Ontology-Based Model of Network and Computer Attacks for Security Assessment

doi:10.1007/s12204-013-1439-5

上海交通大学学报（英文版） ›› 2013, Vol. 18 ›› Issue (5): 554-562.doi: 10.1007/s12204-013-1439-5

Ontology-Based Model of Network and Computer Attacks for Security Assessment

GAO Jian-bo1 (高建波), ZHANG Bao-wen1* (张保稳), CHEN Xiao-hua2 (陈晓桦), LUO Zheng3 (罗铮)

(1. School of Information Security Engineering, Shanghai Jiaotong University, Shanghai 200240, China; 2. General Office, China Information Security Certification Center, Beijing 100020, China; 3. Information Classified Security Protection Evaluation Center, Third Institute of Ministry of Public Security of China, Shanghai 201204, China)

出版日期:2013-10-31 发布日期:2013-12-05
通讯作者: ZHANG Bao-wen(张保稳) E-mail:zhangbw@sjtu.edu.cn

Ontology-Based Model of Network and Computer Attacks for Security Assessment

GAO Jian-bo1 (高建波), ZHANG Bao-wen1* (张保稳), CHEN Xiao-hua2 (陈晓桦), LUO Zheng3 (罗铮)

(1. School of Information Security Engineering, Shanghai Jiaotong University, Shanghai 200240, China; 2. General Office, China Information Security Certification Center, Beijing 100020, China; 3. Information Classified Security Protection Evaluation Center, Third Institute of Ministry of Public Security of China, Shanghai 201204, China)

Online:2013-10-31 Published:2013-12-05
Contact: ZHANG Bao-wen(张保稳) E-mail:zhangbw@sjtu.edu.cn

摘要/Abstract

摘要： With increased cyber attacks over years, information system security assessment becomes more and more important. This paper provides an ontology-based attack model, and then utilizes it to assess the information system security from attack angle. We categorize attacks into a taxonomy suitable for security assessment. The proposed taxonomy consists of five dimensions, which include attack impact, attack vector, attack target, vulnerability and defense. Afterwards we build an ontology according to the taxonomy. In the ontology, attack related concepts included in the five dimensions and relationships between them are formalized and analyzed in detail. We also populate our attack ontology with information from national vulnerability database (NVD) about the vulnerabilities, such as common vulnerabilities and exposures (CVE), common weakness enumeration (CWE), common vulnerability scoring system (CVSS), and common platform enumeration (CPE). Finally we propose an ontology-based framework for security assessment of network and computer systems, and describe the utilization of ontology in the security assessment and the method for evaluating attack effect on the system when it is under attack.

关键词: security assessment, formal analysis, taxonomy, ontology, attack effect

Abstract: With increased cyber attacks over years, information system security assessment becomes more and more important. This paper provides an ontology-based attack model, and then utilizes it to assess the information system security from attack angle. We categorize attacks into a taxonomy suitable for security assessment. The proposed taxonomy consists of five dimensions, which include attack impact, attack vector, attack target, vulnerability and defense. Afterwards we build an ontology according to the taxonomy. In the ontology, attack related concepts included in the five dimensions and relationships between them are formalized and analyzed in detail. We also populate our attack ontology with information from national vulnerability database (NVD) about the vulnerabilities, such as common vulnerabilities and exposures (CVE), common weakness enumeration (CWE), common vulnerability scoring system (CVSS), and common platform enumeration (CPE). Finally we propose an ontology-based framework for security assessment of network and computer systems, and describe the utilization of ontology in the security assessment and the method for evaluating attack effect on the system when it is under attack.

Key words: security assessment, formal analysis, taxonomy, ontology, attack effect

中图分类号:

TP 309

GAO Jian-bo1 (高建波), ZHANG Bao-wen1* (张保稳), CHEN Xiao-hua2 (陈晓桦), LUO Zheng3 (罗铮. Ontology-Based Model of Network and Computer Attacks for Security Assessment[J]. 上海交通大学学报（英文版）, 2013, 18(5): 554-562.

GAO Jian-bo1 (高建波), ZHANG Bao-wen1* (张保稳), CHEN Xiao-hua2 (陈晓桦), LUO Zheng3 (罗铮). Ontology-Based Model of Network and Computer Attacks for Security Assessment[J]. Journal of shanghai Jiaotong University (Science), 2013, 18(5): 554-562.

参考文献

[1] Igure V M, Willams R D. Taxonomies of attacks and vulnerabilities in computer systems [J]. IEEE Communications Surveys, 2008, 10(1): 6-19.
[2] Howard J D, Longstaff T A. A common language for computer security incidents [R]. California: Sandia National Laboratories, 1998.
[3] Alvarez G, Petrovic S. A taxonomy of Web attacks suitable for efficient encoding [J]. Computer & Security, 2003, 22(5): 435-449.
[4] Hansman S, Hunt R. A taxonomy of network and computer attacks [J]. Computers & Security, 2005, 24(1): 31-43.
[5] Simmons C, Ellis C, Shiva S, et al. AVOIDIT: A cyber attack taxonomy [R]. Memphis: University of Memphis, 2009.
[6] Raskin V, Hempelmann C F, Triezenberg K E, et al. Ontology in information security: A useful theoretical foundation and methodological tool [C]//Proceedings of the 2001 Workshop on New Security Paradigms. New York: NSPW, 2001: 53-59.
[7] Beitollahi H, Deconinck G. Analyzing well-known countermeasures against distributed denial of service attacks [J]. Computer Communications, 2012, 35(11): 1312-1332.
[8] Simmonds A, Sandilands P, Ekert L V. An ontology for network security attacks [C]//Proceedings of Second Asian Applied Computing Conference. Kathmandu, Nepal: AACC, 2004: 317-323.
[9] Wang J A, Guo M M, Camargo J. An ontological approach to computer system security [J]. Information Security Journal: A Global Perspective, 2010, 19(2): 61-73.
[10] Venter H S, Eloff J H P. A taxonomy for information security technologies [J]. Computers & Security, 2003, 22(4): 299-307.
[11] Herzog A, Shahmehri N, Duma C. An ontology of information security [J]. International Journal of Information Security and Privacy, 2007, 1(4): 1-23.
[12] Noy N F, Mc-Guinness D L. Ontology development 101: A guide to creating your first ontology [R]. Stanford: Stanford Knowledge Systems Laboratory, 2001.
[13] Blanco C, Lasheras J, Fernandez-Medina E. Basis for an integrated security ontology according to a systematic review of existing proposals [J]. Computers Standards & Interfaces, 2011, 33(4): 372-388.
[14] Baader F, Calvanese D, Mc-Guinness D L, et al. Description logic handbook: Theory, implementation and application [M]. Cambridge, UK: Cambridge University Press, 2003.
[15] Gruber T. Towards principles for the design of ontologies used for knowledge sharing [J]. International Journal of Human-Computer Studies, 1995, 43(5-6): 907-928.
[16] Vargas L G, Dougherty J J. The analytic hierarchy process and multicriterion decision making [J]. American Journal of Mathematical and Management Sciences, 1982, 19(1): 59-92.
[17] Holm H. Performance of automated network vulnerability scanning at remediating security issues [J]. Computers & Security, 2012, 31(2): 164-175.
[18] Hu Ying, Xian Ming, Xiao Shun-ping. Design of a DoS attack effect evaluation system [J]. Computer Engineering & Science, 2005, 27(2): 15-22 (in Chinese).

Ontology-Based Model of Network and Computer Attacks for Security Assessment

Ontology-Based Model of Network and Computer Attacks for Security Assessment

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 5

编辑推荐

Metrics

本文评价

[1]	LIU Li-zhen (刘丽珍), LIU Hao (刘昊), WANG Han-shi* (王函石),SONG Wei (宋巍), ZHAO Xin-lei. Generating Domain-Specific Affective Ontology from Chinese Reviews for Sentiment Analysis[J]. 上海交通大学学报（英文版）, 2015, 20(1): 32-37.
[2]	GU Chao-chen (谷朝臣), HU Jie* (胡洁), PENG Ying-hong (彭颖红). Research on Function Based Method for Bio-Inspiration Knowledge Modeling and Transformation[J]. 上海交通大学学报（英文版）, 2014, 19(2): 190-198.
[3]	TANG Qi (唐琪), WANG Ying-lin* (王英林), ZHANG Ming-lu (张明禄) . Ontology-Based Approach for Legal Provision Retrieval[J]. 上海交通大学学报（英文版）, 2012, 17(2): 135-140.
[4]	QIAO Bai-you (乔百友), WEI Yong (魏勇), WANG Xiao-yang (王潇杨) DING Lin-lin (丁琳琳), WANG. TDRM: A Peer-to-Peer-Based Taxonomy Data Ring Model[J]. 上海交通大学学报（英文版）, 2012, 17(2): 182-189.
[5]	CAO Xue (曹雪), CAI Hong-ming (蔡鸿明), BU Feng-lin (步丰林). Semantic Driven Design Reuse for 3D Scene Modeling[J]. 上海交通大学学报（英文版）, 2012, 17(2): 233-236.