![](bg7.png)
7 RELATED WORK
Tsoumas, Dritsas, and Gritzalis (Tsoumas, Dritsas,
and Gritzalis, 2005) present an ontology-based ap-
proach that manages security of information sys-
tems. The authors argue that the approach is struc-
tured to support the process from policy and Risk
Analysis (RA) documents to technical controls. The
authors state that the result is a knowledge-based,
ontology centric security management system that
may bridge the IS risk assessment and organization-
al security policies with security management
(Tsoumas, Dritsas, and Gritzalis, 2005).
Gorodetski et al. (Gorodetski, Popyack, Kotenko,
and Skormin, 1999) propose a multi-agent model of
an information security system that is based on on-
tology. Authors use the ontology to structure the
distributed knowledge. Nodes and relations defined
in ontology are used by an agent that aims at solving
the entire multitude of problems related to particular
tasks.
In our work, we propose the usage of ontology
based techniques for security knowledge representa-
tion and multi-agent system that enables mapping
between security requirements, security threats and
security controls. We develop the security ontology
that supports security management during the devel-
opment of new software systems and maintenance of
the existing systems. The ontology is general and
can be applied on different types of organizations.
For mapping of ontologies we apply multi-agent
system.
8 CONCLUSIONS
We have proposed security ontology that aims to
support engineers during software engineering proc-
ess and improve the security of software systems.
The security ontology provides holistic view over
the security concepts and relationships between
those. We presented taxonomy of the security ontol-
ogy and discussed the necessity, importance and
usefulness of using security ontologies. Furthermore,
we presented electronic invoice presentment and
payment models and demonstrated electronic in-
voice presentment scenario. In the scenario, the pos-
sibilities of utilizing multi-agent system with on-
tologies for automatic mapping between threats and
countermeasures, which can provide traceability and
facilitate to the development of more secure soft-
ware systems is demonstrated.
ACKNOWLEDGEMENTS
This research is supported by Sweden-Korea re
search Cooperation Programme funded by STINT,
The Swedish Foundation for International Coopera-
tion in Research and Higher Education. http://www.
stint.se
REFERENCES
Awad, E. M. 2007. Electronic Commerce From Vision to
Fulfillment. Pearson Prentice Hall 3
rd
Ed., ISBN 0-13-
173521-7
Bishop, M. 2005 Introduction to Computer Security. Pear-
son Education.
Gorodetski, V. I., Popyack, L. J., Kotenko, I. V, Skormin,
V. A. 1999. Ontology-Based Multi-Agent Model of an
Information Security System. Springer-Verlag Berlin
Heidelberg. LNAI 1711, pp. 528-532
ISO/IEC 15408:2009 Common Criteria for Information
Technology Evaluation, Part 1: Introduction and gen-
eral model. V.3.1 Revision 3, CCMB-2009-07-001
Håkansson, A., Hartung, R., Moradian, E., Wu, D. 2010.
Comparing Ontologies Using Multi-Agent System and
Knowledge Base. Proceedings of the 14th international
conference on Knowledge-based and intelligent in-
formation and engineering systems: Part IV, Springer-
Verlag Berlin, Heidelberg ©2010
Laudon, K. C., Traver, C. G. E-Commerce business.
Technology. Society. 4
th
Ed. Pearson InternationalEdi-
tion. 2008. ISBN-10: 0-13-500932-4
McGraw, G. 2006. Software Security Building Security in.
Addison-Wesley Pearson Ed., ISBN 0-321-35670-5.
Moradian, E., and Håkansson, A. 2006. Possible attacks
on XML Web Services. (IJCSNS) International Journal
of Computer Science and Network Security. Journal
ISSN: 1738-7906 Volume Number: Vol.6, No.1B,
Moradian, E. Håkansson, A., Andersson, J-O. 2010. Multi-
Agent System Supporting Security Requirements Engi-
neering. Accepted in The 9th International Conference
of Software Engineering Research and Practice (SERP
10)
Tsoumas, B., Dritsas, S., and Gritzalis, D. 2005. An On-
tology-Based Approach to Information System Securi-
ty Management. LNCS, 2005, Volume 3685/2005, pp.
151-164
Turban, E., King, D., McKay, J., Marshall, P., Lee, J.,
Viehland, D. 2008. Electronic Commerce A Mana-
gerial Perspective. Pearson Education. Upper Saddle
River, NJ
ONTOLOGYDESIGNANDMAPPINGFORBUILDINGSECUREE-COMMERCESOFTWARE
173