An ontology-based intrusion alerts correlation system

被引：24
作者：
Li, Wan [1 ]
Tian, Shengfeng [1 ]
机构：
[1] Beijing Jiaotong Univ, Sch Comp & Informat Technol, Beijing 100044, Peoples R China
来源：
EXPERT SYSTEMS WITH APPLICATIONS | 2010年 / 37卷 / 10期
关键词：
Alert correlation; Intrusion detection; Ontology; System integration and implementation; RULES;
D O I：
10.1016/j.eswa.2010.03.068
中图分类号：
TP18 [人工智能理论];
学科分类号：
081104 ; 0812 ; 0835 ; 1405 ;
摘要：
Alert correlation techniques effectively improve the quality of alerts reported by intrusion detection systems, and are sufficient to support rapid identification of ongoing attacks or predict an intruder's next likely goal. In our previous work, an alert correlation approach based on our XSWRL ontology has been proposed. This paper focuses on how to develop the intrusion alerts correlation system according to our alert correlation approach. At first, the multi-agent system architecture consisting of agents and sensors is shown. The sensors collect security relevant information, and the agents process the information. Then we present each modules of the system in detail. The State Sensor collects information about security state and the Local State Agent and Center State Agent preprocess the security state information and convert it to ontology. The Attack Sensor collects information about attack and the Local Alert Agent and Center Alert Agent preprocess the alert information and convert it to ontology. The Attack Correlator correlates the attacks and outputs the attack sessions. (C) 2010 Elsevier Ltd. All rights reserved.
引用
收藏
页码：7138 / 7146
页数：9
相关论文
共 38 条
  • [1] [Anonymous], 2004, W3C MEMB SUBMISS
  • [2] [Anonymous], 2002, Proceedings of the 9th ACM conference on Computer and communications security, CCS'02, DOI DOI 10.1145/586110.586144
  • [3] [Anonymous], 2003, DESCRIPTION LOGIC HD
  • [4] [Anonymous], 1995, FUNDAMENTALS DATA ST
  • [5] [Anonymous], 2001, Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection, RAID'00, DOI 10.1007/3-540-45474-86
  • [6] DR-Prolog: A system for defeasible reasoning with rules and ontologies on the Semantic Web
    Antoniou, Grigoris
    Bikakis, Antonis
    [J]. IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING, 2007, 19 (02) : 233 - 245
  • [7] Axelsson S., 2000, ACM Transactions on Information and Systems Security, V3, P186, DOI 10.1145/357830.357849
  • [8] Cuppens F, 2002, P IEEE S SECUR PRIV, P202, DOI 10.1109/SECPRI.2002.1004372
  • [9] Managing alerts in a multi-intrusion detection environment
    Cuppens, F
    [J]. 17TH ANNUAL COMPUTER SECURITY APPLICATIONS CONFERENCE, PROCEEDINGS, 2001, : 22 - 31
  • [10] Cuppens F, 2000, LECT NOTES COMPUT SC, V1907, P197
1234