Military Communications and Information Technology: A Trusted ...

352 Military Communications and Information Technology...
has mechanism that allows the Decision Module to efficiently execute multiple
queries over the data streams in order to perform event correlation. The result
of a correlation process is an intermediate event that is further processed by
CLIPS rule engine [12]. CLIPS uses ontology that describes broad range of network
security aspects (we use ‘’FCDS ontology’’ developed in our project). CLIPS
engine identifies whenever some attacks or malicious network events have been
discovered. The information describing the network incident and reconfiguration
procedures (Common Decision Rule – CDR) are sent to Translator. Moreover,
detailed information in human readable format are generated and visualized to
network administrators via DM GUI.
Figure 3. UML diagram of DM
Data received from network sensors is arranged in streams. Each stream is built
of multiple tuples (events). Each tuple, depending on sensor type, may have different
schema. Borealis allows to process streams in order to correlate information
coming from different sources and to detect network incidents more efficiently.
The query that is executed over the multiple streams consists of operators. There
are different kinds of operators provided by the Borealis engine that allow for aggregation,
filtering and joining data coming from different streams.
According to Figure 2. only intermediate events are matched with the knowledge
stored in the ontology. The intermediate events are obtained via the Borealis
query that is executed over the streams of a network events. Their names, types
and schemas are maintained in the ontology. Each intermediate event received by
CLIPS rule engine is considered as attack symptom and as such is matched with
knowledge in the ontology in order infer the most probable attack [13].
The example of symptom matching is graphically presented in Figure 4.
When the symptoms are received by CLIPS rule engine the most probable attacks
are inferred. However one symptom could match several attacks, therefore CLIPS
is responsible for computing the probability score and alerting about these attacks,
for which the calculated score exceeds the detection threshold.