Ontologies-Based Automated Intrusion Response System

  • Verónica Mateos Lanchas
  • Víctor A. Villagrá González
  • Francisco Romero Bueno
Part of the Advances in Intelligent and Soft Computing book series (AINSC, volume 85)


Automated intrusion response is an important problem in network security. Several Automated Intrusion Response Systems (AIRS) have been proposed to take over that task, but current proposals have limitations related to their adaptability to different intrusion sources, since they do not take into account the semantic of intrusion alerts coming from different Intrusion Detection Systems, with different formats and syntaxes. To solve this problem, this paper proposes an architecture for an AIRS based on ontologies, formal behavior specification languages and reasoning mechanisms, which automatically infers and executes the optimum response action when different security-events network detection sources detect security intrusions. This paper describes the system architecture as well as the inference process of the recommended and optimum responses.


Intrusion Detection Mobile Agent Intrusion Detection System Inference Process Attack Graph 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Symantec Global Internet Security Threat Report. Trends for 2008, vol. XIV (2009)Google Scholar
  2. 2.
    Carver, C.A.: Adaptive Agent-Based Intrusion Response. Ph.D. Thesis, Texas A&M University (2001)Google Scholar
  3. 3.
    Foo, B., Wu, Y.-S., Mao, Y.-C., Bagchi, S., Spafford, E.: ADEPTS: Adaptive Intrusion Response Using Attack Graphs in an E-Commerce Environment. In: International Conference on Dependable Systems and Networks (DSN 2005), pp. 508–517 (2005)Google Scholar
  4. 4.
    Wang, Z.Q., Zhao, Q., Wang, H.Q., Yu, L.J.: MAIRF: An Approach Mobile Agents based Intrusion Response System. In: Proceedings of the 1st IEEE Conference on Industrial Electronics and Applications, pp. 1–4 (2006)Google Scholar
  5. 5.
    Lewandowski, S.M., VanHook, D.J., O’Leary, G.C., Haines, J.W., Rossey, L.M.: SARA: Survivable Autonomic Response Architecture. In: Proceedings of DARPA Information Survivability Conference & Exposition II. DISCEX 2001, vol. 1, pp. 77–88. IEEE Computer Society, Anaheim (2001)CrossRefGoogle Scholar
  6. 6.
    White, G.B., Fisch, E.A., Pooch, U.W.: Cooperating security managers: a peer-based intrusion detection system. IEEE Network, 20–23 (1996)Google Scholar
  7. 7.
    Porras, P.A., Neumann, P.G.: Emerald: Event monitoring enabling responses to anomalous live disturbances. In: NISSC, Baltimore, MD (1997)Google Scholar
  8. 8.
    Stakhanova, N., Basu, S., Wong, J.: A Cost-sensitive model for preemptive intrusion response systems. In: Proceedings of the 21st International Conference on Advanced Networking and Applications, AINA 2007, pp. 428–435. IEEE Computer Society, Washington (2007)CrossRefGoogle Scholar
  9. 9.
    Lang, B., Liu, J., Zheng, J.: The Research on Automated Intrusion Response System Based on Mobile Agents. In: Proceedings of the 8th International Conference on Computer Supported Cooperative Work in Design (2003)Google Scholar
  10. 10.
    Studer, R., Benjamins, V.R., Fensel, D.: Knowledge Engineering: Principles and Methods. Data & Knowledge Engineering 25, 161–197 (1998)zbMATHCrossRefGoogle Scholar
  11. 11.
    Smith, K., Welty, C., McGuinness, D.L.: OWL Web Ontology Language Guide. W3C Recommendation, February 10 (2004)Google Scholar
  12. 12.
    Horrocks, P.F., Patel-Schneider, H., Boley, S., Tabet, B., Dean Grosof, M.: SWRL: A Semantic Web Rule Language Combining OWL and RuleML. W3C Submission (2004)Google Scholar
  13. 13.
    Bossam Rule/OWL Reasoner, (access date June 2010)

Copyright information

© Springer-Verlag Berlin Heidelberg 2010

Authors and Affiliations

  • Verónica Mateos Lanchas
    • 1
  • Víctor A. Villagrá González
    • 1
  • Francisco Romero Bueno
    • 2
  1. 1.Universidad Politécnica de MadridMadridSpain
  2. 2.Telefónica Research and Development (TID)MadridSpain

Personalised recommendations