基于语义的网络安全策略层次依从性分析

Network security policy and the automated refinement of its hierarchies aims to simplify the administration of security services in complex network environments. The semantic gap between the policy hierarchies reflects the validity of the policy hierarchies yielded by the automated policy refinement process. However, little attention has been paid to the evaluation of the compliance between the derived lower level policy and the higher level policy. We present an ontology based on Ontology Web Language (OWL) to describe the semantics of security policy and their implementation. We also propose a method of estimating the semantic similarity between a given higher level security policy and the lower level ones to evaluate the compliance for the policy refinement approach. The method is verified in the case study. The experimental results demonstrate that the proposed method evaluates the semantic similarity between policy and implementation accurately, and that the algorithm of concept similarity analysis reflects the subjective similarity judgment of policy and implementation more accurate than the other algorithms.     

防火墙策略建模与其全局冲突分析(英文)

The global view of firewall policy conflict is important for administrators to optimize the policy.It has been lack of appropriate firewall policy global conflict analysis,existing methods focus on local conflict detection.We research the global conflict detection algorithm in this paper.We presented a semantic model that captures more complete classifications of the policy using knowledge concept in rough set.Based on this model,we presented the global conflict formal model,and represent it with OBDD(Ordered Binary Decision Diagram).Then we developed GFPCDA(Global Firewall Policy Conflict Detection Algorithm) algorithm to detect global conflict.In experiment,we evaluated the usability of our semantic model by eliminating the false positives and false negatives caused by incomplete policy semantic model,of a classical algorithm.We compared this algorithm with GFPCDA algorithm.The results show that GFPCDA detects conflicts more precisely and independently,and has better performance.     

移动自组织网络中可扩展的定位符/标识符分离路由协议

In the traditional Internet Protocol (IP) architecture, there is an overload of IP semantic problems. Existing solutions focused mainly on the infrastructure for the fixed network, and there is a lack of support for Mobile Ad Hoc Networks (MANETs). To improve scalability. A routing protocol for MANETs is presented based on a locator named Tree-structure Locator Distance Vector (TLDV). The hard core of this routing method is the identifier/locator split by the Distributed Hash Table (DHT ) method, which provides a scalable routing service. The node locator indicates its relative location in the network and should be updated whenever topology changes . Locator space is organized as a tree-structure, and the basic routing operation of the TLDV protocol is presented. TLDV protocol is compared to some classical routing protocols for MANETs on the NS2 platform. Results show that TLDV has better scalability.     

使用树结构定位符的MANETs路由模型

为了解决现有MANETs路由机制的可扩展性问题,提出一种使用树结构定位符的路由模型(TLR),通过DHT方法对节点的标识符和定位符进行分离,并使用基于位置的定位机制来提供一种具有可扩展性的路由服务.定位符描述一个节点在网络拓扑中的相对位置并随着节点的移动发生变化,定位符空间采用树结构进行组织.最后量化分析了该路由模型和其他路由机制的性能.分析结果表明,TLR的可扩展性优于平面主动式路由.在假设条件下,TLR的开销的复杂度小于反应式路由的复杂度.因此,相比于现有的MANETs路由机制,TLR具备很好的可扩展性.