Bridging the semantic gap in cybersecurity: a homonym-aware ontology platform
Our A* paper at the ACM Web Conference 2026 proposes a living, wiki-style cybersecurity ontology that links security goals to attacks, vulnerabilities and assets, and tells a computer virus from a biological one.
On this page
Cybersecurity has a vocabulary problem. Compliance teams speak the language of standards such as ISO 27001 and NIST SP 800-53. Analysts speak the language of threats, exploits and vulnerabilities. Executives speak the language of goals: keep customer data confidential, keep services available. The same organisation can hold all three conversations at once without ever connecting them.
Our paper at the Companion Proceedings of the ACM Web Conference 2026, an A* ranked conference, sets out a way to close that gap. I wrote it with Ljiljana Brankovic, Cesar Sanin and David Paul, and it is open access.
Two gaps, not one
The paper starts from two disconnects.
- Standards and operations. Compliance standards are static documents, while threat detection is a moving, operational reality.
- Goals and root causes. High-level security services, such as confidentiality, are rarely linked to the low-level technical causes that threaten them, such as a buffer overflow vulnerability.
Our earlier systematic literature review found many existing cybersecurity ontologies. What it did not find was a dynamic, interoperable platform that keeps these layers connected and lets a community of experts evaluate and improve the mappings over time.
The golden chain
At the heart of the work is a chain of knowledge identified in the review:
Security services → security mechanisms → attacks → vulnerabilities → attackers → assets
Following the chain answers both the “how” and the “why” of a control: which mechanism delivers which security service, which attacks it stops, which vulnerabilities those attacks exploit, who the attackers are, and which assets are at stake.
Three technical contributions
The prototype is a wiki-style, homonym-aware editing platform with management and visualisation tools. It rests on three ideas.
- A concept-term separated architecture. Concepts and the words used for them are stored separately, so the platform can handle synonyms (many words, one concept) and homonyms (one word, many concepts).
- An additive seeder engine. New knowledge is added systematically while preserving what distributed contributors have already built.
- A hybrid contribution model. Batch imports from CSV and JSON sit alongside granular, web-based review by experts.
What the evaluation showed
We unified concepts from several sources, including NIST, MITRE, ISO and CyBOK, into a single, graph-ready knowledge base. The results show that this “living” ontology can interpret homonyms correctly, for example treating “virus” as malware rather than a pathogen, and that it supports knowledge retrieval across domains.
Why it matters
A shared, evolving vocabulary is a precondition for automation. Security tools, compliance reporting and AI assistants all work better when “the thing the standard asks for” and “the thing the analyst sees” are explicitly connected. This platform is a step towards that shared map.
The full paper is available through the DOI below.
Sources and further reading
- Bridging the Semantic Gap: A Homonym-Aware Ontology Platform for Cybersecurity Interoperability, Companion Proceedings of the ACM Web Conference 2026, pp. 242-250
- A Systematic Literature Review on Cybersecurity Ontology, Procedia Computer Science 270 (KES 2025), pp. 3598-3607