%0 Conference Proceedings
%T Implementing a Semantic Approach for Events Correlation in SIEM Systems
%+ École Militaire Polytechnique [Alger] (EMP)
%A Kenaza, Tayeb
%A Machou, Abdelkarim
%A Dekkiche, Abdelghani
%Z Part 9: Semantic Web Services
%< avec comité de lecture
%( IFIP Advances in Information and Communication Technology
%B 6th IFIP International Conference on Computational Intelligence and Its Applications (CIIA)
%C Oran, Algeria
%Y Abdelmalek Amine
%Y Malek Mouhoub
%Y Otmane Ait Mohamed
%Y Bachir Djebbar
%I Springer International Publishing
%3 Computational Intelligence and Its Applications
%V AICT-522
%P 648-659
%8 2018-05-08
%D 2018
%R 10.1007/978-3-319-89743-1_55
%K SEIM
%K Monitoring
%K Intrusion detection
%K Alert correlation
%K Description logic
%K Rules based reasoning
%K Ontology
%K OWL
%Z Computer Science [cs]Conference papers
%X Efficient reasoning in intrusion detection needs to manipulate different information provided by several analyzers in order to build a reliable overview of the underlying monitored system trough a central security information and event management system (SIEM). SIEM provides many functions to take benefit of collected data, such as Normalization, Aggregation, Alerting, Archiving, Forensic analysis, Dashboards, etc. The most relevant function is Correlation, when we can get a precise and quick picture about threats and attacks in real time. Since information provided by SIEM is in general structured and can be given in XML, we propose in this paper to use an ontological representation based on Description Logics (DLs) which is a powerful tool for knowledge representation and reasoning. Indeed, Ontology provides a comprehensive environment to represent any kind of information in intrusion detection. Moreover, basing on DLs and rules, Ontology is able to ensure a decidable reasoning. Basing on the proposed ontology, an alert correlation prototype is implemented and two attack scenarios are carried out to show the usefulness of the semantic approach.
%G English
%Z TC 5
%2 https://inria.hal.science/hal-01913909/document
%2 https://inria.hal.science/hal-01913909/file/467079_1_En_55_Chapter.pdf
%L hal-01913909
%U https://inria.hal.science/hal-01913909
%~ IFIP-LNCS
%~ IFIP
%~ IFIP-AICT
%~ IFIP-TC
%~ IFIP-TC5
%~ IFIP-CIIA
%~ IFIP-AICT-522