![](bgc.png)
the problem with algorithms that are useable with
real-life, big rule sets. We have implemented the
algorithms in Java language in a tool which is
available under request.
However, our approach has some limitations that
give us opportunities for improvement in future
works. The most important one is that our process
can diagnose inconsistent rules, but cannot diagnose
redundant rules.
ACKNOWLEDGEMENTS
This work has been partially funded by Spanish
Ministry of Science and Education project under
grant DPI2006-15476-C02-01, and by FEDER
(under ERDF Program). Many thanks to Pablo Neira
Ayuso for providing us with real rule sets for testing
and to the anonymous reviewers for their useful
comments.
REFERENCES
Abedin, M., Nessa, S., Khan, L., Thuraisingham, B.
“Detection and Resolution of Anomalies in Firewall
Policy Rules”. Proceedings of the Annual IFIP
Working Conference on Data and Applications
Security (DBSec), LNCS 4127. Sophia Antipolis,
France, 2006.
Al-Shaer, E., Hamed, H. Modeling and Management of
Firewall Policies". IEEE eTransactions on Network
and Service Management (eTNSM) Vol.1, No.1, 2004.
Baboescu, F., Varguese, G. “Fast and Scalable Conflict
Detection for Packet Classifiers.” Elsevier Computers
Networks (42-6) (2003) 717-735.
Bollig, B., Wegener, I. “Improving the Variable Ordering
of OBDDs is NP-Complete”. IEEE Transactions on
Computers, Vol.45 No.9, September 1996.
Eppstein, D., Muthukrishnan, S. “Internet Packet Filter
Management and Rectangle Geometry.” Proceedings
of the Annual ACM-SIAM Symposium on Discrete
Algorithms (SODA), January 2001.
García-Alfaro, J., Boulahia-Cuppens, N., Cuppens, F.
Complete Analysis of Configuration Rules to
Guarantee Reliable Network Security Policies,
Springer-Verlag International Journal of Information
Security (Online) (2007) 1615-5262.
Hamed, H., Al-Shaer, E. "Taxonomy of Conflicts in
Network Security Policies." IEEE Communications
Magazine Vol.44, No.3, 2006.
Hari, B., Suri, S., Parulkar, G. “Detecting and Resolving
Packet Filter Conflicts.” Proceedings of IEEE
INFOCOM, March 2000.
Luis, S., Condell, M. "Security policy protocol." IETF
Internet Draft IPSPSPP-01, 2002.
Pozo, S., Ceballos, R., Gasca, R.M. “Fast Algorithms for
Consistency-Based Diagnosis of Firewalls Rule Sets.”
International Conference on Availability, Reliability
and Security (ARES), Barcelona, Spain. IEEE
Computer Society Press, March 2008.
Pozo2, S., Ceballos, R., Gasca, R.M. "Fast Algorithms for
Local Inconsistency Detection in Firewall ACL
Updates". 1
st
International Workshop on
Dependability and Security in Complex and Critical
Information Systems (DEPEND). Cap Esterel, France.
IEEE Computer Society Press, 2008.
Pozo3, S., Ceballos, R., Gasca, R.M. "AFPL, An Abstract
Language Model for Firewall ACLs". 8
th
International
Conference on Computational Science and Its
Applications (ICCSA). Perugia, Italy. Springer-
Verlag, 2008.
Pozo4, S., Ceballos, R., Gasca, R.M. "Polynomial
Heuristic Algorithms for Inconsistency
Characterization in Firewall Rule Sets". 2
nd
International Conference on Emerging Security
Information, Systems and Technologies
(SECURWARE). Cap Esterel, France. IEEE
Computer Society Press, 2008.
Srinivasan, V., Varguese, G, Suri, S., Waldvogel, M. “Fast
and Scalable Layer Four Switching.” Proceedings of
the ACM SIGCOMM conference on Applications,
Technologies, Architectures and Protocols for
Computer Communication, Vancouver, British
Columbia, Canada, ACM Press, 1998.
Taylor, David E. Survey and taxonomy of packet
classification techniques. ACM Computing Surveys,
Vol. 37, No. 3, 2005. Pages 238 – 275.
Yuan, L., Mai, J., Su, Z., Chen, H., Chuah,, C. Mohapatra,
P. FIREMAN: A Toolkit for FIREwall Modelling and
ANalysis. IEEE Symposium on Security and Privacy
(S&P’06). Oakland, CA, USA. May 2006.
Wool, A. A quantitative study of firewall configuration
errors. IEEE Computer, 37(6):62-67, 2004.
A HEURISTIC POLYNOMIAL ALGORITHM FOR LOCAL INCONSISTENCY DIAGNOSIS IN FIREWALL RULE
SETS
441