Ontology-based modeling of DDoS attacks for attack plan detection

This paper proposes an effective approach to model DDoS attacks, and its application to recognize attack plans prior to the actual incident. The goals of this study are, firstly model DDoS attacks, their prerequisites and consequences using semantic representation in order to provide description logic of DDoS attacks; and secondly, propose an ontology-based solution which detects potential DDoS attacks using inference over observing knowledge provided by sensory inputs. Unlike other ontologies in network attack domains, proposed ontology is generated automatically using well-known taxonomies like CAPEC, CWE, and CVE datasets. Proposed method not only introduces semantic to exchange knowledge between machines, but also provides a framework by which machine can detect intrusions.