The Sixth International Symposium on Recent Advances in Intrusion Detection

Modeling Computer Attacks: An Ontology for Intrusion Detection

Anupam Joshi and John Pinkston

September 16, 2003

We state the benefits of transitioning from taxonomies to ontologies and ontology specification languages, which are able to simultaneously serve as recognition, reporting and correlation languages. We have produced an ontology specifying a model of computer attack using the DARPA Agent Markup Language+Ontology Inference Layer, a descriptive logic language. The ontologyrsquos logic is implemented using DAMLJessKB. We compare and contrast the IETFrsquos IDMEF, an emerging standard that uses XML to define its data model, with a data model constructed using DAML+OIL. In our research we focus on low level kernel attributes at the process, system and network levels, to serve as those taxonomic characteristics. We illustrate the benefits of utilizing an ontology by presenting use case scenarios within a distributed intrusion detection system.

BibTeX OWL Tweet Scholar

Tags: cybersecurity, intrusion detection, ontology, security, semantic web

Type: InProceedings

Publisher: Springer

Edition: LNCS-2516

Note:

---

Publisher's site

---

Downloads: 4870 downloads

Google Scholar Citations: 19 citations