SPTrack: Visual Analysis of Information Flows within SELinux Policies and Attack Logs

Abstract

International audienceAnalyzing and administrating system security policies is difficult as policies become larger and more complex every day. The paper present work toward analyzing security policies and sessions in terms of security properties. Our intuition was that combining both visualization tools that could benefit from the expert's eyes, and software analysis abilities, should lead to a new interesting way to study and manage security policies as well as users' sessions. Rather than trying to mine large and complex policies to find possible flaws within, work may concentrate on which potential flaws are really exploited by attackers. Actually, the paper presents some methods and tools to visualize and manipulate large SELinux policies, with algorithms allowing to search for paths, such as information flows within policies. The paper also introduces a complementary original approach to analyze and visualize real attack logs as session graphs or information flow graphs, or even aggregated multiple-sessions graphs. Our wishes is that in the future, when those tools will be mature enough, security administrator can then confront the statical security view given by the security policy analysis and the dynamical and real-world view given by the parts of attacks that most often occurred

Hyperion: A Visual Analytics Tool for an Intrusion Detection and Prevention System

“…This tool helped users analyze the relationship between objects (e.g., files) and subjects (e.g., processes) of policies using its own clustering algorithm. SPTrack [7] is based on the nodelink diagram, and visualizes the criticality level as colored edges according to interactions (e.g., write, signal) allowed by policies. Xu et al [35], [36] suggested using semantic substrates to visualize the key categories (i.e., user, role, domain, type) of the policy in separate spaces.…”

FlowConSEAL: Automatic Flow Consistency Analysis of SEAndroid and SELinux Policies

“…Several visualization-based SELinux policy analysis tools [14][15][16] have been developed to help policy writers to better understand the policies. Gove [14] presents a tool for understanding and comparing SELinux/SEAndroid policies by creating graph representations.…”

SELint: An SEAndroid Policy Analysis Tool

“…The resulting tool, shrimp, can be used to analyze and find errors in the SELinux Reference Policy. Information visualization techniques have been applied to SELinux policy analysis in (Clemente et al, 2012), also in combination with clustering of policy elements (Marouf and Shehab, 2011). These analysis methods are largely academic, and no practical tools based on them are used by the SELinux community.…”