Skip to content

Commit ac83ccc

Browse files
plbt5plbt5
authored
Merge pull request #152 from casework/UCO-Feature-Issue-651-spear_phishing
UCO Issue 651: Use time-aligning concepts in Spear Phishing example
2 parents 4271f2e + 96aaa0d commit ac83ccc

8 files changed

+199
-532
lines changed

‎examples/illustrations/spear_phishing/drafting.ttl‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
1+
@prefix drafting: <http://example.org/ontology/drafting/> .
12
@prefix ep: <http://www.semanticweb.org/OpenCyberSecurityAlliance/Ontology/EndpointProtection/> .
23
@prefix owl: <http://www.w3.org/2002/07/owl#> .
34
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
45
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
56
@prefix sh: <http://www.w3.org/ns/shacl#> .
7+
@prefix time: <http://www.w3.org/2006/time#> .
68
@prefix uco-core: <https://ontology.unifiedcyberontology.org/uco/core/> .
79
@prefix unmapped: <urn:example:unmapped/> .
810
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@@ -12,6 +14,17 @@ uco-core:UcoThing-identifier-regex-shape
1214
sh:deactivated "true"^^xsd:boolean ;
1315
.
1416

17+
drafting:Perdurant
18+
a owl:Class ;
19+
rdfs:subClassOf uco-core:UcoObject ;
20+
rdfs:isDefinedBy <https://github.com/ucoProject/UCO/issues/544> ;
21+
.
22+
23+
drafting:intervalIn
24+
a owl:ObjectProperty ;
25+
rdfs:isDefinedBy <https://github.com/ucoProject/UCO/issues/651> ;
26+
.
27+
1528
ep:bearerOf-shape
1629
a sh:PropertyShape ;
1730
sh:message "This property is unmapped and intended to be replaced."@en ;
@@ -107,8 +120,7 @@ ep:intervalIn-shape
107120
sh:message "This property is unmapped and intended to be replaced."@en ;
108121
sh:maxCount 0 ;
109122
sh:path unmapped:intervalIn ;
110-
sh:severity sh:Info ;
111-
sh:targetClass uco-core:UcoThing ;
123+
sh:targetSubjectsOf unmapped:intervalIn ;
112124
.
113125

114126
ep:isCarrierOf-shape
@@ -194,3 +206,8 @@ ep:uses-shape
194206
sh:targetClass uco-core:UcoThing ;
195207
.
196208

209+
time:Interval
210+
a owl:Class ;
211+
rdfs:isDefinedBy time:2016 ;
212+
.
213+

‎examples/illustrations/spear_phishing/spear_phishing.json‎

Lines changed: 105 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"@context": {
3+
"drafting": "http://example.org/ontology/drafting/",
34
"kb": "http://www.semanticweb.org/OpenCyberSecurityAlliance/Ontology/EndpointProtection/",
45
"owl": "http://www.w3.org/2002/07/owl#",
56
"rdf": "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
67
"rdfs": "http://www.w3.org/2000/01/rdf-schema#",
8+
"time": "http://www.w3.org/2006/time#",
79
"uco-action": "https://ontology.unifiedcyberontology.org/uco/action/",
810
"uco-core": "https://ontology.unifiedcyberontology.org/uco/core/",
911
"uco-identity": "https://ontology.unifiedcyberontology.org/uco/identity/",
@@ -23,26 +25,26 @@
2325
},
2426
{
2527
"@id": "kb:ActOfMalwareDelivery01",
26-
"@type": "uco-observable:ObservableAction",
28+
"@type": "kb:ObservableAction",
2729
"unmapped:precedes": {
2830
"@id": "kb:ActOfMalwareInstallation01"
2931
}
3032
},
3133
{
3234
"@id": "kb:ActOfMalwareInstallation01",
33-
"@type": "uco-observable:ObservableAction"
35+
"@type": "kb:ObservableAction"
3436
},
3537
{
3638
"@id": "kb:ActOfNetworkLogin01",
37-
"@type": "uco-observable:ObservableAction",
39+
"@type": "kb:ObservableAction",
3840
"uco-action:endTime": {
3941
"@type": "xsd:dateTime",
4042
"@value": "2021-09-02T07:32:16.411Z"
4143
}
4244
},
4345
{
4446
"@id": "kb:ActOfNetworkLogout01",
45-
"@type": "uco-observable:ObservableAction",
47+
"@type": "kb:ObservableAction",
4648
"uco-action:endTime": {
4749
"@type": "xsd:dateTime",
4850
"@value": "2021-09-02T11:07:30.658Z"
@@ -55,18 +57,18 @@
5557
},
5658
{
5759
"@id": "kb:ActOfEmailDelivery01",
58-
"@type": "uco-observable:ObservableAction",
60+
"@type": "kb:ObservableAction",
5961
"unmapped:precedes": {
6062
"@id": "kb:ActOfLinkOpening01"
6163
}
6264
},
6365
{
6466
"@id": "kb:ActOfLinkOpening01",
65-
"@type": "uco-observable:ObservableAction"
67+
"@type": "kb:ObservableAction"
6668
},
6769
{
6870
"@id": "kb:ActOfSending02",
69-
"@type": "uco-observable:ObservableAction"
71+
"@type": "kb:ObservableAction"
7072
},
7173
{
7274
"@id": "kb:Agent01",
@@ -263,7 +265,7 @@
263265
},
264266
{
265267
"@id": "kb:DetectionEvent01",
266-
"@type": "uco-core:Event",
268+
"@type": "kb:Event",
267269
"unmapped:hasOccurrentPart": [
268270
{
269271
"@id": "kb:ActOfSending02"
@@ -275,7 +277,7 @@
275277
"@id": "kb:ActOfFileFlagging01"
276278
}
277279
],
278-
"unmapped:intervalIn": {
280+
"drafting:intervalIn": {
279281
"@id": "kb:TemporalInterval03"
280282
}
281283
},
@@ -350,21 +352,21 @@
350352
},
351353
{
352354
"@id": "kb:ActOfEndpointScan01",
353-
"@type": "uco-observable:ObservableAction",
355+
"@type": "kb:ObservableAction",
354356
"unmapped:precedes": {
355357
"@id": "kb:ActOfFileFlagging01"
356358
}
357359
},
358360
{
359361
"@id": "kb:ActOfFileFlagging01",
360-
"@type": "uco-observable:ObservableAction",
362+
"@type": "kb:ObservableAction",
361363
"unmapped:hasOutput": {
362364
"@id": "kb:Alert01"
363365
}
364366
},
365367
{
366368
"@id": "kb:InfectionEvent01",
367-
"@type": "uco-core:Event",
369+
"@type": "kb:Event",
368370
"unmapped:hasOccurrentPart": [
369371
{
370372
"@id": "kb:ActOfMalwareDelivery01"
@@ -373,7 +375,7 @@
373375
"@id": "kb:ActOfMalwareInstallation01"
374376
}
375377
],
376-
"unmapped:intervalIn": {
378+
"drafting:intervalIn": {
377379
"@id": "kb:TemporalInterval02"
378380
},
379381
"unmapped:precedes": {
@@ -448,7 +450,7 @@
448450
},
449451
{
450452
"@id": "kb:SpearFishingEvent01",
451-
"@type": "uco-core:Event",
453+
"@type": "kb:Event",
452454
"unmapped:hasOccurrentPart": [
453455
{
454456
"@id": "kb:ActOfEmailDelivery01"
@@ -457,7 +459,7 @@
457459
"@id": "kb:ActOfLinkOpening01"
458460
}
459461
],
460-
"unmapped:intervalIn": {
462+
"drafting:intervalIn": {
461463
"@id": "kb:TemporalInterval01"
462464
},
463465
"unmapped:precedes": {
@@ -486,15 +488,15 @@
486488
},
487489
{
488490
"@id": "kb:TemporalInterval01",
489-
"@type": "uco-core:UcoThing"
491+
"@type": "kb:TemporalInterval"
490492
},
491493
{
492494
"@id": "kb:TemporalInterval02",
493-
"@type": "uco-core:UcoThing"
495+
"@type": "kb:TemporalInterval"
494496
},
495497
{
496498
"@id": "kb:TemporalInterval03",
497-
"@type": "uco-core:UcoThing"
499+
"@type": "kb:TemporalInterval"
498500
},
499501
{
500502
"@id": "kb:ThreatActorRole01",
@@ -706,7 +708,7 @@
706708
},
707709
{
708710
"@id": "kb:observable-action-295ce323-3284-402c-a320-e8fc4c04f835",
709-
"@type": "uco-observable:ObservableAction",
711+
"@type": "kb:ObservableAction",
710712
"uco-action:object": {
711713
"@id": "kb:email-message-4a81644f-04ad-4d79-8159-a963ddd2fb58"
712714
},
@@ -722,7 +724,7 @@
722724
},
723725
{
724726
"@id": "kb:observable-action-7522ac48-586f-4fba-84b4-b409d042658c",
725-
"@type": "uco-observable:ObservableAction",
727+
"@type": "kb:ObservableAction",
726728
"uco-action:environment": {
727729
"@id": "kb:windows-process-b2afcc1c-2f41-4b4d-8c8f-b74d4b7ec22c"
728730
},
@@ -735,7 +737,7 @@
735737
},
736738
{
737739
"@id": "kb:observable-action-abfeee80-d2b7-451a-91b5-e753798ca4c6",
738-
"@type": "uco-observable:ObservableAction",
740+
"@type": "kb:ObservableAction",
739741
"uco-action:environment": {
740742
"@id": "kb:windows-process-b2afcc1c-2f41-4b4d-8c8f-b74d4b7ec22c"
741743
},
@@ -912,6 +914,84 @@
912914
],
913915
"uco-core:description": "Browser process"
914916
},
917+
{
918+
"@id": "kb:TemporalInterval",
919+
"@type": "owl:Class",
920+
"rdfs:seeAlso": {
921+
"@id": "https://github.com/ucoProject/UCO/issues/651"
922+
},
923+
"rdfs:subClassOf": [
924+
{
925+
"@id": "drafting:Perdurant"
926+
},
927+
{
928+
"@id": "time:Interval"
929+
}
930+
]
931+
},
932+
{
933+
"@id": "kb:Action",
934+
"@type": "owl:Class",
935+
"rdfs:comment": "This class is a temporary class to align concepts for UCO Issues 544 and 651.",
936+
"rdfs:seeAlso": [
937+
{
938+
"@id": "https://github.com/ucoProject/UCO/issues/544"
939+
},
940+
{
941+
"@id": "https://github.com/ucoProject/UCO/issues/651"
942+
}
943+
],
944+
"rdfs:subClassOf": [
945+
{
946+
"@id": "drafting:Perdurant"
947+
},
948+
{
949+
"@id": "uco-action:Action"
950+
}
951+
]
952+
},
953+
{
954+
"@id": "kb:Event",
955+
"@type": "owl:Class",
956+
"rdfs:comment": "This class is a temporary class to align concepts for UCO Issues 544 and 651.",
957+
"rdfs:seeAlso": [
958+
{
959+
"@id": "https://github.com/ucoProject/UCO/issues/544"
960+
},
961+
{
962+
"@id": "https://github.com/ucoProject/UCO/issues/651"
963+
}
964+
],
965+
"rdfs:subClassOf": [
966+
{
967+
"@id": "drafting:Perdurant"
968+
},
969+
{
970+
"@id": "uco-core:Event"
971+
}
972+
]
973+
},
974+
{
975+
"@id": "kb:ObservableAction",
976+
"@type": "owl:Class",
977+
"rdfs:comment": "This class is a temporary class to align concepts for UCO Issues 544 and 651.",
978+
"rdfs:seeAlso": [
979+
{
980+
"@id": "https://github.com/ucoProject/UCO/issues/544"
981+
},
982+
{
983+
"@id": "https://github.com/ucoProject/UCO/issues/651"
984+
}
985+
],
986+
"rdfs:subClassOf": [
987+
{
988+
"@id": "kb:Action"
989+
},
990+
{
991+
"@id": "uco-observable:ObservableAction"
992+
}
993+
]
994+
},
915995
{
916996
"@id": "unmapped:bearerOf",
917997
"@type": "owl:ObjectProperty"
@@ -955,11 +1035,10 @@
9551035
},
9561036
{
9571037
"@id": "unmapped:intervalIn",
958-
"@type": "owl:ObjectProperty",
959-
"rdfs:comment": "Property name not in drafted documentation; borrowed from W3C Time Ontology.",
960-
"rdfs:seeAlso": {
961-
"@id": "https://www.w3.org/TR/owl-time/#time:intervalIn"
962-
}
1038+
"@type": [
1039+
"owl:DeprecatedProperty",
1040+
"owl:ObjectProperty"
1041+
]
9631042
},
9641043
{
9651044
"@id": "unmapped:isCarrierOf",

0 commit comments

Comments
 (0)