A computer network attack taxonomy and ontology

Abstract

Computer network attacks differ in the motivation of the entity behind the attack, the execution and the end result. The diversity of attacks has the consequence that no standard classification exists. The benefit of automated classification of attacks, means that an attack could be mitigated accordingly. The authors extend a previous, initial taxonomy of computer network attacks which forms the basis of a proposed network attack ontology in this paper. The objective of this ontology is to automate the classification of a network attack during its early stages. Most published taxonomies present an attack from either the attacker's or defender's point of view. The authors’ taxonomy presents both these points of view. The framework for an ontology was developed using a core class, the “Attack Scenario”, which can be used to characterize and classify computer network attacks.