基于语义的网络安全策略层次依从性分析

Network security policy and the automated refinement of its hierarchies aims to simplify the administration of security services in complex network environments. The semantic gap between the policy hierarchies reflects the validity of the policy hierarchies yielded by the automated policy refinement process. However, little attention has been paid to the evaluation of the compliance between the derived lower level policy and the higher level policy. We present an ontology based on Ontology Web Language (OWL) to describe the semantics of security policy and their implementation. We also propose a method of estimating the semantic similarity between a given higher level security policy and the lower level ones to evaluate the compliance for the policy refinement approach. The method is verified in the case study. The experimental results demonstrate that the proposed method evaluates the semantic similarity between policy and implementation accurately, and that the algorithm of concept similarity analysis reflects the subjective similarity judgment of policy and implementation more accurate than the other algorithms.     

防火墙策略建模与其全局冲突分析(英文)

The global view of firewall policy conflict is important for administrators to optimize the policy.It has been lack of appropriate firewall policy global conflict analysis,existing methods focus on local conflict detection.We research the global conflict detection algorithm in this paper.We presented a semantic model that captures more complete classifications of the policy using knowledge concept in rough set.Based on this model,we presented the global conflict formal model,and represent it with OBDD(Ordered Binary Decision Diagram).Then we developed GFPCDA(Global Firewall Policy Conflict Detection Algorithm) algorithm to detect global conflict.In experiment,we evaluated the usability of our semantic model by eliminating the false positives and false negatives caused by incomplete policy semantic model,of a classical algorithm.We compared this algorithm with GFPCDA algorithm.The results show that GFPCDA detects conflicts more precisely and independently,and has better performance.     

移动自组织网络中可扩展的定位符/标识符分离路由协议

In the traditional Internet Protocol (IP) architecture, there is an overload of IP semantic problems. Existing solutions focused mainly on the infrastructure for the fixed network, and there is a lack of support for Mobile Ad Hoc Networks (MANETs). To improve scalability. A routing protocol for MANETs is presented based on a locator named Tree-structure Locator Distance Vector (TLDV). The hard core of this routing method is the identifier/locator split by the Distributed Hash Table (DHT ) method, which provides a scalable routing service. The node locator indicates its relative location in the network and should be updated whenever topology changes . Locator space is organized as a tree-structure, and the basic routing operation of the TLDV protocol is presented. TLDV protocol is compared to some classical routing protocols for MANETs on the NS2 platform. Results show that TLDV has better scalability.