Threat-Actor Ontology
Eleven threat actors, their ATT&CK techniques, malware and target sectors — written as a tiny ontology and run through the open-source Open Ontologies reasoner. The engine classifies every actor, then shows the blast radius of adding one new rule, with a consistency verdict. It is not a drawn graph; the consequences are computed.
Declare that any actor which encrypts data for impact (ATT&CK T1486) is, by definition, a ransomware operator — then ask the engine who that now covers.
RansomwareOperator ≡ ∃ usesTechnique.{T1486}Facts the engine derived — nobody wrote these down
The schema says anything that usesTechnique is a ThreatActor (the property's domain). The reasoner applied that to every actor automatically. These are reasoned − asserted: 11 triples (owl-rl).
Frequently asked questions
Is the Threat-Actor Ontology just a drawing?
No. The entities and relationships are curated from public sources (MITRE ATT&CK (technique IDs)), but the consequences are computed by the open-source Open Ontologies reasoning engine, not drawn by hand. The engine-derived panel lists exactly the facts the reasoner added on top of what was written down (143 reasoned minus 132 asserted triples), and the proposed-rule panel is the engine answering an OWL-DL query with a consistency verdict for the whole ontology.
What does "blast radius" mean here?
We add one new rule of intent and ask the reasoner what changes. Here the rule is: Declare that any actor which encrypts data for impact (ATT&CK T1486) is, by definition, a ransomware operator — then ask the engine who that now covers. The engine (owl-dl, description logic SHIQ) returns exactly which entities are reclassified (4 here) and confirms the ontology stays logically consistent. You change a rule; the machine, not a person, works out every consequence.
What is Open Ontologies?
Open Ontologies (github.com/fabio-rovai/open-ontologies, MIT-licensed) is an open-source reasoning engine described as "Terraform for knowledge graphs." It loads RDF/Turtle, runs OWL-RL and OWL-DL reasoning over an in-memory triple store, answers SPARQL, and can produce checkable certificates for its conclusions. PlayCISO ships only the captured output it produces; the engine is not a runtime dependency.