Intrusion Correlation Using Ontologies and Multi-agent Systems

This paper proposes an ontology model for representing intrusion detection events and prevention rules, integrating multiagent systems based on unsupervised and supervised techniques for classification, correlation and pattern recognition. The semantic model describes attacks signatures, reaction tasks, axioms with alerts communication and correlation; nevertheless we have developed the prevention architecture integrated with another security tools. This article focuses on the approach to incorporate semantic operations that facilitate alerts correlation process and providing the inference and reasoning to the ontology model.