## 4 Ontological Approach  
The paper focuses on the ontological approach (used in conjunction with the relational approach) and outlines its benefits to represent vulnerabilities.  
In all known SIEM systems the relational approach is used for data storage. However, the relational approach has various constraints on expression of relations between entities.  
As a rule, the relational model is often overloaded. This can lead to the conclusion that querying the data can take a long time. This is due to the lack of flexibility and expressiveness of SQL query language used in relational databases.  
The next challenge of relational data modeling is the need to update the data schema, when the big changes of the subject area occur. For relational database systems, storing large amounts of data, this task requires a lot of overhead.  
An example of vulnerability description represented by CVE is shown in Figure 2.  
It means that the vulnerability occurs when the host has application \"microsoft ie\" and one of the following operation systems: \"microsoft vista sp2\" or \"microsoft vista sp2 \(\times\)64\" or \"microsoft server 2008 sp2 \(\times\)86\" or \"microsoft server 2008 sp2 \(\times\)64\" or \"microsoft 7 \(\times\)86\" or \"microsoft 7 \(\times\)64\" or \"microsoft server 2008 r2 \(\times\)64\".  
In the relational data model, the entire product list, describing the vulnerability, along with logical operators is stored as a row in a table (Figure 3).  
This representation form does not allow flexibly specifying a parameterized query (with the names of products, versions, _etc._) for the analysis of vulnerabilities.  
An alternative solution on data representation in information processing systems with complex data structures (such as SIEM systems) is an ontological approach, which makes much easier the expressions of complex relationships between entities. When using this approach, the concepts and relationships can be formulated on the base of description logics. At that the terms of the dictionary are the names of unary and binary predicates (concepts and relations). Such predicates are used to express the relations between concepts and to limit their interpretation.  
The _ontology_ is a knowledge base that describes the facts that are always true as part of a community and are based on the generally accepted meaning from the dictionary. In the simplest case, the ontology describes only a hierarchy of concepts and relationships. The changes in the ontological data model require much less effort than in the relational model, especially in areas where it is needed to store different types of information that can be quickly changed. These areas, of course, embrace the security issues of distributed networks, including SIEM.  
It should be also noted that when designing SIEM systems, the data model must be the most common and at the same time not overloaded one, which will be adapted and specified for each application area. Therefore, the use of ontologies is a necessary approach that enables to create a general model that can be flexibly and quickly applied for all necessary concepts in new generation SIEM systems. Loose coupling of domain ontologies makes it easy to add, delete and support individual ontologies. In addition, the components of the ontologies may be dynamically combined during the performance of SIEM systems to meet specific application requirements.  
Mathematics underlying the ontological approach allows building more accurate queries and thus reducing the time spent by the analytical modules of SIEM systems to select information from the repository for a subsequent analysis. This advantage is particularly important in the field of distributed network security, because here there is a need to carry out in-depth analysis of heterogeneous information including historical records.