Application of Security Ontology to Context-Aware Alert Analysis

With rapid development of computer networks, users need a new solution for network security management, aiming at integration. This paper focuses on context-aware alert analysis, which is one of its key functionalities. A practical and efficient approach to guarantee unified representation of context information, background knowledge and attack knowledge for security alerts is still lacking these days. This paper applies security ontology by means of OWL+SWRL+OWL-S based on CIM schema to describe context information and security knowledge in a unified manner. We argue that, our proposed approach improves existing alert analysis techniques by providing formal representations with the use of security ontology, which may possibly be an important stage for implementation of unified network security management.