CharmingGroot

What Are Taxonomy, Thesaurus, and Ontology?

architecture6 min한국어

Also available in Korean: 택소노미, 시소러스, 온톨로지란?

Taxonomies, thesauri, and ontologies are all ways to organize concepts, so the terms are easy to mix up.
But what each one can express is different.
A thesaurus contains a taxonomy, and an ontology contains a thesaurus.
This post walks through all three using the same example: classifying security threats.

What is a taxonomy?

A taxonomy is a classification that divides concepts by a single parent-child relation.
Classifying security threats gives a tree like this.

Threat Malware Account takeover Ransomware Infostealer Brute force Phishing each child is a kind of its parent
A taxonomy divides concepts into a tree using a single parent-child relation.

Standard classifications in security have the same shape.
OCSF divides security events into categories and classes, and MITRE ATT&CK divides attacks into tactics and techniques.

OCSF category › class Findings 2 Detection Finding 2004 Vulnerability Finding 2002 Identity & Access Mgmt 3 Authentication 3002 MITRE ATT&CK tactic › technique › sub-technique Impact TA0040 Data Encrypted for Impact T1486 Credential Access TA0006 Brute Force T1110 Password Spraying T1110.003
Both standards are taxonomies built on a single parent-child relation. The orange outlines mark items that come back later in this post (the detection result class and the technique ransomware uses). Numbers and codes are the IDs each standard assigns.

OCSF (Open Cybersecurity Schema Framework) is an open schema for which fields a security event carries; it divides events into categories and classes and gives them numeric IDs.

MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on real-world observations.

A taxonomy can express a relation like “ransomware is a kind of malware”, and that is enough for filtering and counting by category.

But the same threat goes by different names in different classification schemes.
OCSF records the malware classification as the numeric code 10 (Ransomware), and ATT&CK records the core behavior of this attack as technique T1486 (Data Encrypted for Impact).
A taxonomy alone cannot express that these are connected to “ransomware”.
Each concept in a taxonomy has only one name.

Taxonomy Ransomware Names in other schemes OCSF 10 = Ransomware ATT&CK T1486 ? ? One name per concept, so other schemes' names cannot be linked
The same threat has different names in different schemes, but a taxonomy has no way to link them. In a thesaurus, mappings such as exactMatch and relatedMatch go here.

What is a thesaurus?

A thesaurus is a taxonomy plus alternative names with the same meaning and related concepts.
The international standard is ISO 25964, and on the web it is written in W3C SKOS.
SKOS records the preferred name (prefLabel), alternative names (altLabel), broader and narrower concepts (broader, narrower), and related concepts (related).

SKOS (Simple Knowledge Organization System) is a W3C standard data model for sharing and linking knowledge organization systems such as thesauri and classification schemes on the web.

The ex:ransomware in the figure and code below is an identifier for the concept “ransomware”.
Separate from the human-readable name (prefLabel), it is a shortened form of a unique address (IRI) that lets machines point to one concept without ambiguity.
The ex: prefix abbreviates an example address such as http://example.org/, so ex:ransomware means http://example.org/ransomware.
In the same way, skos: abbreviates the address of the SKOS vocabulary, and ocsf: and attack: are prefixes this post uses to point to OCSF and ATT&CK values.

ex:ransomware prefLabel "랜섬웨어"@ko, "Ransomware"@en altLabel "Crypto ransomware"@en the same concept under any name Within the same scheme Mappings to other schemes broader broader concept Malware related related concept Data encryption exactMatch transitive OCSF 10 = Ransomware relatedMatch not transitive ATT&CK T1486
Read from ex:ransomware, left to right. The top two rows are relations within the same scheme; the bottom two are mappings to concepts in other schemes. Solid exactMatch means the same concept; dashed relatedMatch means only related.

SKOS can also map between different classification schemes.
Each scheme is kept as its own concept scheme, and correspondences between concepts are written with mapping properties (exactMatch, closeMatch, broadMatch, narrowMatch, relatedMatch).

@prefix skos:   <http://www.w3.org/2004/02/skos/core#> .
@prefix ex:     <http://example.org/> .
@prefix ocsf:   <http://example.org/ocsf/> .
@prefix attack: <http://example.org/attack/> .

# OCSF: malware classification as a numeric code
ocsf:malware-10 a skos:Concept ;
    skos:inScheme  ocsf:malwareClassification ;
    skos:prefLabel "Ransomware"@en ;
    skos:notation  "10" .

# MITRE ATT&CK: attack behavior as a technique
attack:T1486 a skos:Concept ;
    skos:inScheme  attack:techniques ;
    skos:prefLabel "Data Encrypted for Impact"@en ;
    skos:notation  "T1486" .

# Mappings from the reference scheme's "ransomware" to other schemes
ex:ransomware skos:exactMatch   ocsf:malware-10 .
ex:ransomware skos:relatedMatch attack:T1486 .

OCSF and ATT&CK are not published as SKOS.
The code above is an example made to show how to treat each scheme’s values as concepts and write the mappings.
Each classification stays as it is, and only the correspondences are recorded separately.

The mapping property is chosen by how close the match is.
OCSF’s Ransomware is the same concept as ransomware, so it is written as exactMatch.
ATT&CK’s T1486 is the signature technique of ransomware, but a technique and a kind of malware are not the same concept, so it is written as relatedMatch.

The two have to be kept apart because only exactMatch has a property called transitivity.
Transitivity means that if A equals B and B equals C, then A equals C.
In SKOS only exactMatch has this property; the other mapping properties, such as closeMatch and relatedMatch, do not.
So if concepts that are not fully identical are linked with exactMatch, different concepts end up merged through the one in the middle, as the figure below shows.

Wrong: all exactMatch Ransomware ATT&CK T1486 OCSF 21 Wiper exactMatch exactMatch A reasoner merges Ransomware and Wiper into one concept (wrong) Right: relatedMatch Ransomware ATT&CK T1486 OCSF 21 Wiper relatedMatch relatedMatch Nothing follows. The three concepts stay separate
T1486 is a technique used by both ransomware and wipers. Linking everything with exactMatch makes ransomware and wipers the same concept through transitivity; relatedMatch does not.

A wiper is malware that erases or corrupts data so it cannot be used; it is number 21 in the OCSF malware classification.

What is an ontology?

A thesaurus only expresses relations between concepts (broader, narrower, related, mapped).
It does not express what a concept has, such as “a detection has a source IP” or “an IP is assigned to a host”.
So it cannot answer a question like “which host is this detection’s source IP assigned to, and were there other detections on that host?”

An ontology adds properties of concepts, relations between concepts, and inference rules.
On the web it is written in RDFS and OWL.

RDFS (RDF Schema) is a W3C language for defining the classes and properties used in RDF data and the hierarchy between them; OWL (Web Ontology Language) is a W3C ontology language that defines classes and properties with richer logic so that a reasoner can draw conclusions.

Definitions (classes and properties) Malware detection Ransomware detection subClassOf Detection subClassOf IP address source IP Host assigned to Data Detection case A ransomware 10.0.0.5 Server A Detection case B brute force source IP assigned to target host type Inference: case A is also a malware detection
The top defines classes and properties; the bottom is data that follows them. A query can go from detection case A through the IP and Server A to detection case B on the same host. The orange dashed arrow is the conclusion drawn from subClassOf.
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix owl:  <http://www.w3.org/2002/07/owl#> .
@prefix ex:   <http://example.org/> .

ex:sourceIP   a owl:ObjectProperty ;
    rdfs:domain ex:Detection ;  rdfs:range ex:IPAddress .
ex:assignedTo a owl:ObjectProperty ;
    rdfs:domain ex:IPAddress ;  rdfs:range ex:Host .
ex:RansomwareDetection rdfs:subClassOf ex:MalwareDetection .
ex:MalwareDetection    rdfs:subClassOf ex:Detection .

The first definition means “a detection has a source IP”, and the second means “an IP is assigned to a host”.
With these relations defined, a query can follow a detection to its IP, the IP to its host, and the host back to other detections.

The last two lines are inference rules.
Since ransomware detection is defined as a subclass of malware detection, a reasoner also treats detection case A, classified as a ransomware detection, as a malware detection.
Where the hierarchy in a taxonomy was just classification, the hierarchy in an ontology is a rule a machine can draw conclusions from.

Comparing the three

TaxonomyThesaurusOntology
What it expressesParent-child classification+ alternative names, related concepts, mappings to other schemes+ properties of concepts, relations between concepts, inference rules
StandardsNone in particularISO 25964, SKOSRDFS, OWL
ExampleThreat › Malware › RansomwareRansomware = OCSF 10, related to ATT&CK T1486Detection → source IP → host, RansomwareDetection subClassOf MalwareDetection
Questions it can answerWhat kind of threat is ransomware?Which concept in the reference scheme matches OCSF’s 10?Which host is this detection’s source IP assigned to?

Summary

If you only need to classify, filter, and count, a taxonomy is enough.
If the same concept arrives under several names or from several classification schemes, you need a thesaurus.
If you need to follow what a concept has, or draw conclusions from definitions, you need an ontology.
The three are not competing approaches; as you need to express more, you add a thesaurus on top of a taxonomy and an ontology on top of a thesaurus, one layer at a time.

References