An Ontology-Based Approach for Zero-Day Information Security Threat Management

Zero Day security threats are diverse and manifest in many forms. Despite the growing number of zero day attacks, very little information about the kind of threat and how to defend against the threats is known by information security professionals. Signature based techniques and statistical based techniques have been seen to be less effective in handling Zero-day security threats (ZDST) since they require a new threat signature and threat profile to be learnt each time, meaning new signatures and profiles cannot be detected and behavior-based approaches have always resulted in many false positives in handling of zero-day security threats. The ZDST may result in disruptions of service, loss of data, loss of data integrity, corruption of data, systems malfunction, miscommunication, or other undesired effects on information systems. This research proposes an ontology-based approach for management of ZDST and evaluates its performance for use in detection and prevention of ZDST within the information security domain.