A description logic based approach for IDS security information management

The upsurge of network distributed denial of service (DDoS) attacks on computer networks demands great effort in network security management. Currently, intrusion detection systems (IDS) are used to secure computer networks. However, IDS may generate a huge volume of alerts, making it hard for security administrators to uncover hidden attack scenarios. In this paper, we propose a description logic-based approach for IDS event semantic analysis, which allows inferring attack scenarios and enabling the attack knowledge semantic queries. With an attack knowledge base consisting of Abox and Tbox, IDS alerts are converted into machine-understandable uniform alert streams. The ontology and attack instances of the attack knowledge base are applied to derive attack scenarios. Then the attack semantic query is implemented by the spreading activation technique, which enables administrators to query the intrusion states of the networks