共查询到18条相似文献,搜索用时 890 毫秒
1.
为了适应复杂的网络环境,防火墙的规则集往往非常庞大,因此人工的方法很难保证防火墙安全策略的正确配置。文中对防火墙中异常策略的检测方法进行了深入的研究,并在此基础上给出了NP防火墙中异常策略检测模块的设计与实现。测试结果表明,该模块可以有效地检测出防火墙规则集中的各种异常,避免安全隐患的产生。 相似文献
2.
针对多安全域之间的访问控制问题提出了策略冲突分类及其检测方法。研究了基于RBAC的多域安全互操作模型及其安全特性,分析了由于引入角色映射带来的策略冲突并对这些冲突进行分类。根据多域环境的特点将安全域角色系统抽象成有向图,利用有效角色系统和角色层次关系,提出了基于角色系统有向图的策略冲突检测方法。最后对方法的计算复杂度进行了分析并给出策略冲突的解决方法。 相似文献
3.
针对分布式防火墙和入侵检测技术各自存在的不足,文中提出基于入侵检测的分布式防火墙的解决方案,通过在主机防火墙内部增加入侵检测模块,形成一种动态分布式防火墙.主机防火墙过滤模块通过修改数据包结构以减少入侵检测量,入侵检测结果快速返回管理中心,及时动态更新策略.实验结果表明:该方案解决了分布式防火墙策略更新慢、内部通信被非法用户截获、无法及时发现入侵攻击等问题,同时也解决了入侵检测模块的数据检测量大和无法阻断攻击等问题. 相似文献
4.
5.
在TCP/IP网络中,包过滤防火墙的策略制定是至关重要的。策略就是让包过滤防火墙在转发数据包之前打开TCP/IP封装,检查进出网络的数据包的各种属性,决定是否允许该数据包通过防火墙。文中对TCP、IP数据包进行了描述,给出了一些策略实例。 相似文献
6.
报文过滤策略是基于报文头部及相关信息对其进行分类的规则集合,报文分类是提供网络服务如路由、QoS、安全等的关键技术.策略中的冲突会导致不一致的系统行为.提出了一种具有精确语义的过滤策略语言,并给出了该语言到Horn程序的转换规则,从而可以利用逻辑推理技术检测和解析冲突.理论分析和原型实现验证了该方法的有效性. 相似文献
7.
8.
9.
10.
11.
Mobile social networks give online social networking sites the capabilities to extend their services to mobile device users. Smart phones and tablets allow users to interact with each other when they are moving. Policy-based management simplifies the management of interaction functionalities by establishing policies to control various activities involved in these functionalities. To detect and resolve potential dynamic conflicts between the rules and configurations from different administrative domains, a knowledge-based policy analysis framework is proposed in this paper. It incorporates relationships between different elements in policy rules into temporal logic using a knowledge extension, which makes dynamic policy conflict analysis more accurate. A prototype system for mobile social networks is implemented to illustrate the capability of this framework. 相似文献
12.
Al-Shaer E. Hamed H. Boutaba R. Hasan M. 《Selected Areas in Communications, IEEE Journal on》2005,23(10):2069-2084
Firewalls are core elements in network security. However, managing firewall rules, particularly, in multifirewall enterprise networks, has become a complex and error-prone task. Firewall filtering rules have to be written, ordered, and distributed carefully in order to avoid firewall policy anomalies that might cause network vulnerability. Therefore, inserting or modifying filtering rules in any firewall requires thorough intrafirewall and interfirewall analysis to determine the proper rule placement and ordering in the firewalls. In this paper, we identify all anomalies that could exist in a single- or multifirewall environment. We also present a set of techniques and algorithms to automatically discover policy anomalies in centralized and distributed firewalls. These techniques are implemented in a software tool called the "Firewall Policy Advisor" that simplifies the management of filtering rules and maintains the security of next-generation firewalls. 相似文献
13.
The global view of firewall policy conflict is important for administrators to optimize the policy.It has been lack of appropriate firewall policy global conflict analysis,existing methods focus on local conflict detection.We research the global conflict detection algorithm in this paper.We presented a semantic model that captures more complete classifications of the policy using knowledge concept in rough set.Based on this model,we presented the global conflict formal model,and represent it with OBDD(Ordered Binary Decision Diagram).Then we developed GFPCDA(Global Firewall Policy Conflict Detection Algorithm) algorithm to detect global conflict.In experiment,we evaluated the usability of our semantic model by eliminating the false positives and false negatives caused by incomplete policy semantic model,of a classical algorithm.We compared this algorithm with GFPCDA algorithm.The results show that GFPCDA detects conflicts more precisely and independently,and has better performance. 相似文献
14.
A. Majidian 《BT Technology Journal》1999,17(2):53-59
Management of today's distributed systems is becoming increasingly complex. There is an obvious requirement for a flexible mechanism to help manage such systems. Rule-based management is one such mechanism. However, in order for rule-based management to become widely usable a method is required by which conflicts between management policies (defined as rules) can be identified and resolved. This paper creates a set theoretic model for rules as a trituple of the relationship between the subject, action and target of a policy. It also identifies two classes of policy set — 'syntactically easy policy set' (SEPS) and 'syntactically non-easy policy set' (SNEPS). SEPSs are policies which are sets of all the Cartesian products of its subjects, actions and targets, whereas SNEPSs are only a subset of that Cartesian product. Conflict analysis of SEPSs has been handled in other papers; this paper addresses conflict analysis of SNEPSs. A method for resolving conflict is suggested. The paper also raises some issues that arise when considering a database of policies. 相似文献
15.
16.
17.
Segmenting high-frequency intracardiac ultrasound images ofmyocardium into infarcted, ischemic, and normal regions 总被引:1,自引:0,他引:1
Xiaohui Hao Bruce C.J. Pislaru C. Greenleaf J.F. 《IEEE transactions on medical imaging》2001,20(12):1373-1383
Segmenting abnormal from normal myocardium using high-frequency intracardiac echocardiography (ICE) images presents new challenges for image processing. Gray-level intensity and texture features of ICE images of myocardium with the same structural/perfusion properties differ. This significant limitation conflicts with the fundamental assumption on which existing segmentation techniques are based. This paper describes a new seeded region growing method to overcome the limitations of the existing segmentation techniques. Three criteria are used for region growing control: 1) Each pixel is merged into the globally closest region in the multifeature space. 2) "Geographic similarity" is introduced to overcome the problem that myocardial tissue, despite having the same property (i.e., perfusion status), may be segmented into several different regions using existing segmentation methods. 3) "Equal opportunity competence" criterion is employed making results independent of processing order. This novel segmentation method is applied to in vivo intracardiac ultrasound images using pathology as the reference method for the ground truth. The corresponding results demonstrate that this method is reliable and effective. 相似文献
18.
In this paper, we propose a user‐centric conflict management method for media services which exploits personal companions for the harmonious detection and resolution of service conflicts. To detect conflicts based on the varying characteristics of individual users, the proposed method exploits the unified context describing all users attempting to access media services. It recommends and mediates users' preferred media contents through a shared screen and personal companions to resolve the detected conflicts. During the recommendation, a list of preferred media contents is displayed on the shared screen, and a personally preferred content list is shown on the user's personal companion comprising the selection of media contents. Mediation assists the selection of a consensual service by gathering the users' selections and highlighting the common media contents. In experiments carried out in a ubiHome, we observed that recommendations and mediation are useful in harmoniously resolving conflicts by encouraging user participation in conflict situations. 相似文献