An ontology-driven approach to model SIEM information and operations using the SWRL formalism

Abstract

International audienceThe management of security events, from the risk analysis, to the selection of appropriate countermeasures, has become a major concern for security analysts and IT administrators. Furthermore, the fact that network and system devices are heterogeneous, increases the difficulty of these administrative tasks. This paper introduces an ontology-driven approach to address the aforementioned problems. The proposed model takes into account two aspects: the information and the operations that are manipulated by SIEM environments in order to reach the desired goals. The model uses ontologies to provide simplicity on the description of concepts, relationships and instances of the security domain. The Semantics Web Rule Languages is used to describe the logic rules needed to infer relationships among individuals and classes. A case study on Botnets is presented at the end of this paper to illustrate a concrete utilization of our model

S-MAIDS: A Semantic Model for Automated Tuning, Correlation, and Response Selection in Intrusion Detection Systems

“…In general we note that, while each model is targeted toward a specific purpose (the goal in [14] is to annotate web resources, while [13] attempts to expand the representation to general computer security, and [12] models a security information and event management (SIEM) system), most adopt a general structure similar to that shown in Figure 1.…”

Security Information and Event Management (SIEM): Analysis, Trends, and Usage in Critical Infrastructures

“…Their deployment thus focuses, firstly, on writing ad hoc collectors and translators to acquire information and normalize it, and secondly, on writing correlation rules to aggregate the information and reduce the amount of data. This operational focus leads SIEM implementers to prioritize syntax over semantics, and to use correlation languages that are poor in terms of features [ 73 ]. However, as the number of attacks, and thus the diversity of alerts received by SIEMs increases, the need for appropriate treatment of these alerts has become essential.…”

Intelligent monitoring with background knowledge

“…To allow time based correlation, e.g. to check if specific events such as a failed login occurred several times within the last ten minutes, the ontology is structured according to the approach of Granadillo et al [4] on the top level of the ontology. The approach suggests to separate the ontology into two parts, the (static) information and the (dynamic) operations as shown in Fig.…”