An ontology-driven approach to model SIEM information and operations using the SWRL formalism

International Journal of Electronic Security and Digital Forensics

Volumn 4, Issue 2-3, 2012, Pages 104-123

  Gonzalez Granadillo, Gustavo ^a   Ben Mustapha, Yosra ^a   Hachem, Nabil ^a   Debar, Herve ^a  

^a INSTITUT TELECOM   (France)

Author keywords

Data model; Event management; Heterogeneity; Logic rules; Ontology; Reasoning; Security events; Security information and event management; Semantics; SIEM; SWRL

Indexed keywords

COMPUTER CIRCUITS; DATA STRUCTURES; RISK ANALYSIS; RISK ASSESSMENT; SEMANTICS;

EVENT MANAGEMENT; HETEROGENEITY; LOGIC RULES; REASONING; SECURITY EVENTS; SECURITY INFORMATION AND EVENT MANAGEMENTS; SIEM; SWRL;

ONTOLOGY;

EID: 84864671603     PISSN: 1751911X     EISSN: 17519128     Source Type: Journal    
DOI: 10.1504/IJESDF.2012.048412     Document Type: Article

References (23)

1. Abdoli, F. and Kahani, M. (2009) 'Ontology-based distributed intrusion detection system', Proceedings of the 14th International CSI Computer Conference, pp.65-70.
2. Cuppens-Boulahia, N., Cuppens, F., Lopez, J., Vasquez, E., Guerra, J. and Debar, H. (2009) 'An ontology-based approach to react to network attacks', International Journal of Information and Computer Security, Vol. 3, Nos. 3-4, pp.280-305.
3. Danyliw, R., Mejier, J. and Demchenko, Y. (2007) 'The incident object description exchange format', RFC 5070.
4. Debar, H., Curry, D. and Feinsten, B. (2007) 'Intrusion detection message exchange format', RFC 4765.
5. Eiter, T., Ianni, G., Polleres, A., Schindlauer, R. and Tompis, H. (2006) 'Reasoning with rules and ontologies', in Reasoning Web 2006, pp.93-127. (Pubitemid 44568361)
6. Fenz, S. and Ekelhart, A. (2009) 'Formalizing information security knowledge', ACM Symposium on Information, Computer and Communication Security, pp.183-194.
7. Gerhards, R. and GmbH A (2009) 'The syslog protocol', RFC 5424.
8. Giuseppini, G. and Burnett, M. (2005) 'Microsoft log parser toolkit', Chapter 5: Managing Snort Alerts, Syngress Publishing Inc., pp.147-163.
9. Gonzalez Granadillo, G., Ben Mustapha, Y., Hachem, N. and Debar, H. (2011) 'An ontology-based model for SIEM environments', 7th International Conference on Global Security Safety and Sustainability.
10. Hachem, N., Ben Mustapha, Y., Gonzalez Granadillo, G. and Debar, H. (2011) 'Botnets: lifecycle and taxonomy', 6th Conference on Network Architecture and Information Systems Security.
11. Herzog, A. Shahmehri, N. and Duma, C. (2007) 'An ontology of information security', International Journal of Information Security and Privacy, Vol. 1, No. 4, pp.1-23.
12. Horridge, M., Jupp,S., Moulton, G., Rector, A., Stevens, R. and Wroe, C. (2007) 'A practical guide to building OWL ontologies using Protégé 4 and CO-ODE tools', The University Of Manchester, 1.1 Ed.
13. Lopez, J., Villagra, V., Holdago, P., de Frutos, E. and Sanz, I. (2009) 'A semantic web approach to share alerts among security information management systems', Proc. Iberic Web Application Security Conference (IBWAS'09).
14. Miller, D., Harris, S., Harper, A., Van Dyke, S. and Blask, C. (2010) Security Information and Event Management (SIEM) Implementation, McGraw Hill, Florida, USA.
15. Morin, B., Me, L., Debar, H. and Ducasse, M. (2009) 'M4D4: a logical framework to support alert correlation in intrusion detection', Information Fusion Internationale, Vol. 10, No. 4, pp.285-299.
16. Nguyen, V. (2011) 'Ontologies and information systems: a literature survey', Command, Control, Communications and Intelligence Division, Defence Science and Technology Organisation DSTO-TN-1002.
17. Razzaq, A., Hur, A., Ahmed, H. and Haider, N. (2009) 'Ontology based application level intrusion detection system by using Bayesian filter', 2nd International Conference on Computer, Control and Communication, pp.1-6.
18. Security in a Box, 'How to install COMODO firewall', available at https://security.ngoinabox.org/en/comodo installation.
19. Undercoffer, J., Joshi, A. and Pinkston, J. (2003) 'Modeling computer attacks: an ontology for intrusion detection', 6th International Symposium on Recent Advances in Intrusion Detection, pp.113-135.
20. W3C Member Submission (2004) 'SWRL: a semantic web rule language combining OWL and RuleML'.
21. W3C Recommendation (2008) 'SPARQL query language for RDF. W3C Recommendation'.
22. W3C Recommendation (2009) 'OWL 2 web ontology language. W3C Recommendation'.
23. Zhang, Z. (2005) 'Ontology query languages for semantic web: a performance evaluation', Master thesis, University of Georgia.