Unified Cyber Ontology (UCO)

What it is Unified Cyber Ontology (UCO) is a community-developed ontology/model intended to provide a consistent foundation for standardized information representation across the cyber-security ecosystem. Cyber-investigation, defense, threat-intelligence, malware, vulnerability-research, and offensive-operation representations can be defined as suitable subsets of its constructs.

Key concepts Shared cyber-domain foundation; subdomain-specific subsets; standardized representation; shared APIs; automated information flow across subdomain boundaries; community governance and versioned releases.

How you’d use it Base a cyber-security subdomain model on the relevant UCO constructs so that its representation remains consistent with other subdomains and can participate in shared APIs and automated information exchange.

LLM angle none stated

Pitfalls & lessons Subdomain representations should be scoped as appropriate subsets rather than treated as isolated models; the site emphasizes broader community involvement in deciding both what to represent and how.

Verdict A useful shared semantic foundation for cyber-security models whose main value is consistency and information flow across otherwise separate operational subdomains.

Sources consulted

• https://unifiedcyberontology.org/