Crii: satc: automated knowledge representation for IOT cybersecurity regulations

This Project Grant award from the National Science Foundation's (NSF) Computer and Information Science and Engineering (CISE) program supports research to develop a novel technique for automating the extraction and mapping of cybersecurity regulations and standards for Internet of Things (IoT) devices.

The $170,062 award to Texas A&M University-Central Texas will fund the creation of semantically-rich ontologies to store knowledge extracted from IoT cybersecurity laws, NIST standards, and other regulatory documents. This will allow organizations to quickly crosscheck and update their IoT privacy policy documents against the applicable rules and standards. Additionally, the project will publish knowledge graphs to enable IoT manufacturers and users to easily identify the regulations a company follows or is missing. This work aims to streamline compliance checking for IoT cybersecurity without human intervention.

Abstract

Regulatory authorities worldwide are developing cybersecurity standards for security and data protection regulations to protect users' information. To protect the privacy and security of data that passes through the internet of things (IOT), vendors must adhere to the many cybersecurity IOT standards and regulations. Due to the growing number of smart devices in many domains, sensitive data is a significant consideration for cybersecurity. All the authority documents for the cybersecurity of IOT devices have complex rules and guidelines. Companies often need assistance understanding and listing the relevant regulations in privacy policies. This project focuses on only USA cybersecurity IOT laws, data protection regulations, and national institute of standards and technology (NIST) standards. The project develops a novel technique to extract knowledge from a vast database of IOT laws and create semantically rich ontology mappings for storing the extracted knowledge from regulatory IOT cybersecurity compliance and privacy policies to quickly crosscheck and update the applicable rules in privacy policy documents using suitable concepts from semantic web technologies. The ontologies will have rules from authority documents like relevant laws, NIST standards, and regulations. Additionally, the project provides a medium by publishing knowledge graphs for IOT manufacturers and users to know which standards or regulations a company follows and those that are missing without reading the privacy policy or IOT authority documents. Furthermore, the project approach will enable organizations to quickly query the knowledge graphs using sparql protocol and RDF query language (sparql) and correct their policy documents. Overall, with this novel research, without human intervention, checking for IOT cybersecurity compliance can happen quickly, and results are sufficiently structured to check for any applicable authority rules and abide by them. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the foundation's intellectual merit and broader impacts review criteria.- subawards are not planned for this award.