Implementing a Semantic Approach for Events Correlation in SIEM Systems - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2018

Implementing a Semantic Approach for Events Correlation in SIEM Systems


Efficient reasoning in intrusion detection needs to manipulate different information provided by several analyzers in order to build a reliable overview of the underlying monitored system trough a central security information and event management system (SIEM). SIEM provides many functions to take benefit of collected data, such as Normalization, Aggregation, Alerting, Archiving, Forensic analysis, Dashboards, etc. The most relevant function is Correlation, when we can get a precise and quick picture about threats and attacks in real time. Since information provided by SIEM is in general structured and can be given in XML, we propose in this paper to use an ontological representation based on Description Logics (DLs) which is a powerful tool for knowledge representation and reasoning. Indeed, Ontology provides a comprehensive environment to represent any kind of information in intrusion detection. Moreover, basing on DLs and rules, Ontology is able to ensure a decidable reasoning. Basing on the proposed ontology, an alert correlation prototype is implemented and two attack scenarios are carried out to show the usefulness of the semantic approach.
Fichier principal
Vignette du fichier
467079_1_En_55_Chapter.pdf (315.4 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-01913909 , version 1 (07-11-2018)





Tayeb Kenaza, Abdelkarim Machou, Abdelghani Dekkiche. Implementing a Semantic Approach for Events Correlation in SIEM Systems. 6th IFIP International Conference on Computational Intelligence and Its Applications (CIIA), May 2018, Oran, Algeria. pp.648-659, ⟨10.1007/978-3-319-89743-1_55⟩. ⟨hal-01913909⟩
117 View
187 Download



Gmail Facebook X LinkedIn More