Ontology Based Risk Management

Abstract

Risk management in several application domains is receiving increasing attention in the last years especially when the risk management must be pursued in a network made of interacting systems. The motivation is that although risk management models and techniques are mature enough to handle risk in the context of a single system, risk evaluation in the setting of a network of systems is much more difficult to model and manage. Because of the lack of awareness of risk, it is difficult to perceive risks propagation within the network of systems. On the other hand, the lack of shared goals and knowledge represents itself a risk, so that we need a good paradigm to organize and communicate information.\ud \ud In this paper we first introduce a metamodel able to represent the fundamental structure from which distributed risk management models can be derived with respect to several application domains. This abstraction arises from an approach to risk management based on the definition of risk ontologies. A risk ontology is specialized to represent and share risk knowledge in a given application domain; changing the underlying ontology, the metamodel can be adapted to a new application domain so that the logic for risk management can be reused with a reasonable tailoring effort.\ud \ud Two case studies are discussed in the paper as possible implementation of risk management systems based on the proposed metamodel

Information Security Risk Assessment

“…Another approach that can simplify and speed up the process of risk assessment is using ontology-based modeling [43][44][45][46][47]. This approach uses semantic elements defined during risk analysis and provides an easy way of duplicating the data once the object or process has been described.…”

Ontology Learning for Systems Engineering Body of Knowledge

“…The study verifies that project risk ontologies can be developed by acquiring tacit knowledge and extracting explicit knowledge from the organization. Nota et al (2010) develop a risk ontology whose aim is to capture the fundamental concepts of risk management together with a formal specification of rules to qualify operational aspects of risk management. Also, Sales et al (2018) carry out an in-depth ontological analysis on the nature of risk and unclear notions in performing risk analysis under the principles of UFO.…”