Collaborative Alert Analysis Based on Security Ontology
Xiao De-bao · 2009
Network users need a new integrated solution for network security management,or in other words,unified network security management.This paper discussed collaborative alert analysis,which is one of its key functionalities,and based on a sufficient understanding of research direction,a basic network security alert analysis model was then provided.As for collaborative alert analysis,the main problem is how to guarantee unified representation of context information,background knowledge and attack knowledge for security alerts.And the fact is that,a practical and efficient app-roach is still lacking these days,which influents the realization of unified network security management.This paper introduced the use of security ontology by means of OWL+SWRL based on CIM Schema for unified representation of information and knowledge,and aimed at proposing a promising approach to improve existing collaborative alert analysis techniques as an important stage to realize unified network security management.