CRII: SaTC: Automated Knowledge Representation for IoT Cybersecurity Regulations

世界各地的监管机构正在制定网络安全标准和数据保护法规，以保护用户的信息。为了保护通过物联网(IoT)的数据的隐私和安全，供应商必须遵守许多网络安全IoT标准和法规。由于许多领域的智能设备数量不断增加，敏感数据是网络安全的重要考虑因素。物联网设备网络安全的所有权威文件都有复杂的规则和指导方针。公司经常需要帮助理解和列出隐私政策中的相关法规。该项目仅关注美国网络安全物联网法律、数据保护法规和国家标准与技术研究所(NIST)标准。该项目开发了一种新技术，可以从海量的物联网法律数据库中提取知识，并创建语义丰富的本体映射，用于存储从监管的物联网网络安全合规性和隐私政策中提取的知识，以便使用语义网技术中的适当概念快速交叉检查和更新隐私政策文档中的适用规则。本体论将拥有来自相关法律、NIST标准和法规等权威文档的规则。此外，该项目通过发布知识图表为物联网制造商和用户提供了一种媒介，使他们无需阅读隐私政策或物联网权威文件，即可了解公司遵循的标准或法规以及缺失的标准或法规。此外，项目方法将使组织能够使用SPARQL协议和RDF查询语言(SPARQL)快速查询知识图，并更正其政策文档。总体而言，有了这项新颖的研究，在没有人为干预的情况下，检查物联网网络安全合规性可以快速进行，结果结构充分，可以检查并遵守任何适用的权威规则。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Regulatory authorities worldwide are developing cybersecurity standards for security and data protection regulations to protect users' information. To protect the privacy and security of data that passes through the Internet of Things (IoT), vendors must adhere to the many cybersecurity IoT standards and regulations. Due to the growing number of smart devices in many domains, sensitive data is a significant consideration for cybersecurity. All the authority documents for the cybersecurity of IoT devices have complex rules and guidelines. Companies often need assistance understanding and listing the relevant regulations in privacy policies. This project focuses on only USA cybersecurity IoT laws, Data Protection Regulations, and National Institute of Standards and Technology (NIST) standards. The project develops a novel technique to extract knowledge from a vast database of IoT laws and create semantically rich ontology mappings for storing the extracted knowledge from regulatory IoT Cybersecurity Compliance and privacy policies to quickly crosscheck and update the applicable rules in privacy policy documents using suitable concepts from Semantic Web technologies. The ontologies will have rules from authority documents like relevant laws, NIST standards, and regulations. Additionally, the project provides a medium by publishing knowledge graphs for IoT manufacturers and users to know which standards or regulations a company follows and those that are missing without reading the privacy policy or IoT authority documents. Furthermore, the project approach will enable organizations to quickly query the knowledge graphs using SPARQL Protocol and RDF Query Language (SPARQL) and correct their policy documents. Overall, with this novel research, without human intervention, checking for IoT cybersecurity compliance can happen quickly, and results are sufficiently structured to check for any applicable authority rules and abide by them.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.