Detection of Anomalies in Packet Filter Configurations

概要

論文の詳細を見る
Packet filtering in a firewall is one of the useful tools for the network security. Packet filtering examines network packet and decides whether to accept, or deny it and this decision is determined by a packet filtering configuration developed by the network administrator. An administrator may find hard to understand and maintain a configuration, and this burden will further be increased to find anomalies between two configurations, especially when the size of filters in configuration increased. The difficulty may leave the administrator with less confidence that the configurations are correctly and completely implemented. The paper introduces SIERRA (A systolic filter sieve array) to interpret the meaning of configuration in space range, and presents how to use SIERRA tree to decide anomalies in different cases.
一般社団法人情報処理学会の論文
2006-05-11