Design and Implementation of a Hybrid Ontological-Relational Data Repository for SIEM Systems

Abstract

Abstract:The technology of Security Information and Event Management (SIEM) becomes one of the most important research applications in the area of computer network security. The overall functionality of SIEM systems depends largely on the quality of solutions implemented at the data storage level, which is purposed for the representation of heterogeneous security events, their storage in the data repository, and the extraction of relevant data for analytical modules of SIEM systems. The paper discusses the key issues of design and implementation of a hybrid SIEM data repository, which combines relational and ontological data representations. Based on the analysis of existing SIEM systems and standards, the ontological approach is chosen as a core component of the repository, and an example of the ontological data model for vulnerabilities representation is outlined. The hybrid architecture of the repository is proposed for implementation in SIEM systems. Since the most of works on the repositories of SIEM systems is based on the relational data model, the paper focuses mainly on the ontological part of the hybrid approach. To test the repository we used the data model intended for attack modeling and security evaluation, which includes both ontological and relational dimensions.

An Ontology-based Storage of Security Information

“…In [10,14,41], the vulnerability-centric ontologies for security analysis are presented. In [23], the common approach to the ontological storage generation is introduced that we evolve in this paper. In [24], a security metrics ontology for security assessment is suggested.…”

Genomics big data hybrid depositories architecture to unlock precision medicine: a conceptual framework

“…In other words, it is impractical to utilize genomics big data without the support of big data technology. In the following section, the proposed genomics big data hybrid depositories system will be discussed based on the work by [100]- [102].…”

“…At the moment, there were no examples of the implemented and used hybrid depositories solely on genomicshealthcare big data with respect to personalized medicine. Therefore, for the purpose of this study, we adapt the concept for the architecture design of the genomics big data hybrid depositories from the work done by [100]. The issues that led to the designing of the hybrid ontologicalrelational data repository to enhance computer network security [106] were almost similar to the challenges that led to the need for genomics big data hybrid depositories.…”

Explorando Modelos Contextuais Híbridos: uma Abordagem Composicional

“…Em [Kotenko et al 2013]é apresentada uma abordagem de modelo híbrido de contexto para sistemas SIEM (Security Information and Events Management) que combina os modelos relacionais, baseados em XML e em ontologias. Os autores justificam que a representação relacional não permite especificar uma consulta parametrizada, por exemplo, com os nomes dos produtos e versões, para a análise de vulnerabilidades e processá-las no programa, o que torna este processo demorado.…”

“…Atualmente, as aplicações cientes de contexto tendem a tratar com dados de diferentes naturezas, onde os mesmos podem ser modelados utilizando diversas abordagens. Nesta perspectiva se observa uma tendência na utilização de repositórios com diferentes modelos de armazenamento, chamados de modelos híbridos [Kotenko et al 2013] [Perera et al 2014], pois muitas vezes a utilização de somente um modelo para armazenamento das informações contextuais acaba não sendo o ideal, por questões ligadas a desempenho, utilização de disco, entre outras [Carvalho 2014].…”