Skip to main content
SpringerLink
Log in

Description of a Network Attack Ontology Presented Formally

  • Chapter
  • First Online:
Artificial Intelligence for Cyber Security: Methods, Issues and Possible Horizons or Opportunities

Part of the book series: Studies in Computational Intelligence ((SCI,volume 972))

  • 1089 Accesses

Abstract

The identification of network attacks in real-time is becoming increasingly important. Most Artificial Intelligence (AI) applications use machine learning to do the classification of attack types but the advantage of an ontological approach is that automated reasoning is the underpinning theory rather than automated learning. Automated reasoners allow automated classification and this powerful feature is the basis for the developing of an early warning system for active network attacks. In this paper, the authors describe how to employ Semantic Technologies by building an ontology to identify network attack types in order to support the automated classification of current network attacks by recognising relevant properties which are then mapped to relevant attack scenarios depicted in the ontology. The classes and relationships of the ontology are described formally and implemented in Protégé, an ontology editor. The Attack Scenario class, a core class of the ontology, represents types of network attacks, for example, a Denial of Service attack. The ontology is evaluated by showing three examples of real attacks that are correctly classified by the presented ontology.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 219.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 279.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info
Hardcover Book
USD 279.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Balepin, I., Maltsev, S., Rowe, J., & Levitt, K. (2003). Using specification-based intrusion detection for automated response. In Recent advances in intrusion detection (pp. 136–154).

    Google Scholar 

  2. Gruber, T. R. (1993). A translation approach to portable ontology specifications. Knowledge Acquisition, 5(2), 199–220.

    Article  Google Scholar 

  3. Noy, N. F., & McGuinness, D. (2001). Ontology development 101: A guide to creating your first ontology. Technical report KSL-01-05, SMI-2001-0880, Stanford Knowledge Systems Laboratory and Stanford Medical Informatics Technical Report

    Google Scholar 

  4. Velasco, D., & Rodriguez, G. (2017). Ontologies for network security and future challenges. arXiv:abs/1704.02441.

  5. Abioye, T. E., Arogundade, O. T., Misra, S., Akinwale, A. T., & Adeniran, O. J. (2020). Toward ontology-based risk management framework for software projects: An empirical study. Journal of Software: Evolution and Process, 32(12),

    Google Scholar 

  6. van Heerden, R. P., Burke, I.D., & Irwin, B. (2012). Classifying network attack scenarios using an ontology. In Proceedings of ICIW 2012 the 7th International Conference on Information-Warfare & Security (pp. 311–324).

    Google Scholar 

  7. Simmonds, A., Sandilands, P., & van Ekert, L. (2004). An ontology for network security attacks. In S. Manandhar, J. Austin, U. Desai, Y. Oyanagi et al. (Eds.), Applied computing (pp. 317–323). Springer.

    Google Scholar 

  8. Tariq, M. A., Joel, Brynielsson, J., & Artman, H. (2012). Framing the attacker in organized cybercrime. In European Intelligence and Security Informatics Conference. IEEE.

    Google Scholar 

  9. Brynielsson, J., Franke, U., Tariq, M. A., & Varga, S. (2016). Using cyber defense exercises to obtain additional data for attacker profiling. In IEEE Conference on Intelligence and Security Informatics (ISI). IEEE.

    Google Scholar 

  10. Gheyas, I. A., & Abdallah, A. E. (2016). Detection and prediction of insider threats to cyber security: A systematic literature review and meta-analysis. Big Data Analytics, 1(1), 6.

    Article  Google Scholar 

  11. Undercoffer, J., Pinkston, J., Joshi, A., & Finin, T. (2004). A target-centric ontology for intrusion detection. In 18th International Joint Conference on Artificial Intelligence (pp. 9–15).

    Google Scholar 

  12. Syed, Z., Padia, A., Finin, T., Mathews, L., & Joshi, A. (2016). UCO: A unified cybersecurity ontology. In UMBC Student Collection.

    Google Scholar 

  13. Dreyfuss, R. C., & Lobel, O. (2016). Economic espionage as reality or rhetoric: Equating trade secrecy with national security. Lewis & Clark Law Review, 20, 419.

    Google Scholar 

  14. Kim, A. C. (2018). Prosecuting Chinese Spies: An empirical analysis of the economic espionage act. Cardozo Law Review, 40, 749.

    Google Scholar 

  15. Mozzaquatro, B. A., Agostinho, C., Goncalves, D., Martins, J., & Jardim-Goncalves, R. (2018). An ontology-based cybersecurity framework for the Internet of Things. Sensors, 18(9), 3053.

    Article  Google Scholar 

  16. Riesco, R., & Villagrá, V. A. (2019). Leveraging cyber threat intelligence for a dynamic risk framework. International Journal of Information Security, 18(6), 715–739.

    Article  Google Scholar 

  17. Doynikova, E., Fedorchenko, A., & Kotenko, I.(2019). Ontology of metrics for cyber security assessment. In Proceedings of the 14th International Conference on Availability, Reliability and Security (pp. 1–8).

    Google Scholar 

  18. Simmonds, A., Sandilands, P., & Van Ekert, L. (2004). An ontology for network security attacks. In Asian Applied Computing Conference (pp. 317–323). Springer.

    Google Scholar 

  19. Arunadevi, M., & Perumal, S. K. (2016). Ontology based approach for network security. In 2016 International Conference on Advanced Communication Control and Computing Technologies (ICACCCT) (pp. 573–578).

    Google Scholar 

  20. Yuan, P., Zeng, Q., & Ding, X. (2015). Hardware-assisted fine-grained code-reuse attack detection. In International Symposium on Recent Advances in Intrusion Detection (pp. 66–85). Springer.

    Google Scholar 

  21. Hansman, S. (2003). A taxonomy of network and computer attack methodologies. Master’s thesis, Department of Computer Science and Software Engineering, University of Canterbury, New Zealand.

    Google Scholar 

  22. Patel, S. K., & Sonker, A. (2016). Rule-based network intrusion detection system for port scanning with efficient port scan detection rules using snort. International Journal of Future Generation Communication and Networking, 9(6), 339–350.

    Article  Google Scholar 

  23. Ben-Asher, N., Oltramari, A., Erbacher, R. F., and Gonzalez, C. (2015). Ontology-based adaptive systems of cyber defense. In STIDS (pp. 34–41).

    Google Scholar 

  24. Ghiëtte, V., Blenn, N., & Doerr, C. (2016). Remote identification of port scan toolchains. In 2016 8th IFIP International Conference on New Technologies, Mobility and Security (NTMS) (pp. 1–5). IEEE.

    Google Scholar 

  25. Simon, K. (2016). Vulnerability analysis using Google and Shodan. In International Conference on Cryptology and Network Security (pp. 725–730). Springer.

    Google Scholar 

  26. Singh, P., Thevar, K., Shetty, P., & Shaikh, B. (2015). Detection of SQL injection and XSS vulnerability in web application. International Journal of Engineering and Applied Sciences, 2(3).

    Google Scholar 

  27. Mereani, F. A., & Howe, J.M. (2018). Detecting cross-site scripting attacks using machine learning. In International Conference on Advanced Machine Learning Technologies and Applications (pp. 200–210). Springer.

    Google Scholar 

  28. Azeez, N. A., Ayemobola, T. J., Misra, S., Maskeliūnas, R., & Damaševičius, R. (2019). Network intrusion detection with a hashing based Apriori algorithm using Hadoop MapReduce. Computers, 8(4), 86.

    Article  Google Scholar 

  29. Azeez, N. A., Salaudeen, B. B., Misra, S., Damaševičius, R., & Maskeliūnas, R. (2020). Identifying phishing attacks in communication networks using URL consistency features. International Journal of Electronic Security and Digital Forensics, 12(2), 200–213.

    Article  Google Scholar 

  30. Yusof, A. R. A., Udzir, N. I., & Selamat, A. (2019). Systematic literature review and taxonomy for DDoS attack detection and prediction. International Journal of Digital Enterprise Technology, 1(3), 292–315.

    Google Scholar 

  31. Liu, R., Vellaithurai, C., Biswas, S. S., Gamage, T. T., & Srivastava, A. K. (2015). Analyzing the cyber-physical impact of cyber events on the power grid. IEEE Transactions on Smart Grid, 6(5), 2444–2453.

    Article  Google Scholar 

  32. Thakur, K., Ali, M. L., Jiang, N., & Qiu, M. (2016). Impact of cyber-attacks on critical infrastructure. In 2016 IEEE 2nd International Conference on Big Data Security on Cloud (BigDataSecurity), IEEE International Conference on High Performance and Smart Computing (HPSC), and IEEE International Conference on Intelligent Data and Security (IDS) (pp. 183–186).

    Google Scholar 

  33. Pogrebna, G., & Skilton, M. (2019). A sneak peek into the motivation of a cybercriminal. In Navigating new cyber risks (pp. 31–54). Springer.

    Google Scholar 

  34. Rege, A., Obradovic, Z., Asadi, N., Singer, B., & Masceri, N. (2017). A temporal assessment of cyber intrusion chains using multidisciplinary frameworks and methodologies. In 2017 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (Cyber SA) (pp. 1–7). IEEE.

    Google Scholar 

  35. Pei, K., Gu, Z., Saltaformaggio, B., Ma, S., Wang, F., Zhang, Z., Si, L., Zhang, X., & Xu, D. (2016). Hercule: attack story reconstruction via community discovery on correlated log graph. In Proceedings of the 32nd Annual Conference on Computer Security Applications (pp. 583–595).

    Google Scholar 

  36. Asadi, N., Rege, A., & Obradovic, Z. (2018). Analysis of adversarial movement through characteristics of graph topological ordering. In 2018 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (Cyber SA) (pp. 1–6). IEEE.

    Google Scholar 

  37. Subairu, S. O., Alhassan, J., Misra, S., Abayomi-Alli, O., Ahuja, R., Damasevicius, R., & Maskeliunas, R. (2020). An experimental approach to unravel effects of malware on system network interface. In Advances in data sciences, security and applications (pp. 225–235). Springer.

    Google Scholar 

  38. Warren, P., Kaivanto, K., & Prince, D. (2018). Could a cyber attack cause a systemic impact in the financial sector? Bank of England Quarterly Bulletin, 58(4), 21–30.

    Google Scholar 

  39. Irmak, E., & Erkek, İ. (2018). An overview of cyber-attack vectors on SCADA systems. In 2018 6th International Symposium on Digital Forensic and Security (ISDFS) (pp. 1–5). IEEE.

    Google Scholar 

  40. Sigler, K. (2018). Crypto-jacking: how cyber-criminals are exploiting the crypto-currency boom. Computer Fraud & Security, 2018(9), 12–14.

    Article  Google Scholar 

  41. Mansfield-Devine, S. (2015). The growth and evolution of DDoS. Network Security, 2015(10), 13–20.

    Article  Google Scholar 

  42. Piggin, R. (2016). Cyber security trends: What should keep CEOs awake at night. International Journal of Critical Infrastructure Protection, 13, 36–38.

    Article  Google Scholar 

  43. Whitler, K. A., & Farris, P. W. (2017). The impact of cyber attacks on brand image: Why proactive marketing expertise is needed for managing data breaches. Journal of Advertising Research, 57(1), 3–9.

    Article  Google Scholar 

  44. Comer, D. E. (2018). The Internet book: Everything you need to know about computer networking and how the Internet works (5th ed.). CRC Press.

    Google Scholar 

  45. Edwards, B. J. (2016). Evidence-based Cybersecurity: Data-driven and abstract models (Doctoral dissertation, The University of New Mexico).

    Google Scholar 

  46. Al-Mhiqani, M. N., Ahmad, R., Yassin, W., Hassan, A., Abidin, Z. Z., Ali, N. S., et al. (2018). Cyber-security incidents: A review cases in cyber-physical systems. International Journal of Advanced Computer Science and Applications, 9(1), 499–508.

    Google Scholar 

  47. Simmonds, A., Sandilands, P., & van Ekert, L. (2004). An ontology for network security attacks. In S. Manandhar, J. Austin, U. Desai, Y. Oyanagi et al. (Eds.), Applied computing (pp. 317–323). Springer.

    Google Scholar 

  48. Burnap, P., French, R., Turner, F., & Jones, K. (2018). Malware classification using self organising feature maps and machine activity data. Computers & Security, 73, 399–410.

    Google Scholar 

  49. Al-Mohannadi, H., Mirza, Q., Namanya, A., Awan, I., Cullen, A., & Disso, J. (2016). Cyber-attack modeling analysis techniques: An overview. In 2016 IEEE 4th International Conference on Future Internet of Things and Cloud Workshops (FiCloudW) (pp. 69–76). IEEE.

    Google Scholar 

  50. Shah, S., & Mehtre, B. M. (2015). An overview of vulnerability assessment and penetration testing techniques. Journal of Computer Virology and Hacking Techniques, 11(1), 27–49.

    Article  Google Scholar 

  51. Arogundade, O. T., Abioye, T. E., & Sanjay, M. (2020). An ontological approach to threats pattern collection and classification: A preliminary study to security management. International Journal of Electronic Security and Digital Forensics, 12(3), 323–335.

    Article  Google Scholar 

  52. Mahjabin, T., Xiao, Y., Sun, G., & Jiang, W. (2017). A survey of distributed denial-of-service attack, prevention, and mitigation techniques. International Journal of Distributed Sensor Networks, 13(12).

    Google Scholar 

  53. Hou, T., & Wang, V. (2020). Industrial espionage—A systematic literature review (SLR). Computers & Security.

    Google Scholar 

  54. Maggi, F., Balduzzi, M., Flores, R., Gu, L., & Ciancaglini, V. (2018). Investigating web defacement campaigns at large. In Proceedings of the 2018 on Asia Conference on Computer and Communications Security (pp. 443–456).

    Google Scholar 

  55. Gupta, R., & Agarwal, S. P. (2017). A comparative study of cyber threats in emerging economies. Globus: An International Journal of Management & IT, 8(2), 24–28.

    Google Scholar 

  56. Scharffe, F., & de Bruijn, J.(2005). A language to specify mappings between ontologies. In Proceedings of the 1st International Conference on Signal-Image Technology and Internet-Based Systems, (SITIS 2005), November 27–December 1. Dicolor Press.

    Google Scholar 

  57. Davies, J., Studer, R., & Warren, P. (2006). Semantic web technologies (pp. 4118). Wiley.

    Google Scholar 

  58. Chaudhri, V. K., Farquhar, A., Fikes, R., Karp, P. D., et al. (1998). OKBC: A programmatic foundation for knowledge base interoperability. In Proceedings of the National Conference on Artificial Intelligence (pp. 600–607).

    Google Scholar 

  59. Wang, A., Chang, W., Chen, S., & Mohaisen, A. (2018). Delving into internet DDoS attacks by botnets: Characterization and analysis. IEEE/ACM Transactions on Networking (TON), 26(6).

    Google Scholar 

  60. Saied, A., Overill, R. E., & Radzik, T. (2016). Detection of known and unknown DDoS attacks using artificial neural networks. Neurocomputing, 172, 385–393.

    Article  Google Scholar 

  61. Santanna, J. J., van Rijswijk-Deij, R., Hofstede, R., Sperotto, A., Wierbosch, M., Granville, L.Z., & Pras, A. (2015). Booters—An analysis of DDoS-as-a-service attacks. In 2015 IFIP/IEEE International Symposium on Integrated Network Management (IM) (pp. 243–251). IEEE.

    Google Scholar 

  62. Dayanandam, G., Rao, T. V., Babu, D. B., & Durga, S. N. (2019). DDoS attacks—Analysis and prevention. In Innovations in Computer Science and Engineering (pp. 1–10). Springer.

    Google Scholar 

  63. Deshmukh, R. V., & Devadkar, K. K. (2015). Understanding DDoS attack and its effect in cloud environment. Procedia Computer Science, 49, 202–210.

    Article  Google Scholar 

  64. Shamsolmoali, P., Zareapoor, M., & Alam, M. A. (2017). Multi-aspect DDOS detection system for securing cloud network. In Handbook of research on end-to-end cloud computing architecture design (pp. 222–252). IGI Global.

    Google Scholar 

  65. Miao, L., Ding, W., & Gong, J. (2015). A real-time method for detecting internet-wide SYN flooding attacks. In The 21st IEEE International Workshop on Local and Metropolitan Area Networks (pp. 1–6). IEEE.

    Google Scholar 

  66. Wen, W., Ceccagnoli, M., & Forman, C. (2016). Opening up intellectual property strategy: Implications for open source software entry by start-up firms. Management Science, 62(9), 2668–2691.

    Article  Google Scholar 

  67. Gupta, B. B., & Badve, O. P. (2017). Taxonomy of DoS and DDoS attacks and desirable defense mechanism in a cloud computing environment. Neural Computing and Applications, 28(12).

    Google Scholar 

  68. Wong, F., & Tan, C. X. (2014). A survey of trends in massive DDoS attacks and cloud-based mitigations. International Journal of Network Security & Its Applications, 6(3), 57.

    Article  Google Scholar 

  69. Westerlund, M., Craigen, D., Bailetti, T., & Agwae, U. (2019). A three-vector approach to blind spots in cybersecurity. In Advanced methodologies and technologies in system security, information privacy, and forensics (pp. 93–104). IGI Global.

    Google Scholar 

  70. Hammi, B., Zeadally, S., & Khatoun, R. (2019). An empirical investigation of Botnet as a service for cyberattacks. Transactions on Emerging Telecommunications Technologies, 30(3).

    Google Scholar 

  71. Oxford Analytica: Audacity of SolarWinds hack will harden Western policy, Expert Briefings (2020). https://doi.org/10.1108/oxan-es258311.

  72. Panettieri, J. (2020). SolarWinds orion hack: SUNBURST security incident Timeline, Channelle22.

    Google Scholar 

  73. Kreb, B. (2020). Malicious domain in SolarWinds hack turned into ‘Killswitch’. Krebs on Security.

    Google Scholar 

  74. Assal, H., & Chiasson, S. (2018). Security in the software development lifecycle. In Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018) (pp. 281–296).

    Google Scholar 

  75. Microsoft Threat Intelligence Center (MSTIC): Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers, Microsoft (2020).

    Google Scholar 

  76. Polatidis, N., Pimenidis, E., Pavlidis, M., Papastergiou, S., & Mouratidis, H. (2018). From product recommendation to cyber-attack prediction: Generating attack graphs and predicting future attacks. Evolving Systems, 1–12.

    Google Scholar 

  77. Omitola, T., & Wills, G. (2018). Towards mapping the security challenges of the Internet of Things (IOT) supply chain. Procedia Computer Science, 126, 441–450.

    Article  Google Scholar 

  78. Arogundade, O. T., Abayomi-Alli, A., & Misra, S. (2020). An ontology-based security risk management model for information systems. Arabian Journal for Science and Engineering, 1–16.

    Google Scholar 

  79. Robinson, M., Jones, K., & Janicke, H. (2015). Cyber warfare: Issues and challenges. Computers & Security, 49, 70–94.

    Article  Google Scholar 

  80. Yeboah-Ofori, A., & Islam, S. (2019). Cyber security threat modeling for supply chain organizational environments. Future Internet, 11(3), 63.

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. University of the Western Cape, Bellville, South Africa

    Renier van Heerden & Louise Leenen

  2. Council for Scientific and Industrial Research, Pretoria, South Africa

    Renier van Heerden

  3. Noroff School of Technology and Digital Media, Oslo, Norway

    Barry Irwin

Authors
  1. Renier van Heerden
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Louise Leenen
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Barry Irwin
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Renier van Heerden .

Editor information

Editors and Affiliations

  1. Center of ICT/ICE, Covenant University, Ota, Nigeria

    Sanjay Misra

  2. Vellore Institute of Technology, Chennai, Tamil Nadu, India

    Amit Kumar Tyagi

Rights and permissions

Reprints and permissions

Copyright information

© 2021 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this chapter

Check for updates. Verify currency and authenticity via CrossMark

Cite this chapter

van Heerden, R., Leenen, L., Irwin, B. (2021). Description of a Network Attack Ontology Presented Formally. In: Misra, S., Kumar Tyagi, A. (eds) Artificial Intelligence for Cyber Security: Methods, Issues and Possible Horizons or Opportunities. Studies in Computational Intelligence, vol 972. Springer, Cham. https://doi.org/10.1007/978-3-030-72236-4_14

Download citation

Publish with us

Policies and ethics

Search

Navigation