SEGrapher: Visualization-based SELinux policy analysis

Marouf, Said; Shehab, Mohamed

doi:10.1109/safeconfig.2011.6111675

Cited by 14 publications

(8 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…SEGrapher [12] is a tool designed specifically for visually analyzing SELinux policies. SEGrapher visualizes the policy as a node-link diagram, where nodes are types and links are policy rules connecting types.…”

Section: Related Workmentioning

confidence: 99%

V3SPA: A visual analysis, exploration, and diffing tool for SELinux and SEAndroid security policies

Gove¹

2021

Preprint

View full text Add to dashboard Cite

SELinux policies have enormous potential to enforce granular security requirements, but the size and complexity of SELinux security policies make them challenging for security policy administrators to determine whether the implemented policy meets an organization's security requirements. To address the challenges in developing and maintaining SELinux security policies, this paper presents V3SPA (Verification, Validation and Visualization of Security Policy Abstractions). V3SPA is a tool that can import SELinux and Security Enhancements (SE) for Android source or binary policies and visualize them using two views: A policy explorer, and a policy differ. The policy explorer supports users in exploring a policy and understanding the relationships defined by the policy. The diffing view is designed to support differential policy analysis, showing the changes between two versions of a policy.The main contributions of this paper are 1) the design of the policy explorer, and the design and novel usecase for the policy differ, 2) a report on system design considerations to enable the graph visualizations to scale up to visualizing policies with tens of thou- sands of nodes and edges, and 3) a survey of five SELinux and SE for Android policy developers and analysts. The results of the survey indicate a need for tools such as V3SPA to help policy workers understand the big picture of large, complex security policies.

show abstract

Section: Related Workmentioning

confidence: 99%

V3SPA: A visual analysis, exploration, and diffing tool for SELinux and SEAndroid security policies

Gove¹

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…SEGrapher [22], a visualization tool for SELinux policy analysis, modeled a policy as a directed graph and visualized it as a kind of node-link diagram called focus-graph. This tool helped users analyze the relationship between objects (e.g., files) and subjects (e.g., processes) of policies using its own clustering algorithm.…”

Section: B Security Policy Visualizationmentioning

confidence: 99%

Hyperion: A Visual Analytics Tool for an Intrusion Detection and Prevention System

Yoo

Kim

et al. 2020

IEEE Access

View full text Add to dashboard Cite

Intrusion detection and prevention systems (IDPSs) are at the core of protecting an enterprise's network. In general, IDPSs use pre-defined rules to detect potential attacks. As the size of an organization grows and new types of intrusions appear, the quantity and complexity of the rules also increase. Moreover, IDPSs generate an overwhelming number of logs that are challenging to handle and analyze. For a more effective and integrative analysis and management of the rules and logs, we propose a novel visual analytics tool, Hyperion. Hyperion interactively visualizes rules to help users understand how the IDPS rules are managed and applied to the enterprise's network entities. Hyperion also provides effective visualizations to enable users to visually analyze the type, period, traffic, and frequency of attacks in addition to a traditional count-based timeline visualization. Finally, Hyperion enables users to interactively simulate the effect of a change in parameters of a detection rule. These features can help streamline the security control cycle consisting of rule application, information collection, log analysis, and rule revision.

show abstract

“…Several visualization-based SELinux policy analysis tools [14][15][16] have been developed to help policy writers to better understand the policies. Gove [14] presents a tool for understanding and comparing SELinux/SEAndroid policies by creating graph representations.…”

Section: Related Workmentioning

confidence: 99%

“…SPTrack [16] helps visualize SELinux policies as well as its attack logs to track IF. SEGrapher [15] generates cluster-based focus-graphs of policies based on clustering.…”

Section: Related Workmentioning

confidence: 99%

FlowConSEAL: Automatic Flow Consistency Analysis of SEAndroid and SELinux Policies

Radhika

Kumar

Shyamasundar

2018

Data and Applications Security and Privacy XXXII

View full text Add to dashboard Cite

SELinux/SEAndroid policies used in practice contain tens of thousands of access rules making it hard to analyse them. In this paper, we present an algorithm for reasoning about the consistency of a given policy by analysing the information flows implied by it. For this purpose, we model SELinux policy rules using the Readers-Writers Flow Model (RWFM). Using this model, our method identifies all possible indirect flows due to a given policy that could lead to inconsistency. One of the main features of the method is that it not only identifies inconsistencies in the policy but also traces the rules that lead to inconsistency. To distinguish between benign and vulnerable indirect flows, we further categorise the indirect rules that directly contradict neverallow rules in the policy and hence have a high potential for information leak. We further rank the rules and domains based on the number of policy violations they cause. We have also implemented a tool FlowConSEAL based on the above method and have applied it on various SELinux/SEAndroid policies for providing a succinct feedback to the user.We thank Asokan N, Elena R and Filippo B for their invaluable insights on SE-Android policy analysis and for sharing SEAndroid policies in early stages of the work.

show abstract

SEGrapher: Visualization-based SELinux policy analysis

Cited by 14 publications

References 5 publications

V3SPA: A visual analysis, exploration, and diffing tool for SELinux and SEAndroid security policies

V3SPA: A visual analysis, exploration, and diffing tool for SELinux and SEAndroid security policies

Hyperion: A Visual Analytics Tool for an Intrusion Detection and Prevention System

FlowConSEAL: Automatic Flow Consistency Analysis of SEAndroid and SELinux Policies

Contact Info

Product

Resources

About