发表机构
Faculty of Computer Science, TU Dresden; Else Kröner Fresenius Center for Digital Health; secunet Security Networks AG（德累斯顿工业大学计算机学院; Else Kröner Fresenius数字健康中心; secunet安全网络股份公司）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
研究针对医疗设备网络安全风险管理文档维护难的问题，提出SECUMAN本体与形状，结合OWL和SHACL实现文档初验、可追溯性及集成，对齐相关标准与本体并扩展网络安全相关概念。
AI 中文摘要
我们提出SECUMAN本体与形状，用于表示和分析医疗设备的网络安全风险管理文档。网络安全风险对联网医疗设备愈发重要，可能直接影响患者安全。当前风险管理文件常以半结构化自然语言文本维护，难以进行一致性检查、认证审核与复用。SECUMAN提供基于OWL的正式词汇表，用于建模安全风险上下文、评估、控制措施及残余风险评估，并采用SHACL约束检查结构完整性及与预期文档模型的符合性。该本体与VDE Spec 90025及相关RISKMAN本体和形状对齐，同时将其面向安全的方法扩展至网络安全风险文档相关概念，如威胁场景、保护目标、攻击者画像、暴露水平、资产及安全设计论证。SECUMAN旨在支持网络安全与安全风险管理文档的自动初验、可追溯性及集成。
英文摘要
We propose the SECUMAN ontology and shapes for representing and analysing cybersecurity risk-management documentation for medical devices. Cybersecurity risks are increasingly relevant for connected medical devices and may have direct consequences for patient safety. Current risk-management files are often maintained as semi-structured natural language text, which makes consistency checking, certification review, and reuse difficult. SECUMAN provides a formal OWL-based vocabulary for modelling security-risk context, assessment, control measures, and residual-risk evaluation, and uses SHACL constraints to check structural completeness and conformity with the intended documentation model. The ontology is aligned with VDE Spec 90025 and the related RISKMAN ontology and shapes, while extending their safety-oriented approach to concepts relevant to cybersecurity risk documentation such as threat scenarios, protection goals, attacker profiles, exposure levels, assets, and secure design arguments. SECUMAN is intended to support automated first-pass validation, traceability, and integration of cybersecurity and safety risk-management documentation.
