Analysis of policy anomalies on distributed network security setups - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2006

Analysis of policy anomalies on distributed network security setups

Résumé

The use of different network security components, such as firewalls and network intrusion detection systems (NIDSs), is the dominant method to survey and guarantee the security policy in current corporate networks. On the one hand, firewalls are traditional security components which provide means to filter traffic within corporate networks, as well as to police the incoming and outcoming interaction with the Internet. On the other hand, NIDSs are complementary security components used to enhance the visibility level of the network, pointing to malicious or anomalous traffic. To properly configure both firewalls and NIDSs, it is necessary to use several sets of filtering and alerting rules. Nevertheless, the existence of anomalies between those rules, particularly in distributed multi-component scenarios, is very likely to degrade the network security policy. The discovering and removal of these anomalies is a serious and complex problem to solve. In this paper, we present a set of algorithms for such a management.
Fichier principal
Vignette du fichier
esorics06.pdf (346.82 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-00540450 , version 1 (26-11-2010)

Identifiants

  • HAL Id : hal-00540450 , version 1

Citer

Joaquin Garcia Alfaro, Frédéric Cuppens, Nora Cuppens-Boulahia. Analysis of policy anomalies on distributed network security setups. ESORICS 2006 : 11th European Symposium on Research in Computer Security, Sep 2006, Hamburg, Germany. pp.496-511. ⟨hal-00540450⟩
79 Consultations
190 Téléchargements

Partager

Gmail Facebook X LinkedIn More