An Efficient Network Security System through an Ontology Approach

A.H.Azni1 , Madihah Mohd Saudi2, Azreen Azman3, Emran Mohd Tamil4, Mohd Yamani Idna Idris5
1
ahazni@[Link], 2madihah@[Link], 3azreen@[Link], 4emran@[Link], 5yamani@[Link],
1,2,3
Universiti Sains Islam Malaysia, Bandar Baru Nilai, Malaysia
4,5
Universiti Malaya, Petaling Jaya, Malaysia

Abstract - Ontology analysis has been shown to be an effective 2. Background

first step in the construction of robust knowledge based
system. Moreover, the popularity of semantic technologies
and the semantic web has provided several beneficial 2.1 Artificial Immune Systems
opportunities for the modeling and computer security
communities of interest. This paper describes the role of Immune System’s main function is to protect our bodies against
ontologies in facilitating network security modeling. It constant attack of external microorganisms. It specifically
outlines the technical challenges in distributed network recognizes and selectively eliminates foreign invaders by a
security simulation modeling and describes how ontology- process known as the immune response [1]. The bodies identify
based methods may be applied to address these challenges. the invaders using two interrelate systems: innate and adaptive
The paper concludes by describing an ontology-based solution immune systems [3]. The former has the ability to recognize
framework for network security simulation modeling and certain microbes and immediately destroy them. Whereas the
analysis and outlining the benefits of this solution approach. adaptive immune system uses somatically generated antigen
receptors generated by random process by concatenating gene
segments. Each cell uses available segments differently to make a
1. Introduction unique receptor, allowing the cells to collectively recognize
malicious organisms confronted during a lifetime [3].
In the last few years, Artificial Immune Systems (AIS) have These attractive features of human immune system have led the
become an increasingly popular computational intelligence researchers to deploy the strengths from human immune system
paradigm. AIS use observed immune components and processes into wide range of application domains such as document
as metaphors to produce systems that encapsulate a number of classification, robotics, fraud detection, character recognition and
desirable properties of the natural system. These systems are then network and hostbased intrusion detections. These AISs have met
applied to solve problems in a wide variety of domains. There are with some success and in many cases have rivaled or bettered
a number of motivations for using the immune system as existing statistical and machine leaning technique [4]. Mimicking
inspiration for many domains, such as recognition, diversity, the immune system in protecting our bodies and fighting against
memory, selfregulation, dynamic protection and learning [1]. invading pathogens are analogous to defending the system and
Ontology, on the other hand, is “a formal, explicit specification network against attack in system. From the literature survey, most
of shared conceptualization” [2]. In this regards, ontologies can be network security works that deploy AIS fall under two different
thought of as semantic primitives that specify a particular domain approaches, which are negative selection and Jerne’s idiotypic
of knowledge. The main advantage for having such formal network theory [4].
specification is to facilitate the knowledge sharing and reuse
among the various parties interested in that particular domain of 2.2 Nature of Ontology
knowledge.
Having a set of standardized ontologies for network security
system will enhance the interoperability between the various
An ontology is an inventory of the kinds of entities that exist in
network security systems. It will also serve as a basis for building
a domain, their salient properties, and the salient relationships that
more specialized ontologies, for example, an ontology for
can hold between them [5]. Every domain – typically, in this
building severity level of foreign element model. Using the
context, some piece of the actual world such as a manufacturing
ontology for developing network security system will result in a
system, a university, a business – has its own ontology, which we
reusable, easy to integrate knowledge bases.
refer to simply as a domain ontology. In a domain ontology, we
In the next section, we will discuss the ontology and AIS in
define various kinds of objects (e.g., tools and employees),
detail. We will first introduce ontologies and outline the
properties (e.g., being made of metal or having three children),
motivations for ontology development and the benefits of
and relations between kinds and their instances (e.g., part of or
ontology development. In the third section, we will describe
married to)
methodology used in building ontology. In section four, we will
Ontology development focuses on extracting the essential
describe an application of network security assessment.
nature of the concepts in any domain and representing this
Here, we will introduce the role of ontologies in the network
knowledge in a structured manner. The construction of ontology
security model development process. At last, we will conclude
differs from traditional information capture activities in the depth
with a summary of the significance and benefits of this research.
and breadth of the information captured. Thus, an ontology
development exercise will expand beyond asserting the mere

267
978-1-4244-3397-1/08/$25.00 ©2008 IEEE

Authorized licensed use limited to: Annamalai University. Downloaded on July 1, 2009 at 07:16 from IEEE Xplore. Restrictions apply.
existence of relations in a domain; the relations are “axiomatized” ontological information in which can be put several uses for
within an ontology (i.e., the behavior of the relation is explicitly multiple application situations.
documented). Ontology development is motivated not so much by Ontologies are important for intelligent systems development
the search for knowledge for its own sake (as, ideally, in the for several reasons, including the following:
natural and abstract science), but the need to understand, design, • Ontological analysis has been shown to be an effective
engineer, and manage such system effectively. first step in the construction of robust knowledge based
Important research issues in ontology management include system [9]. Current and future intelligent systems
determining the appropriate scope and granularity of ontologies, (including modeling network security application) will
standardization and automation of the process of relating different take advantage of knowledge based and expert systems
ontologies, use of natural language processing for ontology technology.
comparisons, and the use of ontologies as a basis of defining • Ontologies will be required to develop standard,
model repositories [6]. reusable application and domain reference models.
Standard ontology reference models such as Suggested
2.3 Motivation for Using Ontologies in Network Upper Merge Ontology (SUMO) are available on the
Security Simulation Modeling internet.
• Ontologies are at the heart of software systems that
Knowledge-intensive approaches to network security facilitate knowledge sharing. The importance of
simulation modeling required the acquisition, storage, knowledge sharing is evidenced by the large body of
maintenance, and application of highly structured knowledge, research directed toward the development of tools and
including ontologies. Ontologies are useful across the network methods to support a knowledge sharing approach to
simulation security modeling and lifecycle, particularly in the integration [10][11].
problem analysis and conceptual model design phase. With
increased used of distributed intelligence approaches to semantic Some benefits of having an ontology-driven approach to
application, ontologies play a critical role in simulation network security as diccused by [12], are that this approach
integration and simulation composability. In particular, ontologies allows one to discover concepts and relationship by either
are essential in facilitating simulation model interoperability, browsing through small ontologies or querying large ontologies
composition, and information exchange at the semantic level. using customized query languages (sparql query) visualize the
One of the key motivations for distributed, federated simulation structure classes, objects, concepts and relationship using
modeling is to allow for the decomposition of the overall system commercially or open source available visualization tools take
model into smaller, more manageable components, and to advantage of ontological descriptions in all phases of network
distribute the model development effort among different security modeling improve the efficiency of multi-modeling or
organizations or functional groups [7]. Once the component component-based modeling, if ontologies of all components are
simulation models have been developed, there is a need for available.
mechanism to assemble a simulation model of the entire target
system in a manner that the “whole (system) = of its 3. Method For Ontology Development
components”. A key technical challenge is modeling and
simulation composability (from a set of independently developed At present developing ontologies is an art rather than a science.
components). Composability is the capability to select and This situation is changing with advent of well defined ontology
assemble simulation components in various combinations into development methodologies [13]. Methodology refers to the
network security simulation systems to satisfy specific user techniques and methods to be followed in order to develop an
requirements [8]. The components to be composed are often ontology. A number of methodologies have been suggested to
drawn from a repository. Composability enables users to combine, develop ontologies [14]. In order to attain the stated goal, the
recombine, and configure or reconfigure components in numerous methodology for developing network security simulation
ways to satisfy their diverse needs and requirements. There are modeling is proposed which is consists of six steps: 1) Identifying
two forms of composability; syntactic and semantic. Syntactic the purpose, 2) Ontology capture, 3) Coding, 4) Refinement, 5)
composability deals with the compatibility of implementation Testing, and 6) Maintenance.
details such as parameter passing mechanisms. Semantic
composability, on the other hand, deals with the validity and
usefulness of composed simulation models [8]. 3.1 Identify the Purpose to Develop Ontology
At this step, three questions need to answer: i) why is the
2.4 Benefits of Ontology Development ontology being built? ii) what is its intended use? iii) who are its
users? Additional, the application and expected uses of the
One of the most important aspects of the general development knowledge base is planned. This usually means working with
and use of an ontology acquisition method is the accumulation of domain experts that have a set of problems that could be solved
a wide range of domain ontologies. Generally, inefficiency is with knowledge-base technology.
among the greatest problems in knowledge management.
Redundant effort is expanded capturing or recreating information 3.2 Ontology Capture Mechanism
that has already been recorded elsewhere. Rather than having to
encode information multiple times in different application It consists of three different stages: i) determining the scope of
settings, the idea is to develop ontology libraries; i.e., large the ontology; ii) selecting a method to capture the ontology, and
revisable knowledge bases of structured, domain specific, iii) defining the concepts in the ontology. Determining the scope
involves identifying all the key concepts and relationships. This

268

Authorized licensed use limited to: Annamalai University. Downloaded on July 1, 2009 at 07:16 from IEEE Xplore. Restrictions apply.
can be achieved by sketching a list of questions (named developed, if either some errors are discovered or new
competency questions) that a knowledge base based on the requirements come up, the code is refined to correct the errors or
ontology should be able to answer. The proposed method used for fulfill the new requirements. Extra-coding refinement refers to the
ontology capture is similar to that used in Object Oriented (OO) changes done to overcome the errors that are uncovered during
Analysis and Design. However, OO programming centers testing, and enhancements carried out during maintenance. Forms
primarily around methods on classes (a programmer makes design can be customized to form a refined knowledge acquisition tool;
decisions based on the operational properties of a class). On the while doing this, further design problems in the original ontology
contrary, an ontology designer makes these decisions based on the may surface.
structural properties of a class. The process of defining concepts
in ontology is also called categorization, which involves taking 3.5 Testing
closely related term and grouping them as concepts or categories.
It uncovers defects in functional logic and implementation, and
3.3 Coding the Ontology is carried out at all stages of development. Once the knowledge
base has been created, end-user tests should be carried to uncover
A suitable ontology editor is selected based on the requirements defects in the ontology and/or the knowledge acquisition tools.
of the domain and the functionality of the learning ontology. Depending upon the problems encountered, appropriate changes
Coding refers to representing the ontology in a formal language. need to be carried out to the ontology – and, at times, to the
First, in the ontology the main classes are entered as concepts, knowledge acquisition process and tools – to overcome any
followed by their attributes and slots. Classes describe learning shortcomings. In addition the full application is tested with end-
concepts. For example, a class of books represents all books. users. This step can lead to further revisions to the ontology and
Specific books are instances of this class. A class can have the knowledge acquisition forms.
subclasses that represent concepts that are more specific than the
superclass. For example, the class of all books can divide into
Mathematics, Physic, and Medicine books. It is remarkable that if 3.6 Maintenance
a class A is a superclass of class B, then every instance of B is
also an instance of A. It is advisable to build an initial small It can be corrective, adaptive or perfective. Corrective
ontology of classes and slots. Suitable tools to query the ontology maintenance involves considering the problems faced by the users
are also required. Ontology development is an iterative process; it while querying the ontology and correcting the ontology to
involves developing preliminary ontology that is refined with overcome these problems. Adaptive maintenance involves
time. In practical terms, coding an ontology includes: modifying the ontology to fulfill new requirements in the future.
a) Defining classes Perfective maintenance involves improving the ontology, to
b) Arranging the classes in a taxonomic hierarchy further refine it.
(subclass-superclass). Particularly, there are three
possible approaches in developing a class hierarchy:
a. A top-down development process starts with
4. Aplication Of Network Security Assesment
the definition of the most general concepts
With the development of network security technology, there are
and subsequent specialization of the concepts.
more and more security equipment to protect our network
b. A bottom-up development process which is
systems. But most of these security equipments will only work
start with the definition of the most specific
independently, which lack of appropriate plan and can not gain
classes (the leaves of the hierarchy) and
best security. Especially for large network system, the network
subsequent grouping of these classes into
architecture becomes more and more complex and dynamic. The
more general concepts.
illegal attacks are also multiple. One character of attacks is those
c. A combination development process which is
complexes attacks cooperate with distributed attacks performed
a combination of the top-down and bottom-up
by a team of malefactors from spatially distributed hosts
approach.
constitute the main threats for computer networks and
c) Defining slots and described allowed values for these
information. Besides of attacks the security situation very nearly
slots, and
concerns the risk of network system. So to recognize network
d) Filling in the values for slots for instances.
security situation is very important to the whole network system.
In the dynamic network environment, agent is suitable for
Then, knowledge base is created by defining individual
collecting data information and constructing the fusion model. In
instances of these classes filling in specific slot value
order to attain the stated goal, ontology is used to model and
information and additional slot restrictions. When the
construct a network security assessment for protecting system
ontology bas been built, the forms will be used to enter
from foreign elements.
instances into the ontology. For example, Protégé 2000 (open
source tools) or TopBraid Composer (licensing tools)
automatically generates forms in its role as a knowledge-
acquisition tool generator.
A. Role of Ontology in the Network Security Simulation Modeling
Process
3.4 Refinement
AIS have been shown to be an adaptive and robust
It consists of two phases: a) intra-coding refinement, and b) computational paradigm. It would be particularly suitable for a
extra-coding refinement. Intra-coding refinement involves the dynamic environment such as the network system. Network
refinement done during the coding phase. As the code is being security simulation assessment is a modeling process, which is a

269

Authorized licensed use limited to: Annamalai University. Downloaded on July 1, 2009 at 07:16 from IEEE Xplore. Restrictions apply.
mapping from different known events to potential components. It < Inflammation, rdf:type, Cact >
should collect a lot of data, which come from different security < Inflammation, hasTime, “Time” >
equipments (IDS, Firewall, antivirus system, security audit system < Inflammation, hasIPAddress, “IP address” >
and so on). These security equipments distributed in different < Cact, isA, “Apoptotic”>
domains in network. The immune system is naturally distributed
and contains many different cells each with its own specialized ForeignElement Class (Cfoe): This class has spyware, virus, and
function. So AIS is very suitable for security situation assessment. worm as individual. These elements were detected from security
Figure 1 shows network security simulation ontology with equipment by Agent class.
relationship between the concepts. < Spyware, rdf:type ForeignElement >
There are nine concepts involve in the ontology. Each concept < Virus, rdf:type ForeignElement >
and its relationship are described as follows: < Worm, rdf:type ForeignElement >
SecurityEquipment Class (Cseq): This class distributed in
Agent Class (Cagt): This is the detection agent that is responsible network. The class has alert information which is triggered by
for detecting security equipment, learns and memorizes the foreign element. Cseq has intrusion detection system and scanner
behavior of foreign element, communicate with control policy, as individual.
and classified itself. Cagt has responsible also in improving the < IntrusionDetectionSystem, rdf:type SecurityEquipment >
security system, and protect the network from < Scanner, rdf:type SecurityEquipment >
virus/spware/spybot outbreak: < SecurityEquipment, hasAlertInformation,
< Cagt, hasDetect, SecurityElement > AlertInformation >
< Cagt, hasLearnAndMemorize, LearnAndMemorize > SecuritySystem Class (Cses): After decision making, Cagt will
< Cagt, hasAdjustControlPolicy, ControlPolicy > find the defects in network. Cagt adjusts the control policies and
< Cagt, hasClassify, Classification > improves the system security as much as possible.
< Cagt, hasImprove, SecuritySystem > < Cagt, hasAdjustControlPolict, ControlPolicy>
< Cagt, hasAction, Action > < CreateImmuneNetwork, rdf:type, Cses >
Communication class (Ccom): In this class, there are < Cagt, hasImproves, Cses >
communication interfaces of different agents. Ccom has subclass
namely, CommunicationLanguage (Ccol), ControlPolicy (Ccop), A Classification class has restriction where if Agent has detects
and TransferProtocol (Ctrp): alert information at one time, then it will categorized under low
< Ccol, rdf:type, Ccom > risk. If Agent has detected alert information less or equal than 2,
< Ccop, rdf:type, Ccom > the severity level is categorize under medium risk. If Agent has
< Ctrp, rdf:type, Ccom > detected alert information more than two times, the severity level
< Cagt, hasAdjustControlPolicy, Ctrp > will be categorized under high risk.
LearnAndMemorize Class (Clem). There are some learning and
training processes. After learning and training process, Agent
class can make decision about the information, which reflects the
5. Conclusion And Future Work
security situation of the network system:
Intelligent application systems are facing rapid changes with
< Clem, hasLearnAndMemorizeForeignElement,
the advent of semantic web technologies and become possible
ForeignElemen >
with the development of ontologies. There is now a need for
< Clem, hasAdjustControlPolicy, Ctrp >
developing an infrastructure to manage the network security
< Clem, hasImprove, SecritySystem >
system information and deliver to network engineers what they
Classification Class (Ccla): This class receives information from
want. Semantic web and ontology-based intelligent information
AlertInformation and classifies the information with the level of
systems is one of the solutions. Ontologies are becoming popular
risk. Classification base on restriction/rule they have.
largely because of what they promise: “a shared and common
< Ccla, receiveAlertInformation, AlertInformation >
understanding that reaches across people and application
Restriction:
systems”.
< hasDetect some AlertInfromation >
The principal benefits of the research describe in this paper
< hasDetect min 2 >
include significant reductions in time and effort needed for
< hasDetect min 1 >
developing and deploying distributed simulation applications,
AlertInformation Class (Cali): This class contents information
significance reductions in the time and effort needed to facilitate
especially is alarm type such as; intrusion information outside,
knowledge sharing, communication, and semantic integration for
attack information inside, virus alert, and system leak.
modeling network security simulation application.
AlertInformation has addressed that data information coming
from, which include IP address and port number in network
system.
< Cali, hasTriggeredByForeignElement, ForeignElement >
< Cali, hasSourceIPAddress, “IP address” >
< Cali, hasDestinationIPAddress, “IP address”>
< Cali, hasSourcePortNumber, “Port number” >
< Cali, hasDestinationPortNumber, “Port number” >
Action Class (Cact). If agents detect high risk alert, they will
emit signal 1which is harmless for network system. That is
apoptotic. The classification class will classify the “apoptotic”
information according with how many foreign element detected
with certain time and space.

270

Authorized licensed use limited to: Annamalai University. Downloaded on July 1, 2009 at 07:16 from IEEE Xplore. Restrictions apply.
 Figure 1. Network Security Assessment Action Flow

6. REFERENCES
[1] L.N. Castro, and J. Timmis, “Artificial Immune Systems: A New [8] Petty, M. D. and E. W. Weisel (2003), “A composability lexicon,”
Computational Intelligence Approach,” Springer Verlag, London, Proceedings of the Spring 2003 Simulation Interoperability
Great Britain, 2002. Workshop, Orlando FL, March 30-April 4 2003, pp. 181-187.
[2] Gruber, T.R., 1993, “ A translation approach to portable ontology [9] Hobbs, J., W. Croft, T. Davies, D. Edwards, and K. Laws, (1997),
specification,s” Knowledge Acquisition, vol. 5, 199 – 220. The TACITUS Commonsense Knowledge Base, Artificial
[3] L.N. Castro, and F. J. Zuben, “Artificial Immune Systems: Basic Intelligence Research Center, SRI International.
Theory and Applications,” Technical Report TR-DCA 01/99, [10] Neches, R., R. Fikes, T. Finin, T. Gruber, R. Patil, T, Senator, and W.
December 1999. R. Swartout (1991), “Enabling technology for knowledge sharing”,
[4] U. Aickelin, , J. Greensmith, and J. Twycross, “Immune System AI Magazine 12(3):36-56.
Approaches to Intrusion Detection – A Review”, ICARIS 2004. pp. [11] Gruber, T. R. (1992), “Ontolingua: a mechanism to support portable
316-329. ontologies”, Knowledge Systems Laboratory Technical Report KSL
[5] Benjamin, P., C. Menzel, and R. J. Mayer (1995). “Towards a method 91-66, Final Version, Stanford University.
for acquiring CIM ontologies,” International Journal of Computer [12] Zhou, Z. Y., Shen, J. & Zhang, X. (2007), “A Danger Theory
Integrated Manufacturing, 8 (3), 225–234. Inspired Multi-agent Fusion Model for Network Security
[6] Fishwick, P. and J. Miller. (2004), “Ontologies for modeling and Assessment”, Proceeding of Third International Conference On
simulation: Issues and approaches,” Proceedings of 2004 Winter Natural Language Computation, 2007.
Simulation Conference. Piscataway, New Jersey: Institute for Electrical [13] Jones, D. M., Bench-Capon, T. J. M. & Visser, P. R. S (1998),
and Electronics Engineers. “Methodologies for Ontology Development”, Proceedings of
[7] Benjamin, P. and M. Graul (2006a), “A framework for adaptive IT&KNOWS Conference for the 15th IFIP World Computer
modeling and ontology-driven simulation,” Proceedings of SPIE, Congress, Budapest, 1998.
Enabling Technologies for Simulation Science X, Vol.6227. [14] Fernandez Lopez, M. (1999), “Overview of Methodologies for
Building Ontologies”, The Proceedings of the IJCAI-99 Workshop on
Ontologies and Problem Solving Methods, Sweden August-1999.

271

Authorized licensed use limited to: Annamalai University. Downloaded on July 1, 2009 at 07:16 from IEEE Xplore. Restrictions apply.