Abstract
Security components such as firewalls, IDS and IPS, are the mainstay and the most widely adopted technology for protecting networks. These security components are configured according to a global security policy. An error in a security policy either creates security holes that will allow malicious traffic to sneak into a private network or blocks legitimate traffic and disrupts normal business processes, which, in turn, could lead to irreparable consequences. It has been observed that most security policies on the Internet are poorly designed and have many misconfigurations. In this paper, we propose a formal process to specify, verify and correct the security policy using the decision tree formalism, which consists of four steps. First, we define the security policy specifications and write it in a natural language. Second, the security policy will be translated into a formal language. Third, we verify the security policy correctness. If this latter is plugged with anomalies, we correct it in the last step.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Al-Shaer, E., Hamed, H.: Discovery of policy anomalies in distributed firewalls. In: Proceedings of IEEE INFOCOM 2004, pp. 2605–2615 (2004)
Al-Shaer, E., Hamed, H., Boutaba, R., Hasan, M.: Conflict classification and analysis of distributed firewall policies. IEEE J. Sel. Areas Commun. (JSAC) 23(10), 2069–2084 (2005)
Al-Shaer, E., Hamed, H.: Firewall policy advisor for anomaly detection and rule editing. In: IEEE/IFIP Integrated Management IM 2003 (2003)
Ben Ftima, F., Karoui, K., Ben Ghezala, H.: Misconfigurations discovery between distributed security policies using the mobile agent approach. In: Proceedings of ACM “The 11th International Conference on Information Integration and Web-based Applications & Services” (iiWAS 2009), Kuala Lampur, Malaysia (2009)
Karoui, K., Ben Ftima, F., Ben Ghezala, H.: A multi-agent framework for anomalies detection on distributed firewalls using data mining techniques. In: Cao, L. (ed.) Data Mining and Multi-agent Integration, pp. 267–278. Springer, Boston, MA (2009). doi:10.1007/978-1-4419-0522-2_18
Eronen, P., Zitting, J.: An expert system for analyzing firewall rules. In: Proceedings of 6th Nordic Workshop on Secure IT-Systems (NordSec 2001) (2001)
Garcia-Alfaro, J., Cuppens, F., Cuppens-Boulahia, N.: Analysis of policy anomalies on distributed network security setups. In: Proceedings of the 11th European Symposium on Research in Computer Security (ESORICS 2006), Hamburg, Germany (2006)
Gouda, M., Liu, A.X.: A model of stateful firewalls and its properties. In: Proceedings of IEEE International Conference on Dependable Systems and Networks (DSN 2005), pp. 320–327 (2005)
Hamed, H., Al-Shaer, E., Marrero, W.: Modeling and verification of IPsec and VPN security policies. In: Proceedings of 13th IEEE International Conference on Network Protocols (ICNP 2005), pp. 259–278 (2005)
Liu, A.X.: Firewall policy verification and troubleshooting. In: Proceedings of IEEE International Conference on Communications (ICC) (2008)
Liu, A.X., Gouda, M.: Complete redundancy detection in firewalls. In: Proceedings of 19th Annual IFIP Conference Data and Applications Security, pp. 196–209 (2005)
Pornavalai, S.P., Chomsiri, T.: Analyzing firewall policy with relational algebra and its application. In: Australian Telecommunication Networks and Applications Conference (ATNAC 2004), Australia (2004)
Ben Ftima, F.: Thesis: Test des composants de sécurité distribués (2016)
Karoui, K.B., Ben Ftima, F., Ben Ghezala, H.: Distributed firewalls and IDS interoperability checking based on a formal approach. Int. J. Comput. Netw. Commun. 5(5), 95–115 (2013)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2017 Springer International Publishing AG
About this paper
Cite this paper
Ben Ftima, F., Karoui, K., Ben Ghezala, H. (2017). A Formal Approach for Network Security Policy Relevancy Checking. In: Yan, Z., Molva, R., Mazurczyk, W., Kantola, R. (eds) Network and System Security. NSS 2017. Lecture Notes in Computer Science(), vol 10394. Springer, Cham. https://doi.org/10.1007/978-3-319-64701-2_42
Download citation
DOI: https://doi.org/10.1007/978-3-319-64701-2_42
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-64700-5
Online ISBN: 978-3-319-64701-2
eBook Packages: Computer ScienceComputer Science (R0)