RE: Towards a better understanding of JSON-LD (Was: MTI Binding)

[Cory Casanave <cory-c@modeldriven.com>]

The question here is with regard to nested structures and the RDF model.

The native RDF model has no defined nesting/ Each atomic "fact" (a triple) such as "john weighs 5 lbs" exists in a namespace and there is no other defined structure. When RDF is serialized it may have a nested structure, as does JSON-LD. The wrinkle here is that what is nested Vs. what is "top level" is usually based on the rules of the serializer.  What I would suggest is that in addition to the base RDF schema a specific serialization be defined for CTI such that it can be reliably parsed with a known structure. This in no way invalidates the RDF schema and in a sense serves both worlds. 

When we create logical information models in UML we typically define aggregation (the black diamond). While this has no meaning to RDF there is nothing wrong with putting that fact in the schema as an augmentation "hint" for serialization, so we can generate an augmented RDF schema (which, by the way, can be serialized in JSON-LD). That same model can then generate XML schema with the same data hierarchy. A pure RDF application reading this data may ignore the hint but would still be able to interpret the data.

I would see this as a finer point of using JSON-LD should we move in that direction.

As for how much you put in one type Vs. making finer grain types - that is up to the modeler and has mostly the same concerns that it does in XML or schemaless JSON - the style of constructing the logical data model is orthogonal to the MTI discussion.

-Cory Casanave

-----Original Message-----
From: cti-users@lists.oasis-open.org [mailto:cti-users@lists.oasis-open.org] On Behalf Of Grobauer, Bernd
Sent: Wednesday, October 07, 2015 7:47 AM
To: terry.macdonald@threatloop.com; shawn.p.riley@gmail.com
Cc: cti-users@lists.oasis-open.org; jwunder@mitre.org
Subject: [cti-users] Towards a better understanding of JSON-LD (Was: MTI Binding)

Hi,

Terry asked the following question to get a better understanding of
JSON-LD:

> If we're free to construct our own STIX specific schema, if we can put 
> in it what we want, and we can derive the schema programmatically from 
> the actual underlying model that sounds very useful.
> Does this mean that the main difference between the JSON-LD and 
> JSONSchema is just the way that JSON-LD explicitly references the 
> applicable schema (increasing size slightly)? And JSONSchema has an 
> implicit relationship. Correct?

The way I understand it (I would be grateful if one of the experts could refute me here or back me up) is that there is an additional difference in the way schemas works:

- JSONSchema (if it works anyhting like XSLD) allows you to
  strictly specify the form of your json: this field must be here,
  that field may be here, etc.

- JSON-LD schemas specify for a given 'thing', what kind of
  properties it may have, where the property definition is in
  the form of a key and a value -- the value may be something
  atomic or something that essentially is a reference to another
  'thing', again with properties. JSON-LD does not care whether
  in sending a piece of JSON, you fill out one, two, or all
  possible properties for a given "thing" -- you just add up whatever
  information you receive about a thing.

Theoretically, JSONSchema and JSON-LD could be used in conjunction, i.e., one could use JSONSchema to constrain the way JSON must look like, but I guess if we do that then there is little point in using JSON-LD in the first place?

I am still wondering about the following: the advantage of JSON-DL, if I understand it correctly, would be that we move towards techniques of semantic processing/reasoning, because JSON-DL transforms into RDF. My (limited and maybe faulty understanding) is that when modeling for RDF, one strives to pack as much information about a thing as possible into key-value pairs with atomic values, using relationships to other things where the other thing truly has some semantic meaning.  In that respect, there is a penalty on more complicated things such as ordered lists, nested structures, etc.  JSON-DL allows me to describe order, nested structures, etc., but when transformed into RDL, these structures give rise to auxiliary nodes: for example, an ordered list of n elements gives rise to n auxiliary nodes that represent that list as a graph.

If it is true, then a more or less direct translation of STIX/CybOX into JSON-LD certainly, though possible, probably would not serve the purpose of enabling easy use of ontological reasoning using RDF or similar, because the translation of the model would result in more auxiliary nodes than "normal" nodes: STIX and CYBOX just love nested structures.

So my question: would an adoption of JSON-LD in a way that actually leverages the fact that JSON-LD translates into RDF, mean that we have to drastically change the way in which STIX/CybOX are modeled, in many instances removing nesting as it exists today in STIX/CybOX?

Kind regards,

Bernd