From using description logics to handling inconsistency in cooperative intrusion detection

Abstract

Cooperative intrusion detection consists in using several IDS and other analyzers in order to supply an overview of the system under consideration. In this case, the definition of a shared vocabulary describing the different information is prominent. Since these pieces of information are structured, we propose in this paper to use description logics which ensure the reasoning decidability. Besides, the analyzers used in cooperative intrusion detection are not totally reliable. Consequently, the cooperation could easily generate conflicts or inconsistencies. We propose in this paper to handle these inconsistencies using the so-called partial lexicographic inference.