OntoSecU: An ontology‑based framework for proactive vulnerability management in Ecuadorian universities through semantic integration of Nmap, Nessus, and Shodan

Abstract

The objective of the article is to present OntoSecU: An ontological framework that semantically integrates findings from Nmap, Nessus, and Shodan with standardized catalogs (CVE, CWE, CPE, NVD) and the CISA KEV list, to prioritize the remediation of vulnerabilities in an explainable manner within an Ecuadorian higher education institution. This article directly derives from the master's thesis of Eng. Bolívar Ramos and presents as novel contributions: (a) an updated synthesis of the state of the art on ontologies in cybersecurity; (b) clear formalization of prioritization rules with operational examples; (c) an expanded comparative discussion with recent literature; and (d) specific projections for the Ecuadorian university context. Methods: an applied design combined ontology engineering (OWL, SHACL, SPARQL), data-normalization pipelines, and rule-based prioritization. The empirical assessment corresponds exclusively to a validation of acceptability and explainability via a Likert-type questionnaire applied to an institutional expert panel (n=5), without operational impact metrics. Results: all ten items achieved specific acceptance percentages at the highest agreement level (Likert=5): Item 1 (80%), Item 2 (100%), Item 3 (80%), Item 4 (100%), Item 5 (80%), Item 6 (100%), Item 7 (80%), Item 8 (100%), Item 9 (80%), Item 10 (100%). The median was Me=5 for all items, indicating expert acceptance in constructs such as usefulness, explainability, centralized visibility, semantic integration, rule-engine suitability, and dashboard usability. This level of evidence corresponds to prototype acceptance/explainability validation, not to operational impact assessment. Conclusions: OntoSecU shows conceptual feasibility and perceived utility for the Ecuadorian university context, offering shared semantics, validations, and reproducible queries that enable traceability and auditability. A longitudinal phase with real telemetry is proposed to quantify operational impact and consolidate data-and-rules governance.