KGCS Ontology Documentation

The KGCS ontology is a frozen (v1.0), standards-backed semantic backbone for cybersecurity knowledge graphs. It integrates authoritative standards from NVD and MITRE into a coherent OWL ontology with 12 modules, SHACL governance, and deterministic causal chains.

Documentation

Document	Description
Core Ontology v1.0	The authoritative semantic backbone — classes, relationships, invariants, and traversal rules for the frozen core
Asset Extension v1.0	Extension module for organizational assets, computed relationships, and risk overlay — sits on top of the frozen core
Namespace Policy v1.0	Canonical prefixes (`kgcs:`, `cpe:`, `cve:`, `cwe:`, etc.) and namespace governance rules

OWL Modules (12 total)

All OWL files are frozen at v1.0. The core and extension modules have detailed documentation above; standards modules encode the official schemas from NVD and MITRE.

Core & Extension

Module	Standard	OWL File
Core Ontology	KGCS Core	core-ontology-v1.0.owl
Asset Extension	KGCS Extension	asset-extension-v1.0.owl

Standards — NVD / NIST

Module	Standard	OWL File
CPE	NVD / NIST	cpe-ontology-v1.0.owl
CVE	NVD / NIST	cve-ontology-v1.0.owl
CVSS	NVD / NIST	cvss-ontology-v1.0.owl

Standards — MITRE

Module	Standard	OWL File
CWE	MITRE	cwe-ontology-v1.0.owl
CAPEC	MITRE	capec-ontology-v1.0.owl
ATT&CK	MITRE	attack-ontology-v1.0.owl
D3FEND	MITRE	d3fend-ontology-v1.0.owl
CAR	MITRE	car-ontology-v1.0.owl
SHIELD	MITRE	shield-ontology-v1.0.owl
ENGAGE	MITRE	engage-ontology-v1.0.owl

Causal Chain

The canonical traversal path through the ontology:

CPE → CVE → CWE → CAPEC → ATT&CK → {D3FEND, CAR, SHIELD, ENGAGE}

Every edge is standards-backed, deterministic, and traceable. No hops are skipped. See the canonical traversal example in the Core Ontology documentation.

Schema Mappings — OWL mapping specifications for each standard
KGCS Overview — Architecture and design principles
SHACL Constraints — Shape validation rules
Case Studies — Real-world vulnerability analysis using the ontology