From healthcare to cybersecurity: the SCS group applies structured knowledge to make digital systems smarter, safer, and more meaningful.
Computer Science is often preoccupied with data and with the computer as a data manipulation machine’, says professor Giancarlo Guizzardi, leader of the research group Semantics, Cybersecurity and Services (SCS) at the University of Twente. ‘But data refer to things, people, events and relationships in the real world. If we want to build digital systems that we can understand and trust, we need to have a good way of working out the relationship between the data and what the data represent. That is called semantics. An important part of the research in the SCS group is building so-called ontologies to address current problems in data management, cybersecurity and the interoperability of digital systems. Our group is quite unique in its approach.’
‘The importance of semantics is great, but too often overlooked. Suppose a hospital and a general practice record medical information about the same patient, but using different terms. Let’s say the hospital uses the term “myocardial infarction”, while the general practice talks about “heart attack”. Without additional explanation, a computer does not know that a heart attack is the same as a myocardial infarction. This problem can be solved by giving the computer an ontology, a structured description of knowledge about a particular subject: what things are, what they are called, and how they are related.
Guizzardi’s group has developed several ontologies that are used in practice. ‘Grounding all these ontologies is a foundational theory called the Unified Foundational Ontology, UFO in short’, says Guizzardi. ‘Currently, it is in the process of ISO standardisation. Over the years, UFO and a modelling language based on it called OntoUML, have been successfully employed by many organisations worldwide. The National Health Care Institute, for example, has used it for safe data exchange among a multitude of systems. Moreover, organisations such as NASA have repeatedly demonstrated interest in these results.’
What binds the group’s work on semantics, cybersecurity and services together is what Guizzardi calls ‘meaningful computing’. Guizzardi: ‘Meaning in the sense of semantics but also in the sense of purpose: building systems that are aligned with human values and norms. Recently, we have been developing ontologies that help to operationalise ethical norms proposed by the EU by translating these into concrete rules that engineers can use to build ethical systems.’
Triaging security alerts
Within the SCS group, associate professor Andrea Continella leads the cybersecurity team. Continella: ‘We focus on designing new techniques to test, prevent, or mitigate cyberattacks. Among the systems we look at are cloud systems and IoT systems. Recently, we built our own IoT Cyber lab: a room that replicates a studio apartment equipped with IoT devices like a smart fridge, a smart alarm system, and even a smart bed with sensors below the mattress. In the lab, we test smart devices in terms of security.’
One of the interesting results of Continella’s work is in the field of alert triaging. This is the problem that nowadays many security systems give too many security alerts to act on all of them. ‘We have used a combination of AI and semantic technologies to build a model that can group the most important security alerts together, so that security operators don’t have to go through all of them but know which ones have priority. Using data sets from real-world companies, we measured that our solution reduced the workload of the operators by ninety per cent.’
Over the past five years, the SCS group has grown quite a lot, Continella says. ‘But at the same time, the group has grown into a research family, a dynamic and friendly environment where people help each other and have fun together. Beyond research, we play together in international hacking competitions under the ‘Twente Hacking Squad’ team, and in our IoT lab we have installed a football table that we made smart with sensors tracking goals and replaying the match highlights.’
Protecting critical infrastructure
PhD student Taru Itäpelto began her career as a professional musician in several symphony orchestras in Finland. She later transitioned to entrepreneurship, working as the CEO and CFO of a foster care company before discovering her passion for cybersecurity. Now she is researching how to leverage digital twins to improve the cybersecurity of critical infrastructures. ‘Such systems have life cycles of thirty to forty years’, she says. ‘In the meantime, various components are updated, and external threats evolve, leading to a changing cybersecurity landscape. So, the key question is: How to ensure the cybersecurity of a critical infrastructure throughout its lifetime?’
An example that Itäpelto has been working on is a small surveillance system that can be incorporated in any critical infrastructure. ‘I have looked at how we can use ontologies to build a digital twin model that is robust against changes. Even if a camera is replaced, the system’s security should remain intact.’
Itäpelto says that the social aspects of the SCS group are similar to what she was used to in Finland: ‘There’s a flat hierarchy, and it’s easy to communicate with everyone. This, combined with the strong social connections, means I feel valued and included in this group.’
Group passport – Semantics, Cybersecurity & Services (SCS)
Research fields
- Ontologies, ontology-driven conceptual modelling, systems security, data security, service design theories, model-driven engineering, Internet of Things
Institution
- Faculty of Electrical Engineering, Mathematics and Computer Science (EEMCS) of the University of Twente
Research facility
- Adaptive IT Laboratory
Employees: Total 55 (as of September 2025)
- 3 professors, 4 associate professors, 8 assistant professors, 3 lecturers, 9 associate researchers, 28 PhD students.
Websites
Published in I/O Magazine #2 2025
Text Bennie Mols
Images Ivar Pel