title: Ontology based log content extraction engine for a posteriori security control.
abstract: In a posteriori access control, users are accountable for actions they performed and must provide evidence, when required by some legal authorities for instance, to prove that these actions were legitimate. Generally, log files contain the needed data to achieve this goal. This logged data can be recorded in several formats; we consider here IHE-ATNA (Integrating the healthcare enterprise-Audit Trail and Node Authentication) as log format. The difficulty lies in extracting useful information regardless of the log format. A posteriori access control frameworks often include a log filtering engine that provides this extraction function. In this paper we define and enforce this function by building an IHE-ATNA based ontology model, which we query using SPARQL, and show how the a posteriori security controls are made effective and easier based on this function.
authors.affiliation: IT/Telecom Bretagne, Cesson Sévigné, France. hanieh.azkia@telecom-bretagne.eu
authors.forename: Hanieh
authors.initials: H
authors.lastname: Azkia
authors.forename: Nora
authors.initials: N
authors.lastname: Cuppens-Boulahia
authors.forename: Frédéric
authors.initials: F
authors.lastname: Cuppens
authors.forename: Gouenou
authors.initials: G
authors.lastname: Coatrieux
mesh_terms: D016494:Computer Security / Q000592:standards*; D057286:Electronic Health Records / Q000592:standards*; D005602:France; D055991:Health Records, Personal; D057386:Search Engine / Q000592:standards*