Project overview

The project 'Ontology-Driven OSINT Attribution from Dark Web and Breach Sources' focused on improving cyber threat intelligence through formal knowledge representation. It involved work related to an OWL 2 DL ontology developed in collaboration with Cyber Defence Service Ltd, designed to model infostealer malware artefacts including stolen credentials, system profiles, and domain detects, and to support automated victim attribution.

The project involved two distinct pieces of research. Firstly, it assessed existing CTI frameworks and cybersecurity ontologies to identify gaps in their coverage of infostealer log data, finding that no existing schema formally models the artefacts produced by credential-stealing malware. Secondly, the project designed and evaluated a reasoning pipeline that applies formal SWRL rules to automatically classify victims by financial exposure and endpoint protection level, demonstrated on a synthetic dataset in compliance with ethics approval requirements.