An Ontology for SNORT Rule

Intrusion Detection System (IDS) is an important component to provide security for an organization. Its main function is to detect harmful traffic. The detection is done based on rules. SNORT is a widely used open-source IDS system. To have efficient detection, SNORT rule specification allows very expressive way to create a rule. This is not a trivial task especially for self-defined rule. Due to this complexity and huge amount of rules, there can be problems about both syntax and semantics which in turn effects on the IDS system performance. We thus propose an ontology for SNORT rules which is designed to support SNORT rule verification using OWL ontology.