Ontology-based Distributed Intrusion Detection System

In this paper we discussed about utilizing methods and techniques of semantic web in the Intrusion Detection Systems. To extract semantic relations between computer attacks and intrusions in a Distributed Intrusion Detection System, we use ontology. Prot g software is our selected software for building ontology. In addition, we utilized Jena framework to make interaction between MasterAgent and attacks ontology. Our Distributed Intrusion Detection System is a network which contains some IDSagents and a special MasterAgent. MasterAgent contains our proposed attacks ontology. Every time a IDSagent detects an attack or new suspected condition, it sends detection's report for MasterAgent. Therefore, it can extract the semantic relationship among computer attacks and suspected situations in the network with proposed ontology. Finally, the experience shows that the pruposed system reduced the rate of false positive and false negative.