ajnelson-nist Mar 21, 2025
96aaa0d
Regenerate Make-managed files
ajnelson-nist Mar 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions examples/illustrations/spear_phishing/drafting.ttl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
@prefix drafting: <http://example.org/ontology/drafting/> .
@prefix ep: <http://www.semanticweb.org/OpenCyberSecurityAlliance/Ontology/EndpointProtection/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix time: <http://www.w3.org/2006/time#> .
@prefix uco-core: <https://ontology.unifiedcyberontology.org/uco/core/> .
@prefix unmapped: <urn:example:unmapped/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
Expand All @@ -12,6 +14,17 @@ uco-core:UcoThing-identifier-regex-shape
sh:deactivated "true"^^xsd:boolean ;
.

drafting:Perdurant
a owl:Class ;
rdfs:subClassOf uco-core:UcoObject ;
rdfs:isDefinedBy <https://github.com/ucoProject/UCO/issues/544> ;
.

drafting:intervalIn
a owl:ObjectProperty ;
rdfs:isDefinedBy <https://github.com/ucoProject/UCO/issues/651> ;
.

ep:bearerOf-shape
a sh:PropertyShape ;
sh:message "This property is unmapped and intended to be replaced."@en ;
Expand Down Expand Up @@ -107,8 +120,7 @@ ep:intervalIn-shape
sh:message "This property is unmapped and intended to be replaced."@en ;
sh:maxCount 0 ;
sh:path unmapped:intervalIn ;
sh:severity sh:Info ;
sh:targetClass uco-core:UcoThing ;
sh:targetSubjectsOf unmapped:intervalIn ;
.

ep:isCarrierOf-shape
Expand Down Expand Up @@ -194,3 +206,8 @@ ep:uses-shape
sh:targetClass uco-core:UcoThing ;
.

time:Interval
a owl:Class ;
rdfs:isDefinedBy time:2016 ;
.

131 changes: 105 additions & 26 deletions examples/illustrations/spear_phishing/spear_phishing.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,11 @@
{
"@context": {
"drafting": "http://example.org/ontology/drafting/",
"kb": "http://www.semanticweb.org/OpenCyberSecurityAlliance/Ontology/EndpointProtection/",
"owl": "http://www.w3.org/2002/07/owl#",
"rdf": "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
"rdfs": "http://www.w3.org/2000/01/rdf-schema#",
"time": "http://www.w3.org/2006/time#",
"uco-action": "https://ontology.unifiedcyberontology.org/uco/action/",
"uco-core": "https://ontology.unifiedcyberontology.org/uco/core/",
"uco-identity": "https://ontology.unifiedcyberontology.org/uco/identity/",
Expand All @@ -23,26 +25,26 @@
},
{
"@id": "kb:ActOfMalwareDelivery01",
"@type": "uco-observable:ObservableAction",
"@type": "kb:ObservableAction",
"unmapped:precedes": {
"@id": "kb:ActOfMalwareInstallation01"
}
},
{
"@id": "kb:ActOfMalwareInstallation01",
"@type": "uco-observable:ObservableAction"
"@type": "kb:ObservableAction"
},
{
"@id": "kb:ActOfNetworkLogin01",
"@type": "uco-observable:ObservableAction",
"@type": "kb:ObservableAction",
"uco-action:endTime": {
"@type": "xsd:dateTime",
"@value": "2021-09-02T07:32:16.411Z"
}
},
{
"@id": "kb:ActOfNetworkLogout01",
"@type": "uco-observable:ObservableAction",
"@type": "kb:ObservableAction",
"uco-action:endTime": {
"@type": "xsd:dateTime",
"@value": "2021-09-02T11:07:30.658Z"
Expand All @@ -55,18 +57,18 @@
},
{
"@id": "kb:ActOfEmailDelivery01",
"@type": "uco-observable:ObservableAction",
"@type": "kb:ObservableAction",
"unmapped:precedes": {
"@id": "kb:ActOfLinkOpening01"
}
},
{
"@id": "kb:ActOfLinkOpening01",
"@type": "uco-observable:ObservableAction"
"@type": "kb:ObservableAction"
},
{
"@id": "kb:ActOfSending02",
"@type": "uco-observable:ObservableAction"
"@type": "kb:ObservableAction"
},
{
"@id": "kb:Agent01",
Expand Down Expand Up @@ -263,7 +265,7 @@
},
{
"@id": "kb:DetectionEvent01",
"@type": "uco-core:Event",
"@type": "kb:Event",
"unmapped:hasOccurrentPart": [
{
"@id": "kb:ActOfSending02"
Expand All @@ -275,7 +277,7 @@
"@id": "kb:ActOfFileFlagging01"
}
],
"unmapped:intervalIn": {
"drafting:intervalIn": {
"@id": "kb:TemporalInterval03"
}
},
Expand Down Expand Up @@ -350,21 +352,21 @@
},
{
"@id": "kb:ActOfEndpointScan01",
"@type": "uco-observable:ObservableAction",
"@type": "kb:ObservableAction",
"unmapped:precedes": {
"@id": "kb:ActOfFileFlagging01"
}
},
{
"@id": "kb:ActOfFileFlagging01",
"@type": "uco-observable:ObservableAction",
"@type": "kb:ObservableAction",
"unmapped:hasOutput": {
"@id": "kb:Alert01"
}
},
{
"@id": "kb:InfectionEvent01",
"@type": "uco-core:Event",
"@type": "kb:Event",
"unmapped:hasOccurrentPart": [
{
"@id": "kb:ActOfMalwareDelivery01"
Expand All @@ -373,7 +375,7 @@
"@id": "kb:ActOfMalwareInstallation01"
}
],
"unmapped:intervalIn": {
"drafting:intervalIn": {
"@id": "kb:TemporalInterval02"
},
"unmapped:precedes": {
Expand Down Expand Up @@ -448,7 +450,7 @@
},
{
"@id": "kb:SpearFishingEvent01",
"@type": "uco-core:Event",
"@type": "kb:Event",
"unmapped:hasOccurrentPart": [
{
"@id": "kb:ActOfEmailDelivery01"
Expand All @@ -457,7 +459,7 @@
"@id": "kb:ActOfLinkOpening01"
}
],
"unmapped:intervalIn": {
"drafting:intervalIn": {
"@id": "kb:TemporalInterval01"
},
"unmapped:precedes": {
Expand Down Expand Up @@ -486,15 +488,15 @@
},
{
"@id": "kb:TemporalInterval01",
"@type": "uco-core:UcoThing"
"@type": "kb:TemporalInterval"
},
{
"@id": "kb:TemporalInterval02",
"@type": "uco-core:UcoThing"
"@type": "kb:TemporalInterval"
},
{
"@id": "kb:TemporalInterval03",
"@type": "uco-core:UcoThing"
"@type": "kb:TemporalInterval"
},
{
"@id": "kb:ThreatActorRole01",
Expand Down Expand Up @@ -706,7 +708,7 @@
},
{
"@id": "kb:observable-action-295ce323-3284-402c-a320-e8fc4c04f835",
"@type": "uco-observable:ObservableAction",
"@type": "kb:ObservableAction",
"uco-action:object": {
"@id": "kb:email-message-4a81644f-04ad-4d79-8159-a963ddd2fb58"
},
Expand All @@ -722,7 +724,7 @@
},
{
"@id": "kb:observable-action-7522ac48-586f-4fba-84b4-b409d042658c",
"@type": "uco-observable:ObservableAction",
"@type": "kb:ObservableAction",
"uco-action:environment": {
"@id": "kb:windows-process-b2afcc1c-2f41-4b4d-8c8f-b74d4b7ec22c"
},
Expand All @@ -735,7 +737,7 @@
},
{
"@id": "kb:observable-action-abfeee80-d2b7-451a-91b5-e753798ca4c6",
"@type": "uco-observable:ObservableAction",
"@type": "kb:ObservableAction",
"uco-action:environment": {
"@id": "kb:windows-process-b2afcc1c-2f41-4b4d-8c8f-b74d4b7ec22c"
},
Expand Down Expand Up @@ -912,6 +914,84 @@
],
"uco-core:description": "Browser process"
},
{
"@id": "kb:TemporalInterval",
"@type": "owl:Class",
"rdfs:seeAlso": {
"@id": "https://github.com/ucoProject/UCO/issues/651"
},
"rdfs:subClassOf": [
{
"@id": "drafting:Perdurant"
},
{
"@id": "time:Interval"
}
]
},
{
"@id": "kb:Action",
"@type": "owl:Class",
"rdfs:comment": "This class is a temporary class to align concepts for UCO Issues 544 and 651.",
"rdfs:seeAlso": [
{
"@id": "https://github.com/ucoProject/UCO/issues/544"
},
{
"@id": "https://github.com/ucoProject/UCO/issues/651"
}
],
"rdfs:subClassOf": [
{
"@id": "drafting:Perdurant"
},
{
"@id": "uco-action:Action"
}
]
},
{
"@id": "kb:Event",
"@type": "owl:Class",
"rdfs:comment": "This class is a temporary class to align concepts for UCO Issues 544 and 651.",
"rdfs:seeAlso": [
{
"@id": "https://github.com/ucoProject/UCO/issues/544"
},
{
"@id": "https://github.com/ucoProject/UCO/issues/651"
}
],
"rdfs:subClassOf": [
{
"@id": "drafting:Perdurant"
},
{
"@id": "uco-core:Event"
}
]
},
{
"@id": "kb:ObservableAction",
"@type": "owl:Class",
"rdfs:comment": "This class is a temporary class to align concepts for UCO Issues 544 and 651.",
"rdfs:seeAlso": [
{
"@id": "https://github.com/ucoProject/UCO/issues/544"
},
{
"@id": "https://github.com/ucoProject/UCO/issues/651"
}
],
"rdfs:subClassOf": [
{
"@id": "kb:Action"
},
{
"@id": "uco-observable:ObservableAction"
}
]
},
{
"@id": "unmapped:bearerOf",
"@type": "owl:ObjectProperty"
Expand Down Expand Up @@ -955,11 +1035,10 @@
},
{
"@id": "unmapped:intervalIn",
"@type": "owl:ObjectProperty",
"rdfs:comment": "Property name not in drafted documentation; borrowed from W3C Time Ontology.",
"rdfs:seeAlso": {
"@id": "https://www.w3.org/TR/owl-time/#time:intervalIn"
}
"@type": [
"owl:DeprecatedProperty",
"owl:ObjectProperty"
]
},
{
"@id": "unmapped:isCarrierOf",
Expand Down
Loading
Loading