J Shanghai Jiaotong Univ Sci

Journal of shanghai Jiaotong University (Science) ›› 2013, Vol. 18 ›› Issue (5): 554-562.doi: 10.1007/s12204-013-1439-5

Previous Articles     Next Articles

Ontology-Based Model of Network and Computer Attacks for Security Assessment

Ontology-Based Model of Network and Computer Attacks for Security Assessment

GAO Jian-bo1 (高建波), ZHANG Bao-wen1* (张保稳), CHEN Xiao-hua2 (陈晓桦), LUO Zheng3 (罗 铮)   

  1. (1. School of Information Security Engineering, Shanghai Jiaotong University, Shanghai 200240, China; 2. General Office, China Information Security Certification Center, Beijing 100020, China; 3. Information Classified Security Protection Evaluation Center, Third Institute of Ministry of Public Security of China, Shanghai 201204, China)
  2. (1. School of Information Security Engineering, Shanghai Jiaotong University, Shanghai 200240, China; 2. General Office, China Information Security Certification Center, Beijing 100020, China; 3. Information Classified Security Protection Evaluation Center, Third Institute of Ministry of Public Security of China, Shanghai 201204, China)
  • Online:2013-10-31 Published:2013-12-05
  • Contact: ZHANG Bao-wen(张保稳) E-mail:zhangbw@sjtu.edu.cn

Abstract: With increased cyber attacks over years, information system security assessment becomes more and more important. This paper provides an ontology-based attack model, and then utilizes it to assess the information system security from attack angle. We categorize attacks into a taxonomy suitable for security assessment. The proposed taxonomy consists of five dimensions, which include attack impact, attack vector, attack target, vulnerability and defense. Afterwards we build an ontology according to the taxonomy. In the ontology, attack related concepts included in the five dimensions and relationships between them are formalized and analyzed in detail. We also populate our attack ontology with information from national vulnerability database (NVD) about the vulnerabilities, such as common vulnerabilities and exposures (CVE), common weakness enumeration (CWE), common vulnerability scoring system (CVSS), and common platform enumeration (CPE). Finally we propose an ontology-based framework for security assessment of network and computer systems, and describe the utilization of ontology in the security assessment and the method for evaluating attack effect on the system when it is under attack.

Key words: security assessment| formal analysis| taxonomy| ontology| attack effect

摘要： With increased cyber attacks over years, information system security assessment becomes more and more important. This paper provides an ontology-based attack model, and then utilizes it to assess the information system security from attack angle. We categorize attacks into a taxonomy suitable for security assessment. The proposed taxonomy consists of five dimensions, which include attack impact, attack vector, attack target, vulnerability and defense. Afterwards we build an ontology according to the taxonomy. In the ontology, attack related concepts included in the five dimensions and relationships between them are formalized and analyzed in detail. We also populate our attack ontology with information from national vulnerability database (NVD) about the vulnerabilities, such as common vulnerabilities and exposures (CVE), common weakness enumeration (CWE), common vulnerability scoring system (CVSS), and common platform enumeration (CPE). Finally we propose an ontology-based framework for security assessment of network and computer systems, and describe the utilization of ontology in the security assessment and the method for evaluating attack effect on the system when it is under attack.

关键词: security assessment| formal analysis| taxonomy| ontology| attack effect

CLC Number: