An ontological approach to threats pattern collection and classification: a preliminary study to security management

摘要

This study presents an agent based approach to resolve issues related to the collection and classification of software application anomalies and misuses with the aim of facilitating the reappraisal of security controls of information system (IS). The proposed system is assumed to be integrated with the existing IS in order to enhance information system security maintenance by continuously collecting identified threat behaviour from the application intrusion detection system (IDS). The system comprises of several functional agents like the input collector agent, classifier agent, and tracking agent. The collector agent collects the identified threats by the IDS, the categoriser agent categorises according to STRIDE model using pattern matching algorithm on the content of security knowledge base. The security knowledge repository is developed based on existing security ontology. The classifier classifies based on the threats IP address while the tracking agent collates all the threats profile. The collect-categorise-classify-track (C3T) model is hereby presented. The potential usability of this work is demonstrated by a case study and its useful integration with further studies is also discussed.