Ontology-based distributed intrusion detection system

F. Abdoli, M. Kahani
2009 2009 14th International CSI Computer Conference  
In this paper we discussed about utilizing methods and techniques of semantic web in the Intrusion Detection Systems. To extract semantic relations between computer attacks and intrusions in a Distributed Intrusion Detection System, we use ontology. Protégé software is our selected software for building ontology. In addition, we utilized Jena framework to make interaction between MasterAgent and attacks ontology. Our Distributed Intrusion Detection System is a network which contains some
more » ... ts and a special MasterAgent. MasterAgent contains our proposed attacks ontology. Every time a IDSagent detects an attack or new suspected condition, it sends detection's report for MasterAgent. Therefore, it can extract the semantic relationship among computer attacks and suspected situations in the network with proposed ontology. Finally, the experience shows that the pruposed system reduced the rate of false positive and false negative. Keywords Ontology; Intrusion Detection System; Denial of Service attack I. 978-1-4244-4262-1/09/$25.00
doi:10.1109/csicc.2009.5349372 fatcat:tltbqowvjrgjzfhdjgxeobbauq