![](bg2.png)
munication when it does not occur during the system
collects traffic. The second is that it may permits
unintended communication. For example, if malwa-
res perform communication during traffic collection,
such communication section will be permitted.
In this paper, in order to solve above second pro-
blem, we propose communication classifying system
to judge normality of communication. Proposed sy-
stem uses a reason that the previous system permits
communication and a state of destination terminal for
judgement. Result of this judgement makes us pos-
sible to prohibit communication that the previous sy-
stem overly permitted.
2 RELATED WORKS
There are many researches to construct VLAN for the
internal network. Watanabe et al. proposed automati-
cally VLAN construction method focusing on amount
of traffic volume(T. Watanabe, T. Kitazaki, T. Idegu-
chi, and Y. Murata, 2005). In this method, they use
network traffic data to decide network design. When
a certain amount of communication occurs among ter-
minals, such terminals belong to same VLAN. Howe-
ver, from the viewpoint of security, it may not be able
to prevent the malware activities. A terminal with a
small communication volume belongs default VLAN
in this method. This means that if there are inactive
malwares to hide in the network, such infected termi-
nal may belong default VLAN and it can communi-
cation with all terminals in default VLAN. There are
any other researches to support construction or ma-
nagement VLAN(A.K. Nayak, A. Reimers, N. Feam-
ster, and R. Clark, 2009)(T. Miyamoto, T. Tamura, R.
Suzuki, H. Hiraoka, H. Matsuo, M. Izumi, and K. Fu-
kunaga, 2000), however, it is difficult to construct fine
access controls among VLANs.
In addition, there are several products such as
“VLAN .Config”
1
to construct VLAN automatically.
Such products make us possible to construct VLAN to
our network, however, it is difficult to generate ACLs
as same as above researches.
1
http://www.iiga.jp/solution/config/vlan.html
3 OUR PREVIOUS RESEARCH
3.1 An Automated ACL Generation
System using Directory Service
Information and Network Traffic
Data
In order to support constructing separated network,
we proposed a system which generates ACL automa-
tically by using directory service information and net-
work traffic data(H. HasegawaY. YamaguchiH. Shi-
mada, and H.Takakura, 2017). The system generates
ACL based on access authority. If a user of a host has
access authority to files in a server, the system judges
communication between the host and the server is ne-
cessary. On the other hand, if the access from a host
to server is prohibited, the communication between
them is judged as unnecessary and the system restricts
such communication. Because directory service ser-
vers generally manage access authorities from hosts
to files in servers, the system refers directory service
server in organizations.
In addition, the system confirms the effectiveness
of generated ACL by using network traffic data. Be-
fore applying generated ACL, the system collects mir-
rored packets from the network. When communica-
tion prohibited by the ACL is observed, the system
reevaluates that communication is necessary and re-
writes the ACL. By executing these procedures, the
system can generate an ACL, and we can construct a
separated network easily by applying such ACL.
In this paper, we call this system as “Automated
ACL Generation System”.
3.2 Dynamic Access Control Method
with SDN for Practical Network
Separation
The previous system makes us possible to construct a
separated network easily, however, it may prohibit ne-
cessary communication under the following scenario.
Since the system uses mirrored traffic in the network
to judge the necessity of the communication section,
it judges necessary communication as unnecessary if
the communication does not occur during the system
collects mirrored packets.
In order to solve such problem, we proposed a
system that dynamically generates ACL using SDN
(Software Defined Networking)(S. Nakamura, H. Ha-
segawa, Y. Tateiwa, H. Takakura, Y Kim and Y. Ka-
tayama, 2017). Firstly, in this paper, we call this sy-
stem as “Dynamic Access Control System”. Automa-
Construction of Secure Internal Networks with Communication Classifying System
553