A Semantic Approach to Situational Awareness for Intrusion Detection
Loading...
Permanent Link
Author/Creator
Author/Creator ORCID
Date
2012-06-11
Department
Program
Citation of Original Publication
Sumit More, M. Lisa Mathews, Anupam Joshi, and Tim Finin, A Semantic Approach to Situational Awareness for Intrusion Detection, Proceedings of the National Symposium on Moving Target Research, June 2012.
Rights
This item is likely protected under Title 17 of the U.S. Copyright Law. Unless on a Creative Commons license, for uses protected by Copyright Law, contact the copyright holder or the author.
Abstract
We describe a situation-aware intrusion detection system that integrates heterogeneous sources of information to build and maintain a semantically rich knowledge-base about cyber threats and vulnerabilities. Most current intrusion detection and prevention systems rely on signature-based approaches to detect attacks. When an attack signature is not available, such as for a new exploit or a significantly modified known one, such systems are much less effective. Moreover, these intrusion detection systems are point-based solutions which do not make effective use of heterogeneous data sources, which can provide important information related to intrusions which are not yet available as signature patterns. This information can also help detect low-and-slow attacks in which small intrusions that are spatially and temporally apart combine to build a more elaborate attack.