Automatic Conflict Analysis and Resolution of Traffic Filtering Policy for Firewall and Security Gateway

Ferraresi, Simone; Pesic, Stefano; Trazza, Livia; Baiocchi, Andrea

doi:10.1109/icc.2007.220

Cited by 18 publications

(14 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Then, they give sufficient conditions to detect redundancy and inconsistency. Ferraresi et al [10] develop a new firewall anomalies classification of based on the severity concept. Besides, they propose two automatic conflict resolution algorithms.…”

Section: Related Workmentioning

confidence: 99%

Detection of firewall configuration errors with updatable tree

Abbes

Bouhoula

Rusinowitch

2015

Int. J. Inf. Secur.

View full text Add to dashboard Cite

International audienceThe fundamental goals of security policy are to allow uninterrupted access to the network resources for authenticated users and to deny access to unauthenticated users. For this purpose, firewalls are frequently deployed in every size network. However, bad configurations may cause serious security breaches and network vulnerabilities. In particular, conflicted filtering rules lead to block legitimate traffic and to accept unwanted packets. This fact troubles administrators who have to insert and delete filtering rules in a huge configuration file. We propose in this paper a quick method for managing a firewall configuration file. We represent the set of filtering rules by a firewall anomaly tree (FAT). Then, an administrator can update the FAT by inserting and deleting some filtering rules. The FAT modification automatically reveals emerged anomalies and helps the administrator to find the adequate position for a new added filtering rule. All the algorithms presented in the paper have been implemented, and computer experiments show the usefulness of updating the FAT data structure in order to quickly detect anomalies when dealing with a huge firewall configuration file

show abstract

Section: Related Workmentioning

confidence: 99%

Detection of firewall configuration errors with updatable tree

Abbes

Bouhoula

Rusinowitch

2015

Int. J. Inf. Secur.

View full text Add to dashboard Cite

show abstract

“…Today's practice is to treat firewalls as private information known only to administrators. A firewall may have a large number of conflicting rules 22–24, which can be detected and rectified through policy anomaly detection algorithm 22, 23, visualization 25, or firewall queries 7. Through a SQL‐like query language called the SFQL and decision trees as its underlying data structure, firewall queries can be answered in an efficient way and used to assist human users to understand, analyze, maintain and debug firewalls.…”

Section: Related Workmentioning

confidence: 99%

Could firewall rules be public – a game theoretical perspective

Liao

Striegel

2011

Security Comm Networks

View full text Add to dashboard Cite

Firewalls are among the most important components in network security. Traditionally, the rules of the firewall are kept private under the assumption that privacy of the ruleset makes attacks on the network more difficult. We posit that this assumption is no longer valid in the Internet of today due to two factors: the emergence of botnets reducing probing difficulty and second, the emergence of distributed applications where private rules increase the difficulty of troubleshooting. We argue that the enforcement of the policy is the key, not the secrecy of the policy itself. In this paper, we demonstrate through the application of game theory that public firewall rules when coupled with false information (lying) are actually better than keeping firewall rules private, especially when taken in the larger group context of the Internet. Interesting scenarios arise when honest, public firewalls are socially insured by other lying firewalls and networks adopting public firewalls become mutually beneficial to each other. The equilibrium under multiple‐network game is socially optimal because the percentage of required lying firewalls in social optimum is much smaller than the percentage in single‐network equilibrium and the chance of attacking through firewalls is further reduced to zero. Copyright © 2011 John Wiley & Sons, Ltd.

show abstract

“…The authors of [4], [20], [21], and [22] have focused on techniques for analyzing legacy firewall policies for networks with centralized and distributed firewalls. All possible firewall rule relations are formally defined and are used to identify and classify policy conflicts (anomalies).…”

Section: Related Workmentioning

confidence: 99%

Policy conflict analysis for diffserv quality of service management

Charalambides

Flegkas

Pavlou

et al. 2009

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

How to cite:Charalambides, M.; Flegkas, P.; Pavlou, G.; Rubio-Loyola, J.; Bandara, A. K.; Lupu, E. C.; Dulay, N. and Sloman, M. (2009 oro.open.ac.uk > REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 1Abstract-Policy-based management provides the ability to (re-)configure differentiated services networks so that desired Quality of Service (QoS) goals are achieved. This requires implementing network provisioning decisions, performing admission control, and adapting bandwidth allocation to emerging traffic demands. A policy-based approach facilitates flexibility and adaptability as policies can be dynamically changed without modifying the underlying implementation. However, inconsistencies may arise in the policy specification. In this paper we provide a comprehensive set of QoS policies for managing Differentiated Services (DiffServ) networks, and classify the possible conflicts that can arise between them. We demonstrate the use of Event Calculus and formal reasoning for the analysis of both static and dynamic conflicts in a semiautomated fashion. In addition, we present a conflict analysis tool that provides network administrators with a user-friendly environment for determining and resolving potential inconsistencies. The tool has been extensively tested with large numbers of policies over a range of conflict types.

show abstract

Automatic Conflict Analysis and Resolution of Traffic Filtering Policy for Firewall and Security Gateway

Cited by 18 publications

References 8 publications

Detection of firewall configuration errors with updatable tree

Detection of firewall configuration errors with updatable tree

Could firewall rules be public – a game theoretical perspective

Policy conflict analysis for diffserv quality of service management

Contact Info

Product

Resources

About