EXEHDA-SO: uma abordagem ontológica para ciência de situação aplicada ao domínio de segurança da informação

Abstract

Modern computing infrastructures, typical of Ubiquitous Computing, assume characteristics of flexibility and permissiveness regarding the connectivity of the environment. These characteristics have contributed over the last few years to the emerging Internet of Things, which extends the demand for connectivity and therefore raises computer networks traffic. However, the same factors that allow these evolutions also potentiate problems with regard to Information Security. Information security solutions for specific purposes are developed in computer networks, developed in their own syntax languages, providing events in different formats. These factors individualize the analysis of these solutions, which brings difficulties to incidents identification. In this sense, Situational Science, as a strategy capable of integrating events from different sources, becomes a fundamental requirement for the security controls implementation, allowing the typical flexibility of UbiComp. Considering this, the present dissertation proposes an ontological approach to Situation Science applied to the Information Security domain, called EXEHDA-SO (Execution Environment for Highly Distributed Applications - Security Ontology). Through the processing of heterogeneous events, coming from different contextual sources, a contribution is made to the understanding phase of Situational Science. The EXEHDA-SO model is presented in three fragments called Core, Scope and InterCell Analyzer. In order to validate the proposed model a case study was developed allusive to Universidade Federal de Pelotas computational infrastructure. In this evaluation, considering the characteristics of heterogeneity and distribution of the environment, it was possible to observe the main contributions proposed in this dissertation.