Implementing a Semantic Approach for Events Correlation in SIEM Systems - Computational Intelligence and Its Applications Access content directly
Conference Papers Year : 2018

Implementing a Semantic Approach for Events Correlation in SIEM Systems

Abstract

Efficient reasoning in intrusion detection needs to manipulate different information provided by several analyzers in order to build a reliable overview of the underlying monitored system trough a central security information and event management system (SIEM). SIEM provides many functions to take benefit of collected data, such as Normalization, Aggregation, Alerting, Archiving, Forensic analysis, Dashboards, etc. The most relevant function is Correlation, when we can get a precise and quick picture about threats and attacks in real time. Since information provided by SIEM is in general structured and can be given in XML, we propose in this paper to use an ontological representation based on Description Logics (DLs) which is a powerful tool for knowledge representation and reasoning. Indeed, Ontology provides a comprehensive environment to represent any kind of information in intrusion detection. Moreover, basing on DLs and rules, Ontology is able to ensure a decidable reasoning. Basing on the proposed ontology, an alert correlation prototype is implemented and two attack scenarios are carried out to show the usefulness of the semantic approach.
Fichier principal
Vignette du fichier
467079_1_En_55_Chapter.pdf (315.4 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01913909 , version 1 (07-11-2018)

Licence

Attribution

Identifiers

Cite

Tayeb Kenaza, Abdelkarim Machou, Abdelghani Dekkiche. Implementing a Semantic Approach for Events Correlation in SIEM Systems. 6th IFIP International Conference on Computational Intelligence and Its Applications (CIIA), May 2018, Oran, Algeria. pp.648-659, ⟨10.1007/978-3-319-89743-1_55⟩. ⟨hal-01913909⟩
121 View
190 Download

Altmetric

Share

Gmail Facebook X LinkedIn More