An ontology-driven approach to model SIEM information and operations using the SWRL formalism

摘要: The management of security events, from the risk analysis to selection appropriate countermeasures, has become a major concern for analysts and IT administrators. Furthermore, fact that network system devices are heterogeneous, increases difficulty these administrative tasks. This paper introduces an ontology-driven approach address aforementioned problems. proposed model takes into account two aspects: information operations manipulated by SIEM environments in order reach desired goals. uses ontologies provide simplicity on description concepts, relationships instances domain. semantics web rule languages used describe logic rules needed infer among individuals classes. A case study Botnets is presented at end this illustrate concrete utilisation our model.