Sharing information about security alerts using semantic web technologies

This paper presents a semantic web-based architecture to share alerts among Security Information Management Systems (SIMS). Such architecture is useful if two or more SIMS from different domains need to know information about alerts happening in the other domains, which is of vital importance for an early response to network incidents. For this, each SIMS has a knowledge base that contains the security alerts. This knowledge base can be queried from other SIMS, using standard semantic web protocols. To assess this architecture, both risk analysis and botnet detection use cases have been developed. The former one is based on the interoperability provided by this architecture. Rule-based reasoning is also used for the latter case. The performance of both use cases has been evaluated, providing some results.