CYBERNER SEMANTIC METAMODEL AS AN INTERMEDIATE LAYER FOR GEOSPATIAL DATA TRANSFORMATION IN CYBERSECURITY SYSTEMS

Abstract

Modern cybersecurity systems process data from heterogeneous sources, a significant part of which carries geospatial information such as IP address geolocation, geographic coordinates, hostnames, data center identifiers, cloud regions and location data of users and assets. Because widely used schemas – the Elastic Common Schema (ECS), Structured Threat Information Expression (STIX) and the Open Cybersecurity
Schema Framework (OCSF) – represent this information in different ways, transformations between them often lead to the loss of semantic context. The article presents a conceptual approach in which the CyberNER semantic metamodel acts as an intermediate layer supporting the transformation of geospatial data between heterogeneous cybersecurity schemas. CyberNER is not another target schema, but an M2-level metamodel based on entities, semantic roles, relationships, attributes and contexts, in which the geospatial layer is a specialization of the semantic core rather than an autonomous domain model. The proposed approach is illustrated with a proof-of-concept transformation example and is expected to increase the completeness and fidelity of the semantic transformation of geospatial data and to reduce information loss in relation to direct transformations based solely on field mapping. The study is conceptual and methodological in character; its main limitation is the lack of large-scale quantitative validation, which is indicated as the direction of further research.