S-MAIDS: A semantic model for automated tuning, correlation, and response selection in intrusion detection systems

Proceedings - International Computer Software and Applications Conference

Volumn , Issue , 2013, Pages 319-328

  Strasburg, Chris ^a   Basu, Samik ^b   Wong, Johnny S ^b  

^a IOWA STATE UNIVERSITY   (United States)

^b Iowa State University   (United States)

Author keywords

Computer aided diagnosis; Computer security; Intrusion detection; Knowledge based systems; Software measurement

Indexed keywords

APPLICATION PROGRAMS; AUTOMATION; COMPUTER AIDED DIAGNOSIS; COMPUTER CRIME; KNOWLEDGE BASED SYSTEMS; SECURITY OF DATA; SEMANTICS; TUNING;

AUTOMATED TUNING; DETECTION CAPABILITY; INTRUSION DETECTION AND RESPONSE SYSTEMS; INTRUSION DETECTION SYSTEMS; OPERATING CHARACTERISTICS; OWL ONTOLOGIES; RESPONSE SELECTION; SOFTWARE MEASUREMENT;

INTRUSION DETECTION;

EID: 84891323480     PISSN: 07303157     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/COMPSAC.2013.57     Document Type: Conference Paper

References (18)

1. A. A. Cardenas, J. S. Baras, and K. Seamon, "A framework for the evaluation of intrusion detection systems," in IEEE Symposium on Security and Privacy, 2006, pp. 63-77.
2. R. Maxion and K. Tan, "Benchmarking anomaly-based detection systems," Proceeding International Conference on Dependable Systems and Networks. DSN 2000, pp. 623-630, 2000.
3. B. Foo, Y. sung Wu, Y. chun Mao, S. Bagchi, and E. H. Spafford, "Adepts: Adaptive intrusion response using attack graphs in an e-commerce environment, dsn," 2005.
4. N. Stakhanova, S. Basu, and J. Wong, "Taxonomy of intrusion response systems," International Journal of Information and Computer Security, vol. 1, pp. 169-184, 2007.
5. The Mitre Corporation, "Standardizing Cyber Threat Intelligence Information with the Structured Threat Information eXpression (STIX)," Tech. Rep., 2012.
6. D. McGuinness, F. Van Harmelen et al., "Owl web ontology language overview," W3C recommendation, vol. 10, no. 2004-03, p. 10, 2004.
7. D. E. Denning, "An Intrusion-Detection Model," IEEE Transactions on Software Engineering, vol. 13, no. 2, pp. 222-232, 1987.
8. S. Axelsson, "A preliminary attempt to apply detection and estimation theory to intrusion detection," no. 00-4, p. 11, 2000.
9. G. Gu, P. Fogla, D. Dagon, W. Lee, and B. Skori, "An Information-Theoretic Measure of Intrusion Detection Capability," Georgia Institute of Technology. GIT-CC-05-10, Tech. Rep., 2005.
10. G. Gu, P. Fogla, D. Dagon, W. Lee, and B. Skoric, "Towards an information-theoretic framework for analyzing intrusion detection systems," Computer Security-ESORICS 2006, pp. 527-546, 2006.
11. J. Undercoffer, J. Pinkston, A. Joshi, and T. Finin, "A target-centric ontology for intrusion detection," in Workshop on Ontologies in Distributed Systems-18th International Joint Conference on Artificial Intelligence, 2004.
12. G. G. Granadillo, Y. B. Mustapha, N. Hachem, and H. Debar, "An ontology-driven approach to model siem information and operations using the swrl formalism," Int. J. Electron. Secur. Digit. Forensic, vol. 4, no. 2/3, pp. 104-123, Aug. 2012. [Online]. Available: http://dx.doi.org/10.1504/IJESDF.2012. 048412
13. A. Vorobiev and N. Bekmamedova, "An Ontology-Driven Approach Applied to Information Security," Journal of Research and Practice in Information Technology, vol. 42, no. 1, pp. 61-76, 2010.
14. A. Kim, J. Luo, and M. Kang, "Security ontology for annotating resources," On the Move to Meaningful Internet Systems 2005, pp. 1483-1499, 2005.
15. B. Morin, L. Me, H. Debar, and M. Ducasse, "A logicbased model to support alert correlation in intrusion detection," Information Fusion, vol. 10, no. 4, pp. 285-299, Feb. 2009.
16. Microsoft Corporation, "Microsoft Security Bulletin MS01-033: Unchecked Buffer in Index Server ISAPI Extension Could Enable Web Server Compromise," 2001. [Online]. Available: http://technet.microsoft.com/ en-us/security/bulletin/ms01-033
17. eEye Digital Security, ".ida Code Red Worm," Tech. Rep. [Online]. Available: http://www.eeye.com/html/ Research/Advisories/AL20010717. html
18. Cisco, "Introduction to Cisco IOS NetFlow," Tech. Rep., 2012. [Online]. Available: http://www.cisco.com/ en/US/prod/collateral/iosswrel/ ps6537/ps6555/ps6601/ prod\ white\ paper0900aecd80406232.html