Toward a Unified View of Cybersecurity Ontologies: A Systematic Review and Conceptual Consolidation

The dynamic and complex nature of the cybersecurity domain necessitates robust tools and frameworks to manage and mitigate security risks effectively. Security ontologies, serving as structured artefacts, play a pivotal role in standardizing domain concepts and relationships, thus enabling the development of advanced tools for addressing security issues. Despite the proliferation of various security ontologies that focus on diverse aspects and conceptual levels, there is a lack of clarity regarding their differences and specific applications. This ambiguity complicates the task of selecting and utilizing the most appropriate ontology for specific security tasks. This study aims to systematically classify existing security ontologies and extract their main concepts and relationships to provide a structured analysis. The classification will serve as a foundational step towards developing a unified security ontology, which will integrate the essential elements from the reviewed ontologies into a comprehensive framework that addresses the broader needs of cybersecurity. Through a meticulous literature review, we examine existing security ontologies, highlighting their scope, focus, and the level of detail they provide. Our research diverges from traditional reviews as we not only catalog these ontologies but also aim to harmonize them into a cohesive framework. % \textbf{Results:} This unified ontology seeks to clarify the included concepts and relationships, classifying them according to a rigorously developed framework. The ultimate goal of this work is to facilitate a clearer understanding and application of security ontologies, thereby enhancing the interoperability and effectiveness of security measures across various platforms and environments. This paper contributes to the field by offering a pathway towards a standardized, comprehensive ontology that can serve as a cornerstone for future developments in cybersecurity management and research.