Ontologies-Based Automated Intrusion Response System
Automated intrusion response is an important problem in network security. Several Automated Intrusion Response Systems (AIRS) have been proposed to take over that task, but current proposals have limitations related to their adaptability to different intrusion sources, since they do not take into account the semantic of intrusion alerts coming from different Intrusion Detection Systems, with different formats and syntaxes. To solve this problem, this paper proposes an architecture for an AIRS based on ontologies, formal behavior specification languages and reasoning mechanisms, which automatically infers and executes the optimum response action when different security-events network detection sources detect security intrusions. This paper describes the system architecture as well as the inference process of the recommended and optimum responses.
KeywordsIntrusion Detection Mobile Agent Intrusion Detection System Inference Process Attack Graph
Unable to display preview. Download preview PDF.
- 1.Symantec Global Internet Security Threat Report. Trends for 2008, vol. XIV (2009)Google Scholar
- 2.Carver, C.A.: Adaptive Agent-Based Intrusion Response. Ph.D. Thesis, Texas A&M University (2001)Google Scholar
- 3.Foo, B., Wu, Y.-S., Mao, Y.-C., Bagchi, S., Spafford, E.: ADEPTS: Adaptive Intrusion Response Using Attack Graphs in an E-Commerce Environment. In: International Conference on Dependable Systems and Networks (DSN 2005), pp. 508–517 (2005)Google Scholar
- 4.Wang, Z.Q., Zhao, Q., Wang, H.Q., Yu, L.J.: MAIRF: An Approach Mobile Agents based Intrusion Response System. In: Proceedings of the 1st IEEE Conference on Industrial Electronics and Applications, pp. 1–4 (2006)Google Scholar
- 6.White, G.B., Fisch, E.A., Pooch, U.W.: Cooperating security managers: a peer-based intrusion detection system. IEEE Network, 20–23 (1996)Google Scholar
- 7.Porras, P.A., Neumann, P.G.: Emerald: Event monitoring enabling responses to anomalous live disturbances. In: NISSC, Baltimore, MD (1997)Google Scholar
- 9.Lang, B., Liu, J., Zheng, J.: The Research on Automated Intrusion Response System Based on Mobile Agents. In: Proceedings of the 8th International Conference on Computer Supported Cooperative Work in Design (2003)Google Scholar
- 11.Smith, K., Welty, C., McGuinness, D.L.: OWL Web Ontology Language Guide. W3C Recommendation, February 10 (2004)Google Scholar
- 12.Horrocks, P.F., Patel-Schneider, H., Boley, S., Tabet, B., Dean Grosof, M.: SWRL: A Semantic Web Rule Language Combining OWL and RuleML. W3C Submission (2004)Google Scholar
- 13.Bossam Rule/OWL Reasoner, http://bossam.wordpress.com (access date June 2010)