Abnormal policy detection and correction using overlapping transition

Sunghyun Kim, Heejo Lee

    Research output: Contribution to journalArticlepeer-review

    1 Citation (Scopus)

    Abstract

    Policy in security devices such as firewalls and Network Intrusion Prevention Systems (NIPS) is usually implemented as a sequence of rules. This allows network packets to proceed or to be discarded based on rule's decision. Since attack methods are increasing rapidly, a huge number of security rules are generated and maintained in security devices. Under attack or during heavy traffic, the policy configured wrong creates security holes and prevents the system from deciding quickly whether to allow or deny a packet. Anomalies between the rules occur when there is overlap among the rules. In this paper, we propose a new method to detect anomalies among rules and generate new rules without configuration error in multiple security devices as well as in a single security device. The proposed method cuts the overlap regions among rules into minimum overlap regions and finds the abnormal domain regions of rules' predicates. Classifying rules by the network traffic flow, the proposed method not only reduces computation overhead but blocks unnecessary traffic among distributed devices.

    Original languageEnglish
    Pages (from-to)1053-1061
    Number of pages9
    JournalIEICE Transactions on Information and Systems
    VolumeE93-D
    Issue number5
    DOIs
    Publication statusPublished - 2010

    Keywords

    • ACL
    • Firewall
    • Network security
    • Policy anomalies
    • Security policy

    ASJC Scopus subject areas

    • Software
    • Hardware and Architecture
    • Computer Vision and Pattern Recognition
    • Electrical and Electronic Engineering
    • Artificial Intelligence

    Fingerprint

    Dive into the research topics of 'Abnormal policy detection and correction using overlapping transition'. Together they form a unique fingerprint.

    Cite this