The Evaluation Process of a Computer Security Incident Ontology

2nd Workshop on Ontologies and their Applications

Luciana A. F. Martimiano ; Edson Moreira

Others  :  http://CEUR-WS.org/Vol-199/wonto-06.pdf
PID  :  3907

来源: CEUR

【 摘 要 】

Ontologies have been developed and used by several researchers in different knowledge domains aiming to ease the structuring and management of knowledge, and to create a unique standard to represent concepts of such a knowledge domain. Considering the computer security domain, several tools can be used to manage and store security information. These tools generate a great amount of security alerts, which are stored in different formats. This lack of standard and the amount of data make the tasks of the security administrators even harder, because they have to understand, using their tacit knowledge, different security alerts to make correlation and solve security problems. Aiming to assist the administrators in executing these tasks efficiently, this paper presents the main features of the computer security incident ontology developed to model, using a unique standard, the concepts of the security incident domain, and how the ontology has been evaluated.