Onto-by-wire: Bridging the knowledge gap between avionics and cybersecurity through ontology

Collaboration between stakeholders is one of the current challenges facing cyberattacks in the avionics sector. Our goal is to propose ontologies as a viable solution to address this need among subsystems connecting heterogeneous providers, thereby contributing to the enhancement of system standardization and interoperability.The ARINC 429 bus standard raises concerns due to its lack of authentication, creating a plausible avenue for an adversary to engage in deceptive communication. We develop the ontology onto-by-429, created to provide avionics stakeholders with a comprehensive knowledge model of ARINC 429. It is combined with well-established ontologies such as NASA’s ATMONTO and MITRE D3FEND, bridging the domains of security, air traffic management (ATM), and ARINC 429. It results in a cross-disciplinary ontology known as onto-by-wire.Within the MITRE ATT&CK framework, we assess two distinct cyberattack scenarios, addressing concerns related to spoofing and denial-of-service (DoS) attacks. By giving a question to our Anomaly Explanation Engine (AEE) via a SPARQL request, its responses provide comprehensive anomaly explanations that facilitate error detection and establish a repository of traceable attack explanationOntology’s efficiency is evaluated using three simulated test cases: a rogue radiometer, a tampered Electronic Flight Bag (EFB), and a rogue autopilot. Our prototype is distinct from previous avionics attack taxonomies, establishes a knowledge base and employs the SAMOD agile methodology to build the ontology.Our logical rules pass consistency evaluations made by Pellet, a practical OWL-DL reasoner, during all three iteration processes. Three relevant competency questions, proposed by domain experts, are answered, providing anomaly elucidation to inform a pilot, a maintenance worker, or an Intrusion Detection Systems (IDS) developer of an attack, while offering cybersecurity countermeasure components and capabilities from MITRE D3FEND.