Extending the VERIS Framework to an Incident Handling Ontology
Extending the VERIS Framework to an Incident Handling Ontology
复制标题
将 VERIS 框架扩展到事件处理本体
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
A. F. P. D. Santos
中科院分区：
文献类型：
--
作者：
Guilherme Baesso Moreira;Vanusa Menditi Calegario;J. C. Duarte;A. F. P. D. Santos
统计数据显示，尽管在网络安全方面投入了大量资金，但事件数量仍在持续增长，网络攻击的动机是政治和金融问题，很多时候是由国家资助的，作为网络战的一部分。尽管人们普遍认为事件的发生几乎是不可避免的，但文献表明，网络安全举措往往侧重于预防事件，而不是对事件的响应，许多组织往往准备不足，忽视了关键的事件处理流程。为了填补这一空白，提出了一些倡议，其中之一是VERIS框架，一个“事件记录和事件共享的词汇表”。VERIS的目标是为事件文档提供基础，同时允许将匿名数据共享到社区数据库，从而为组织内部或外部各方提供使用的度量标准。由于VERIS是一个专注于信息收集和共享的框架，这项工作提出将该模型从原始的JSON表示扩展到OWL本体，OWL本体是语义Web倡议的主要工具之一，用于知识表示，并与信息共享的思想紧密相关。这项工作的重点是使用这种表示进行事件处理的优点。
Statistics show that while large amounts of money are being invested in cybersecurity, the number of incidents continues to grow, with cyber attacks motivated by political and financial issues, many times funded by States as part of cyberwarfare. Although the general perception is that the occurrence of incidents is almost inevitable, the literature demonstrates that cybersecurity initiatives are often focused on prevention of incidents rather than its response, with many organizations often poorly prepared and ignoring key incident handling processes. Some initiatives were proposed in order to fill this gap, one of them being the VERIS framework, a "vocabulary for event recording and incident sharing." VERIS goal is to provide a basis for incident documentation, at the same time allowing the sharing of anonymized data to a community database, hence providing metrics for use within organizations or among external parties. As VERIS is a framework focused on information gathering and sharing, this work proposes the extension of the model from its original JSON representation to an OWL ontology, one of the main tools of the Semantic Web initiative, used for knowledge representation and strongly tied to the idea of information sharing. This work focus on the advantages of using such representation for incident handling.