On web semantics and data mining: Intrusion detection as a case study

We examine the intersection of data mining and se-mantic web in this paper. We briefly identify some points where they can impact one another, and then develop a specific example of intrusion detection, an applica-tion of distributed data mining. We have produced an ontology specifying a model of computer attacks. Our model is based upon an analysis of over 4,000 classes of computer attacks and their corresponding attack strate-gies using data derived from CERT/CC advisories and NIST’s ICAT meta-base. We present our attack model first as a taxonomy and convert it to a target-centric ontology that will be refined and expanded over time. We state the benefits of forgoing dependence upon tax-onomies for the classification of computer attacks and intrusions, in favor of ontologies. We illustrate the ben-efits of utilizing an ontology by comparing a use case scenario of our ontology and the IETF’s Intrusion De-tection Exchange Message Format Data Model.