Network Security Situation Elements Fusion Method Based on Ontology

As current research can not solve the problem of making multi-source heterogeneous network security situation elements uniformly described, a network security situation elements fusion method based on ontology is proposed. Firstly, a fusion model is constructed which contains network environment, network vulnerability, network attack, network security incident and sensor as key class. Secondly, three fusion rules which contain alert aggregation, alert verification and attack session reconstruction are formulated by using Semantic Query-enhanced Web Rule Language. Finally, the application example shows that the method can make situation elements uniformly described. Security situation information has higher complementary and lower redundancy, which achieves better fusion effect.