Classifying network attack scenarios using an ontology

Van Heerden, Renier; Irwin, Barry V W; Burke, I D

Title: Classifying network attack scenarios using an ontology
Creator: Van Heerden, Renier
Creator: Irwin, Barry V W
Creator: Burke, I D
Date Issued: 2012
Date: 2012
Type: Conference paper
Identifier: vital:6606
Identifier: http://hdl.handle.net/10962/d1009326
Description: This paper presents a methodology using network attack ontology to classify computer-based attacks. Computer network attacks differ in motivation, execution and end result. Because attacks are diverse, no standard classification exists. If an attack could be classified, it could be mitigated accordingly. A taxonomy of computer network attacks forms the basis of the ontology. Most published taxonomies present an attack from either the attacker's or defender's point of view. This taxonomy presents both views. The main taxonomy classes are: Actor, Actor Location, Aggressor, Attack Goal, Attack Mechanism, Attack Scenario, Automation Level, Effects, Motivation, Phase, Scope and Target. The "Actor" class is the entity executing the attack. The "Actor Location" class is the Actor‟s country of origin. The "Aggressor" class is the group instigating an attack. The "Attack Goal" class specifies the attacker‟s goal. The "Attack Mechanism" class defines the attack methodology. The "Automation Level" class indicates the level of human interaction. The "Effects" class describes the consequences of an attack. The "Motivation" class specifies incentives for an attack. The "Scope" class describes the size and utility of the target. The "Target" class is the physical device or entity targeted by an attack. The "Vulnerability" class describes a target vulnerability used by the attacker. The "Phase" class represents an attack model that subdivides an attack into different phases. The ontology was developed using an "Attack Scenario" class, which draws from other classes and can be used to characterize and classify computer network attacks. An "Attack Scenario" consists of phases, has a scope and is attributed to an actor and aggressor which have a goal. The "Attack Scenario" thus represents different classes of attacks. High profile computer network attacks such as Stuxnet and the Estonia attacks can now be been classified through the “Attack Scenario” class.
Format: 14 pages
Format: pdf
Language: English
Relation: Van Heerden, R.P. and Irwin, Barry Vivian William and Burke, I.D. (2012) Classifying Network Attack Scenarios using an Ontology. In: 7th International Conference on Information Warfare and Security, University of Washington, 22-23 March, 2012, University of Washington, Seattle, USA..

Hits: 595
Visitors: 674
Downloads: 103

Collections

RU Department of Information Systems

Irwin, Barry W (Prof)

RU Department of Computer Science

SDG 09. Industry, Innovation and Infrastructure

		Thumbnail	File	Description	Size	Format
View Details Download			SOURCEPDF	PDF	360 KB	Adobe Acrobat PDF	View Details Download