TY - GEN
T1 - An ontology-based approach to react to network attacks
AU - Cuppens-Boulahia, Nora
AU - Cuppens, Frédéric
AU - De Vergara, Jorge E.López
AU - Vázquez, Enrique
AU - Guerra, Javier
AU - Debar, Hervé
PY - 2008/12/1
Y1 - 2008/12/1
N2 - To address the evolution of security incidents in current communication networks it is important to react quickly and efficiently to an attack. The RED (Reaction after Detection) project is defining and designing solutions to enhance the detection/reaction process, improving the overall resilience of IP networks to attacks and help telecommunication and service providers to maintain sufficient quality of service and respect service level agreements. Within this project, a main component is in charge of instantiating new security policies that counteract the network attacks. This paper proposes an ontology-based approach to instantiate these security policies. This technology provides a way to map alerts into attack contexts, which are used to identify the policies to be applied in the network to solve the threat. For this, ontologies to describe alerts and policies are defined, using inference rules to perform such mappings.
AB - To address the evolution of security incidents in current communication networks it is important to react quickly and efficiently to an attack. The RED (Reaction after Detection) project is defining and designing solutions to enhance the detection/reaction process, improving the overall resilience of IP networks to attacks and help telecommunication and service providers to maintain sufficient quality of service and respect service level agreements. Within this project, a main component is in charge of instantiating new security policies that counteract the network attacks. This paper proposes an ontology-based approach to instantiate these security policies. This technology provides a way to map alerts into attack contexts, which are used to identify the policies to be applied in the network to solve the threat. For this, ontologies to describe alerts and policies are defined, using inference rules to perform such mappings.
KW - Attack reaction
KW - IDMEF
KW - OWL
KW - Ontology
KW - OrBAC
KW - Policy instantiation
KW - SWRL
U2 - 10.1109/CRISIS.2008.4757461
DO - 10.1109/CRISIS.2008.4757461
M3 - Conference contribution
AN - SCOPUS:63249101412
SN - 9781424433094
T3 - Proceedings 2008 3rd International Conference on Risks and Security of Internet and Systems, CRiSIS 2008
SP - 27
EP - 35
BT - Proceedings 2008 3rd International Conference on Risks and Security of Internet and Systems, CRiSIS 2008
T2 - 2008 3rd International Conference on Risks and Security of Internet and Systems, CRiSIS 2008
Y2 - 28 October 2008 through 30 October 2008
ER -