标题： 面向安全编排自动化与响应的基于意图和本体驱动的自主安全响应 显示英文标题

标题： Toward an Intent-Based and Ontology-Driven Autonomic Security Response in Security Orchestration Automation and Response

摘要： 现代安全编排、自动化和响应(SOAR)平台必须迅速适应不断演变的网络攻击。 基于意图的网络已成为一种有前景的范例，通过高级声明性意图来缓解网络攻击，这些意图比程序化操作提供了更大的灵活性和持久性。 在本文中，我们通过提出一种统一的、本体驱动的安全意图定义，弥合了两个活跃的研究方向之间的差距：基于意图的网络安全防御和自主网络安全防御，该定义利用了MITRE-D3FEND网络安全本体。 我们还提出了一种通用的两层方法，将此类安全意图集成到决策理论的自主网络安全防御系统中，从而实现分层和上下文感知的自动化响应能力。 我们的方法的实用性通过一个具体的用例得到证明，展示了其在下一代安全编排、自动化和响应平台中的集成。 显示英文摘要

摘要： Modern Security Orchestration, Automation, and Response (SOAR) platforms must rapidly adapt to continuously evolving cyber attacks. Intent-Based Networking has emerged as a promising paradigm for cyber attack mitigation through high-level declarative intents, which offer greater flexibility and persistency than procedural actions. In this paper, we bridge the gap between two active research directions: Intent-Based Cyber Defense and Autonomic Cyber Defense, by proposing a unified, ontology-driven security intent definition leveraging the MITRE-D3FEND cybersecurity ontology. We also propose a general two-tiered methodology for integrating such security intents into decision-theoretic Autonomic Cyber Defense systems, enabling hierarchical and context-aware automated response capabilities. The practicality of our approach is demonstrated through a concrete use case, showcasing its integration within next-generation Security Orchestration, Automation, and Response platforms.