A Topology-Based Conflict Detection System for Firewall Policies using Bit-Vector-Based Spatial Calculus
نویسندگان
چکیده
Firewalls use packet filtering to either accept or deny packets on the basis of a set of predefined rules called filters. The firewall forms the initial layer of defense and protects the network from unauthorized access. However, maintaining firewall policies is always an error prone task, because the policies are highly complex. Conflict is a misconfiguration that occurs when a packet matches two or more filters. The occurrence of conflicts in a firewall policy makes the filters either redundant or shadowed, and as a result, the network does not reflect the actual configuration of the firewall policy. Hence, it is necessary to detect conflicts to keep the filters meaningful. Even though geometry-based conflict detection provides an exhaustive method for error classification, when the number of filters and headers increases, the demands on memory and computation time increase. To solve these two issues, we make two main contributions. First, we propose a topology-based conflict detection system that computes the topological relationship of the filters to detect the conflicts. Second, we propose a systematic implementation method called BISCAL (a bit-vector-based spatial calculus) to implement the proposed system and remove irrelevant data from the conflict detection computation. We perform a mathematical analysis as well as experimental evaluations and find that the amount of data needed for topology is only one-fourth of that needed for geometry.
منابع مشابه
Design and Implementation of Conflict Detection System for Time-Based Firewall Policies
Firewalls are one of the most common mechanisms used to protect the network from unauthorized access and security threats. Nowadays, time-based firewall policies are widely in use in many firewalls such as CISCO ACLs and Linux iptables to control network traffic with respect to time. However, network administrators struggle to maintain the firewall policies due to their high complexity. A confl...
متن کاملAn Intelligent Anti-Islanding Scheme for Synchronous-Based Distributed Generation Using Reduced-Noise Morphological Gradient
This paper presents a pattern recognition-based scheme for detection of islanding conditions in synchronous- based distributed generation (DG) systems. The main idea behind the proposed scheme is the use of spatial features of system parameters such as the frequency, magnitude of positive sequence voltage, etc. In this study, the system parameters sampled at the point of common coupling (PCC) w...
متن کاملFirewall Management for to Resolve the Policy Anomalies
Firewall is a security system for network, that controls the network traffic based on firewall rules. Firewall depends on the policy configuration, but managing that firewall policy is complex. Existing policy analysis tools, such as Firewall Policy Advisor and FIREMAN, they can only detect the policy anomaly cannot resolve these anomalies, and detection time was also increased. Therefore, I re...
متن کاملSpecification, Analysis and Resolution of Anomalies in Firewall Security Policies
Firewalls are essential components in network security solutions. Managers have to specify their organizational security policies using low level and order-dependent rules in firewalls. Furthermore, dependency of firewalls to the network topology, frequent changes in network topology and lack of an automatic method for analysis and verification of anomalies in specified security policy lead to ...
متن کاملAn Effective Modality Conflict Model for Identifying Applicable Policies During Policy Evaluation
Policy evaluation is a process to determine whether a request submitted by a user satisfies the access control policies defined by an organization. Modality conflict is one of the main issues in policy evaluation. Existing modality conflict detection approaches do not consider complex condition attributes such as spatial and temporal constraints. An effective authorization propagation rule is n...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
برای دانلود متن کامل این مقاله و بیش از 32 میلیون مقاله دیگر ابتدا ثبت نام کنید
ثبت ناماگر عضو سایت هستید لطفا وارد حساب کاربری خود شوید
ورودعنوان ژورنال:
- IJCNS
دوره 4 شماره
صفحات -
تاریخ انتشار 2011