Using Argumentation Logic for Firewall Policy Specification and Analysis

Abstract

Abstract. Firewalls are important perimeter security mechanisms that imple-ment an organisation's network security requirements and can be notoriously difficult to configure correctly. Given their widespread use, it is crucial that network administrators have tools to translate their security requirements into firewall configuration rules and ensure that these rules are consistent with each other. In this paper we propose an approach to firewall policy specification and analysis that uses a formal framework for argumentation based preference reasoning. By allowing administrators to define network abstractions (e.g. subnets, protocols etc) security requirements can be specified in a declarative manner using high-level terms. Also it is possible to specify preferences to express the importance of one requirement over another. The use of a formal framework means that the security requirements defined can be automatically analysed for inconsistencies and firewall configurations can be automatically generated. We demonstrate that the technique allows any inconsistency property, including those identified in previous research, to be specified and automatically checked and the use of an argumentation reasoning framework provides administrators with information regarding the causes of the inconsistency.

On harnessing information models and ontologies for policy conflict analysis

“…This is observed by Hari et al (2000), Hamed (2003, 2004a,b), Al-Shaer et al (2005) and Bandara et al (2006b), as the algorithms developed depend on some sort of implicit knowledge of the target managed system, for example, that the policies are ordered and only one in a set is enforced. This approach can be very ecient for centralised applications, but may not scale to distributed systems without augmenting the algorithms .…”

“…Another approach to the problem, proposed by Bandara et al (2006b), is to encode the rewall policies into a logic programming language and to use AI techniques to search for policy anomalies. They represent a rewall policy as a logic statement in Prolog (a logic programming language).…”

An ontology-based Plug-and-Play approach for in-vehicle Time-Sensitive Networking (TSN)

“…It relieves the network administrators and help to automate the management tasks. In [15] and [16] ontologies are applied to describe the network policies such as firewall policies. Management of complex 5G networks using ontologies is proposed in [17].…”

Firewall configuration: An application of multiagent metalevel argumentation

“…[8] described a technique based on Argumentation for Logic Programming with Priorities, allowing administrators to use high-level abstractions in specifying their network security requirements. In [9], this work was extended to automatically generate firewall policies from higher-level requirements; and in previous work, we [6,42] have discussed how to use argumentation to handle firewall anomalies and, more generally, to address cyber-security.…”