一种分布式防火墙过滤策略的异常检测模型

分布式防火墙的安全性很大程度上取决于过滤策略正确配置。过滤策略的异常可能导致分布式防火墙系统所保护的网络出现严重的访问漏洞。为了能够自动化地检测分布式防火墙过滤策略存在的异常,对分布式防火墙系统中各过滤节点上的过滤规则之间可能出现的异常进行分类,并建立了一个过滤策略异常检测的模型。该模型能够检测出分布式防火墙过滤规则之间的冗余、冲突、不完整等各种异常,从而保证了分布式防火墙过滤策略的完整性和一致性。     

基于DFSQL实现分布式防火墙策略异常检测与分析

分布式防火墙在保护网络安全方面发挥着重要作用,但是由于分布式防火墙规则之间的异常,给网络带来了安全隐患.理解并且分析分布式防火墙的功能及存在的异常是必要的但又困难的.因此,文章中引入DFSQL分布式防火墙策略异常查询结构性描述语言,并给出一种适用于分布式防火墙规则异常检测算法,通过仿真实验证明算法的正确性和执行效率.     

基于改进策略树的防火墙策略审计方案设计与实现

防火墙在当今网络中起着不可或缺的作用,防火墙规则配置的合理与否直接关系到网络环境的安全.随着网络规模日益增大,防火墙配置也日趋复杂,为了更好的发挥防火墙的防护性能,防火墙策略审计应需而生.文章首先对防火墙规则之间的关系进行了详细研究,总结并分析了一些常见的规则异常种类,并对现有的策略审计方案进行了综述研究.其次,论述了防火墙策略审计系统整体的工作流程,层次化的分析了系统总体架构设计,对防火墙策略审计系统的配置规则审计模块进行了重点研究论述.再次,论述了传统的策略判定树审计方案,详细阐述了该方案的实现流程,分析并指出了该方案的优点以及所存在的不足.接下来提出一种以树形结构为基础改进后的策略审计方案,详细论述了该方案的审计流程并实现了改进的审计方案.最后结合该实现展示了系统的图形化报表以及详细审计结果,对改进后审计方案的审计结果与传统策略树进行了对比分析验证.     

基于SMFDD实现分布式防火墙异常规则检测及优化

为提高分布式防火墙异常规则的检测效率并优化异常规则,提出基于半同构标记防火墙决策图(SMFDD)的分布式防火墙异常规则检测算法与异常规则优化算法。异常规则检测算法在保持原始规则完整性、一致性、紧凑性的基础上,消除独立防火墙规则间异常;通过SMFDD之间的比较操作,提高异常规则的检测效率。异常规则优化算法根据SMFDD之间逻辑操作,定位引起规则异常的重叠或交叉域,修正分布式防火墙规则间异常,优化防火墙规则。仿真结果表明,当防火墙含有一定规则时,异常规则检测算法可以提高分布式防火墙规则间异常检测效率,异常优化算法能够快速优化异常规则。     

基于策略分段的防火墙一致性测试

防火墙是设置在被保护网络和外部网络之间的一道屏障.网络通信需要防火墙根据特定安全策略下进行监控和过滤.防火墙是否有效起到防护作用需要通过防火墙实现和安全策略配置的一致性测试.本文提出了一种改进的防火墙一致性测试方法,引入策略分段的思想,对非原子策略规则有选择的产生测试例,缩减了网络地址空间,将指数级测试例数目O(2101rpmn2)降低为多项式级O(Mpmn2),减少了产生的测试例的数量,有效提高了测试效率.     

一种分布式防火墙规则冲突的检测算法

为解决分布式防火墙中因规则冲突而导致策略异常问题,提出了一种基于XML的DFW策略异常的发现算法;该算法在分布式防火墙系统中,对于处在不同防火墙策略中的每条规则,设计一棵单根结点的树来表示分布式防火墙策略,即策略树(Policy Tree),然后通过集合全部的策略树,完成防火墙之间策略异常的发现过程;通过对算法的模拟运行,发现该算法在速度性能和可伸缩性方面较其他算法有很大的改进。     

基于时间的多层防火墙访问控制列表策略审计方案

针对多层防火墙中的访问控制列表（ACL）策略审计问题,基于时间分析了单个防火墙间及多层防火墙间的策略异常,并根据防火墙之间的拓扑结构提出了一种基于树结构的回溯异常检测算法（ADBA）。首先,解析各个防火墙ACL策略,统一数据格式到数据库;然后,根据防火墙间的拓扑建立树状结构并检测单个防火墙内的策略异常;最后,ADBA利用数据库中的数据与树结构进行异常检测并记录异常策略。实验结果表明,ADBA与基于半同构标记防火墙决策图（SMFDD）算法相比,ADBA的检测时间比SMFDD算法减少了28.01%,同时参考时间因素相比SMFDD算法,ADBA能够减少异常检测的误判。故ADBA能有效实施于多层防火墙的ACL策略审计,提高异常检测的精确性并减少异常检测时间。     

一种计算机网络防御策略描述语言*

定义了一种计算机网络防御策略描述语言（computer network defense policy specification language,CNDPSL）。该语言面向CNDPM模型,能够统一描述保护、检测和响应策略,并通过策略引擎映射为相应的防御规则。CNDPSL是一种声明式语言,抽象了网络防御控制的行为,对网络防御需求具有较好的灵活性、可扩展性和适应性。在GTNetS仿真平台中的实验表明,该语言能够描述防御策略并有效地转换为防火墙的ACL、检测和响应规则等,从而为计算机网络攻防演练提供防御策略支     

基于信任机制的网络防火墙状态检测模型

针对当前网络防火墙状态检测模型的网络安全置信度低,导致防火墙状态检测时间较长,服务器易受到攻击,检测准确率及防火墙安全性较低的问题,提出了基于信任机制的网络防火墙状态检测模型.分析防火墙安全性能,根据信任机制建立置信度,通过自适应阈值算法,判断网络是否存在攻击现象,并对数据包实施预处理,设置包过滤防火墙规则集,运用哈希...     

浅析ISA SERVER 2004访问规则策略

ISA SERVER 2004从上到下来评估防火墙策略，并且按照协议，从源网络、计划时间、到目的网络、用户集、内容类型的顺序来进行评估。在处理访问规则时发生逻辑错误，套导致防火墙策略处理结果与你的期望大相径庭。     

An anomaly prevention approach for real-time task scheduling

This research responds to practical requirements in the porting of embedded software over platforms and the well-known multiprocessor anomaly. In particular, we consider the task scheduling problem when the system configuration changes. With mutual-exclusive resource accessing, we show that new violations of the timing constraints of tasks might occur even when a more powerful processor or device is adopted. The concept of scheduler stability and rules are then proposed to prevent scheduling anomaly from occurring in task executions that might be involved with task synchronization or I/O access. Finally, we explore policies for bounding the duration of scheduling anomalies.     

Assigning multiple job types to parallel specialized servers

In this paper methods of mixing decision rules are investigated and applied to the so-called multiple job type assignment problem with specialized servers. This problem is modeled as continuous time Markov decision process. For this assignment problem performance optimization is in general considered to be difficult. Moreover, for optimal dynamic Markov decision policies the corresponding decision rules have in general a complicated structure not facilitating a smooth implementation. On the other hand optimization over the subclass of so-called static policies is known to be tractable. In the current paper a suitable static decision rule is mixed with dynamic decision rules which are selected such that these rules are relatively easy to describe and implement. Some mixing methods are discussed and optimization is performed over corresponding classes of so-called mixing policies. These mixing policies maintain the property that they are easy to describe and implement compared to overall optimal dynamic Markov decision policies. Besides for all investigated instances the optimized mixing policies perform substantially better than optimal static policies.     

An innovative simulation environment for cross-domain policy enforcement

With the development of policy management systems, policy-based management has been introduced in cross-domain organization collaborations and system integrations. Theoretically, cross-domain policy enforcement is possible, but in reality different systems from different organizations or domains have very different high-level policy representations and low-level enforcement mechanisms, such as security policies and privacy configurations. To ensure the compatibility and enforceability of one policy set in another domain, a simulation environment is needed prior to actual policy deployment and enforcement code development. In most cases, we have to manually write enforcement codes for all organizations or domains involved in every collaboration activity, which is a huge task. The goal of this paper is to propose an enforcement architecture and develop a simulation framework for cross-domain policy enforcement. The entire environment is used to simulate the problem of enforcing policies across domain boundaries when permanent or temporary collaborations have to span multiple domains. The middleware derived from this simulation environment can also be used to generate policy enforcement components directly for permanent integration or temporary interaction. This middleware provides various functions to enforce policies automatically or semi-automatically across domains, such as collecting policies of each participant domain in a new collaboration, generating policy models for each domain, and mapping specific policy rules following these models to different enforcement mechanisms of participant domains.     

Complete analysis of configuration rules to guarantee reliable network security policies

The use of different network security components, such as firewalls and network intrusion detection systems (NIDSs), is the dominant method to monitor and guarantee the security policy in current corporate networks. To properly configure these components, it is necessary to use several sets of security rules. Nevertheless, the existence of anomalies between those rules, particularly in distributed multi-component scenarios, is very likely to degrade the network security policy. The discovery and removal of these anomalies is a serious and complex problem to solve. In this paper, we present a complete set of mechanisms for such a management.     

Investigating the use of genetic programming for a classic one-machine scheduling problem

Genetic programming has rarely been applied to manufacturing optimisation problems. In this paper the potential use of genetic programming for the solution of the one-machine total tardiness problem is investigated. Genetic programming is utilised for the evolution of scheduling policies in the form of dispatching rules. These rules are trained to cope with different levels of tardiness and tightness of due dates.     

Semantic-based authorization architecture for Grid

There are a few issues that still need to be covered regarding security in the Grid area. One of them is authorization where there exist good solutions to define, manage and enforce authorization policies in Grid scenarios. However, these solutions usually do not provide Grid administrators with semantic-aware components closer to the particular Grid domain and easing different administration tasks such as conflict detection or resolution. This paper defines a proposal based on Semantic Web to define, manage and enforce security policies in a Grid scenario. These policies are defined by means of semantic-aware rules which help the administrator to create higher-level definitions with more expressiveness. These rules also permit performing added-value tasks such as conflict detection and resolution, which can be of interest in medium and large scale scenarios where different administrators define the authorization rules that should be followed before accessing a resource in the Grid. The proposed solution has been also tested providing some reasonable response times in the authorization decision process.     

A Data Classification Method for Inconsistency and Incompleteness Detection in Access Control Policy Sets

Access control policies may contain anomalies such as incompleteness and inconsistency, which can result in security vulnerabilities. Detecting such anomalies in large sets of complex policies automatically is a difficult and challenging problem. In this paper, we propose a novel method for detecting inconsistency and incompleteness in access control policies with the help of data classification tools well known in data mining. Our proposed method consists of three phases: firstly, we perform parsing on the policy data set; this includes ordering of attributes and normalization of Boolean expressions. Secondly, we generate decision trees with the help of our proposed algorithm, which is a modification of the well-known C4.5 algorithm. Thirdly, we execute our proposed anomaly detection algorithm on the resulting decision trees. The results of the anomaly detection algorithm are presented to the policy administrator who will take remediation measures. In contrast to other known policy validation methods, our method provides means for handling incompleteness, continuous values and complex Boolean expressions. In order to demonstrate the efficiency of our method in discovering inconsistencies, incompleteness and redundancies in access control policies, we also provide a proof-of-concept implementation.     

Rule-based system to detect energy efficiency anomalies in smart buildings,a data mining approach

The rapidly growing world energy use already has concerns over the exhaustion of energy resources and heavy environmental impacts. As a result of these concerns, a trend of green and smart cities has been increasing. To respond to this increasing trend of smart cities with buildings every time more complex, in this paper we have proposed a new method to solve energy inefficiencies detection problem in smart buildings. This solution is based on a rule-based system developed through data mining techniques and applying the knowledge of energy efficiency experts. A set of useful energy efficiency indicators is also proposed to detect anomalies. The data mining system is developed through the knowledge extracted by a full set of building sensors. So, the results of this process provide a set of rules that are used as a part of a decision support system for the optimisation of energy consumption and the detection of anomalies in smart buildings.     

The SemSPM approach: fine integration of WS-SecurityPolicy semantics to enhance matching security policies in SOA

The lack of semantics in WS-SecurityPolicy standard hampers the effectiveness of matching security policies. To resolve this problem, we present a semantic approach for matching Web service security policies. The approach consists in the transformation of WS-SP into an OWL-DL ontology and the definition of a set of rules which automatically generate semantic relations that can exist between the provider and requestor security requirements. We show how these relations lead to more correct and refined matching of security policies. We also describe the implementation details of our approach and its validation through a real-world use case.     

Learning Sequential Decision Rules Using Simulation Models and Competition

The problem of learning decision rules for sequential tasks is addressed, focusing on the problem of learning tactical decision rules from a simple flight simulator. The learning method relies on the notion of competition and employs genetic algorithms to search the space of decision policies. Several experiments are presented that address issues arising from differences between the simulation model on which learning occurs and the target environment on which the decision rules are ultimately tested.