CN103116670B - The switching consistency verification method of computer network defense strategy - Google Patents
The switching consistency verification method of computer network defense strategy Download PDFInfo
- Publication number
- CN103116670B CN103116670B CN201310033121.1A CN201310033121A CN103116670B CN 103116670 B CN103116670 B CN 103116670B CN 201310033121 A CN201310033121 A CN 201310033121A CN 103116670 B CN103116670 B CN 103116670B
- Authority
- CN
- China
- Prior art keywords
- measure
- strategy
- measures
- data
- policy
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
- 238000000034 method Methods 0.000 title claims abstract description 35
- 230000007123 defense Effects 0.000 title claims abstract description 32
- 238000012795 verification Methods 0.000 title abstract description 20
- 230000014509 gene expression Effects 0.000 claims abstract description 35
- 230000008569 process Effects 0.000 claims abstract description 7
- 238000004458 analytical method Methods 0.000 claims description 16
- 238000001514 detection method Methods 0.000 claims description 15
- 238000007781 pre-processing Methods 0.000 claims description 14
- 238000012545 processing Methods 0.000 claims description 12
- 230000006399 behavior Effects 0.000 claims description 10
- 238000006243 chemical reaction Methods 0.000 claims description 10
- 230000004044 response Effects 0.000 claims description 9
- 238000009795 derivation Methods 0.000 claims description 7
- 238000010586 diagram Methods 0.000 claims description 7
- 238000001914 filtration Methods 0.000 claims description 7
- 101000841301 Homo sapiens Utrophin Proteins 0.000 claims description 4
- 102100029092 Utrophin Human genes 0.000 claims description 4
- 230000006872 improvement Effects 0.000 claims description 4
- 230000000694 effects Effects 0.000 claims description 3
- 230000003068 static effect Effects 0.000 claims description 2
- 230000001681 protective effect Effects 0.000 claims 1
- 230000009471 action Effects 0.000 abstract description 15
- 230000008034 disappearance Effects 0.000 abstract 1
- 239000000284 extract Substances 0.000 abstract 1
- 230000000875 corresponding effect Effects 0.000 description 11
- 230000007812 deficiency Effects 0.000 description 5
- 238000011160 research Methods 0.000 description 4
- 238000004880 explosion Methods 0.000 description 3
- 238000000605 extraction Methods 0.000 description 3
- 230000009466 transformation Effects 0.000 description 3
- 230000007704 transition Effects 0.000 description 3
- 230000006870 function Effects 0.000 description 2
- 238000004519 manufacturing process Methods 0.000 description 2
- 238000002203 pretreatment Methods 0.000 description 2
- 230000003542 behavioural effect Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000012804 iterative process Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000003012 network analysis Methods 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
- 238000003786 synthesis reaction Methods 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 238000010200 validation analysis Methods 0.000 description 1
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The switching consistency verification method of computer network defense (CND) strategy, step is: (1) first carries out tactful pre-service: to policy depiction file and the Turbo codes file of input, the morphology resolver utilizing lex/yacc instrument to generate and syntax parsing device are resolved it, obtain the packet scope for each class action process.Precision is carried out to corresponding main body, object; (2) measure pre-service is carried out again: to the measure description document of input, the morphology resolver utilizing lex/yacc instrument to generate and syntax parsing device are resolved it, determine the protected field that equipment manages, then weed out irrelevant configuration rule, and the packet scope handled by the action specified extracts; (3) the packet scope of all kinds of action is expressed as logical expression, and corresponds on corresponding safety equipment.Utilize propositional logic satisfiability decision means Yices to solve, travel through all packet scopes, obtain measure and whether there is redundancy or disappearance.
Description
Technical Field
The invention belongs to the technical field of computer network security, in particular to a method for verifying whether a high-level strategy and a bottom-level equipment measure in computer network defense are consistent, which expands the idea of consistency analysis from a firewall rule to the environment of the computer network defense strategy.
Background
Computer network defense strategies refer to rules whereby computer networks and information systems select defensive measures based on certain conditions in order to achieve a particular security objective. As attacks on large-scale networks and information systems become more frequent, research into network security has entered the phase of dynamic defense. Policies have always played an important role in the management of security devices, affecting and guiding the configuration of security measures. In general, policies are abstract recognitions based on human thinking and cannot be directly understood by network devices. The network defense strategies at the high level need to be translated manually or automatically into low-level measures to be executed by equipment and personnel. The transformation of the defense strategy is a step-by-step refinement process, and an important task in the strategy evolution process is the consistency analysis and verification of the strategy transformation of each abstraction level. Through checking the consistency before and after conversion, analyzing and indicating the conditions of deficiency and redundancy generated in the conversion process, the further evolution of the strategy can be guided, and a solid foundation can be provided for the strategy to be correctly executed on equipment. The existing method for verifying the conversion consistency of the computer network defense strategy mainly has the following problems:
(1) the method is limited to research objects, is based on a model detection method of logic programming, only aims at the traditional packet filtering firewall when the problem of strategy conversion consistency is researched, and cannot completely express the whole state of computer network defense. Therefore, expanding the model to various kinds of defense strategies remains to be studied.
(2) At present, a consistency detection model based on a colored Petri net can only verify whether a system has a logic error or not, and cannot locate the reason causing the error. Moreover, the state explosion problem of colored Petri nets limits the scale of networks he can verify.
(3) The semantic similarity-based research method has inaccurate consistency judgment due to participation of subjective factors. Moreover, the similarity is only a numerical value and cannot accurately indicate the position where the inconsistency occurs.
Disclosure of Invention
The technical problem of the invention is solved: the method can analyze and locate the loss or redundancy of measures relative to the strategy, and can give counter examples of measures which do not meet the consistency and improvement suggestions based on the strategy. And the method has higher time efficiency and is suitable for the verification of a large-scale network.
The technical scheme adopted by the invention is as follows: the method for verifying the conversion consistency of the computer network defense strategy comprises the following steps:
(1) in the data preprocessing part, the data preprocessing part mainly comprises two parts, one part is used for preprocessing strategies, and the other part is used for preprocessing measures. The policy is the standard of the system consistency analysis, and for the processing of the policy, the range of the data packet processed for each type of action is obtained according to the syntax analysis of lex and yacc. And corresponding subjects and objects are refined.
(2) The pre-treatment part of the measures is slightly more complicated than the pre-treatment of the strategy in step (1). Because one policy may generate multiple measures after the policy is converted into a measure. However, the obtained measure sets are the same in basic structure, a few different places exist in the condition that specific nodes deployed by different measures are not consistent or specific instances IP (Internet protocol) referred by the same term are different, the placed nodes are called organizations in the strategy, and the measures follow the term. Therefore, the protection domain managed by the device is determined, irrelevant configuration rules are eliminated, and the range of the data packets processed by the action specified by the configuration rules is extracted.
(3) The satisfiability expression generation and verification part is the main content of consistency analysis, and the data packet ranges of various actions generated in the steps (1) and (2) are expressed into logic expressions through the grammar described by the SMT description language and are corresponding to the corresponding safety equipment. SMT tools, like SAT tools, are used to solve problem-propositional logic satisfiable problems. But, in contrast, the SAT tool can only address logical propositions that contain only boolean variables. According to a specific theory and logic, the SMT can solve a wider proposition logic problem, the problems can include integer variables and real number type variables, and the obtained logic proposition containing the integer variables or the real number variables is only required to be handed to an SMT tool to be solved. The logic formula solving tool is selected from the group consisting of Yices. The data packet range can be conveniently converted into the logic expression in the form of an integer, so that a mature satisfaction verification tool is utilized to traverse all the data packet ranges, and whether the measures have redundancy or deficiency is obtained.
(4) The error tracking part mainly accomplishes two aspects of work. Locating the position where the inconsistency occurs. The satisfiable expression produces a satisfiable solution in step (3) at which it is determined that a miss or redundancy has occurred. Constructing a data packet counter example. Since the SMT solver can only give one tuple of packets that satisfies the expression, it is not enough to guide the administrator to improve the inconsistency. Therefore, by combining the minimum terms in the expression, the range of the data packet with counterexample is constructed, and all the range of the inconsistent data packet is found.
One CND policy in step (1) includes organizational structure, role, activity, view, context, and measure elements.
The DMDL language adopted by the description measure file in step (1) can describe the defense measures in the dynamic defense model, and the defense measures mainly described in step (1) include: description of static packet filtering rules, description of state firewalls, and description of SYNFlood (IP protocol synchronization bit flooding), UDPStorm (UDP protocol flooding), ICMP flow (ICMP protocol flooding) flow filtering parameters in the protection measures; describing intrusion detection rules and describing intrusion detection node configuration information in detection measures; configuration description of the response measure.
And (3) extracting the behavior semantics in the step (2) by extracting all the sentences containing the measure non-terminal characters, including different types of protection measures, detection measures and response measures in the production formula. Since the non-terminal will generate a fixed and unique terminal action finally, the views and roles related to the statement are classified accordingly according to the final terminal action.
The method for converting the data domain tuple to the satisfiability expression in the step (3) is to perform iterative processing on all measures by using three derivation rules of recall (repeated call), success (success) and failure (failure), and mark the measures at the same time, wherein two conditions are adopted for successful processing: firstly, all measure rules are processed, which means that data packets processed in all measures are declared in a strategy, namely, the definition of no redundancy is met; the data packet of the strategy statement is in the processing range of the measure, which is the definition without loss; there are also two conditions for process failure: the measure set is not processed. It stops at the rule currently being processed and prompts the administrator for redundancy for this rule. Because the scope of the packet that this rule states is not declared in the policy; and secondly, failure derivation rules are met, which means that after all measures are processed, a part of data packets which need to be processed and are declared by the strategy are still unprocessed, namely, the data packets are missing.
The method for solving the counter-example in the step (4) is that under the condition that the verification fails, the SMT solver provides a solution meeting the expression, and the expression in the solution is extracted by recording the counter-example data packet; since the SMT solver can only provide one counter-example, then return; therefore, it is necessary to temporarily ignore the counter-example and keep the policy and measures consistent, and then start a new round of verification, and by continuously establishing a new counter-example and its corresponding satisfiability expression, merge the same polynomials in the expression, so as to obtain the scope of the counter-example packet, and provide an improved opinion for the device configuration management of the administrator.
Compared with the prior art, the method has the beneficial effects that:
(1) the invention can analyze and verify the consistency between CNDPSL language description strategies and measures. The CNDPSL is a declarative language, abstracts the control behavior of network defense, establishes a strategy, measure and formal model of the network, and can uniformly describe protection, detection and response strategies. Therefore, the method has important significance for automatic deployment and defect analysis of strategies and measures in computer network defense.
(2) The invention analyzes the consistency between strategies and measures in the computer network defense, and does not only research the traditional packet filtering firewall, thereby better expressing the overall state of the computer network defense. The method provided by the invention can accurately position the position with inconsistency, does not cause the state explosion problem generated by the Petri network analysis method, improves the consistency verification efficiency to the maximum extent, and is suitable for verification of large-scale networks.
(3) The consistency detection model based on the colored Petri net can only verify whether the system has a logic error or not, and can not locate the reason causing the error. Moreover, the state explosion problem of the Petri net limits the scale of the network which can be verified by the Petri net. The SMT-based verification model proposed by the present invention does not have this problem.
(4) Compared with the prior SAT method, the satisfiability verification technology based on the SMT provided by the invention can quickly and accurately analyze and position the deficiency or redundancy of the measures relative to the strategy, and can give out the measure counter example and the improvement suggestion which do not meet the consistency based on the strategy.
Drawings
FIG. 1 is a functional block diagram of a policy transformation consistency analysis system according to the present invention;
FIG. 2 is a state transition diagram of the robotic model of the present invention;
FIG. 3 is a sequence diagram of a data pre-processing module according to the present invention;
FIG. 4 is a flow diagram of a behavior semantics extraction module of the present invention;
FIG. 5 is a diagram of data field derivation rules in accordance with the present invention;
FIG. 6 is a flow chart of a counter-example construction algorithm of the present invention.
Detailed Description
The invention is realized concretely as follows:
(1) in the data preprocessing part, a strategy file described by a computer network defense strategy description language and a measure file described by a defense measure description language DMDL are automatically analyzed by utilizing Lex and Yacc, so that a protection strategy, a detection strategy and a response strategy, as well as a protection measure, a detection measure and a response measure can be analyzed, wherein a plurality of strategies are stored in the strategy file, and a plurality of measures are stored in the measure file;
(2) extracting the behavior semantics of the strategies and measures in the step (1), obtaining data domain tuples of various behaviors, and giving a structural schematic diagram of the data domain tuples of the strategies and measures;
(3) after the data domain tuples of different behaviors of the strategy and the measure are obtained through the step (2), a satisfiability expression can be generated according to the data domain tuples of the strategy and the measure, the satisfiability expression is input into a satisfiability model theory SMT judgment tool YIces, and the consistency is verified according to the reliability and the completeness defined in the model;
(4) if inconsistency is detected in step (3), an error tracking stage is entered, and at this time, a data packet generator is adopted to observe whether the data is indeed declared in the policy and is not configured in the measure by sending a data packet corresponding to the data domain tuple, so that the correctness of the consistency analysis system is verified, and measure counterexamples and improvement suggestions which do not meet the consistency can be given based on the policy.
The invention adopts the satisfiability solving theory based on SMT to model the strategy and measure in the computer network defense, and then carries out consistency verification on the strategy and measure. If the structure is a satisfied formula, it is described that there is inconsistency between the policy and the measure, a counter example can be obtained by using the derivation rule, and the position, the type and the cause of the inconsistency can be obtained by further analysis.
1. Description of automaton
The method comprises the steps of constructing a consistency analysis automaton model of the computer network defense strategy conversion according to a concept model of the consistency analysis of the computer network defense strategy conversion given in the past, wherein a state transition function of the automaton model is derived from the relation between activities in the concept model, and each state is formed by all values of an entity concept at a certain moment. The model is represented by a push down automaton as follows:
P＝(Q,Σ,,d,q0,Z0,F)
wherein, the state set Q ═ { Q ═ Q0,q1,q2,q3,q4,q5,q5′,q6,q7,q8,q9,q10The input symbol set Σ ═ p, m, sp,smT }; set of stack symbols { P, M, Wp,Wm,Cp,Cm,Sp,Sm,D,Ss,Cs,Z0}; d is a body transfer function of the automaton, and the specific state transition is shown in FIG. 2; set of termination states F ═ q0}。
q0Indicating an initial state and a normal final state, i.e. performing a consistency analysis, q1Indicating the completion of the receiving of the policy statement, q2Representing the state of receiving the policy grammar and obtaining a set of policy ordered words, q3Representing the state of extracting the behavioral semantics of the ordered set of words and obtaining a policy data domain tuple, q4Indicating the completion of the statement of the accepted measure, q6State representing the grammar of the accepted measure and resulting in a set of measures ordered words, q7Representing the state of acceptance of the topology and resulting in an ordered set of concepts and policy structures, q8Representing the state of accepting the measure syntax and obtaining the measure structure and the policy structure, q9Representing the state of structural similarity and key concept pairs derived from policy and measure structures, q10Representing the state of concept similarity obtained from key concept pairs, and finally q10Returning to the initial state q after the semantic similarity is obtained by state synthesis0. Automatic machineThe model is shown in fig. 2, and table 1 gives a symbolic illustration of sigma-sum.
Table 1 symbol description table in automaton
| Symbol | Meaning of a symbol |
| p | Representing policy description statements |
| m | Presentation measure description statement |
| sp | Representing policy syntax |
| sm | Syntax of presentation measure |
| t | Representing topological descriptions |
| P | Stack symbols representing policy description statements |
| M | Stack symbols, representing measure description statements |
| Wp | Stack notation representing a set of policy ordered words |
| Wm | Stack symbol, sequential word set for presentation measure |
| Cp | Stack notation representing an ordered set of concepts for a policy |
| Cm | Stack notation, representing an ordered set of concepts for a measure |
| Sp | Stack notation, meaning semantic structure of policy statements |
| Sm | Stack symbols, semantic structures representing measure statements |
| D | Stack symbols representing sets of key concept pairs |
| Ss | Stack symbols representing statement satisfiability expressions |
| Cs | Stack symbol, presentation measure location set |
| Z0 | Bottom of stack symbol, no meaning |
2. Data pre-processing
The data preprocessing module of the invention mainly comprises two sub-modules, one part is the preprocessing of the strategy statement, and the other part is the preprocessing of the measure statement, as shown in fig. 3. The strategy sentences are the benchmark of system consistency analysis, and the whole strategy is considered to accurately reflect the upper-layer intention. For policy processing, firstly, a packet range for each type of action processing is obtained according to syntax analysis of Lex and Yacc. And corresponding subjects and objects are refined. As another module of the data preprocessing module, the preprocessing of the measure statements is slightly more complex than the preprocessing of the policy statements. Because after a policy is converted into a measure, one policy statement may generate a plurality of measure statements. However, the obtained measure statement sets are the same in basic structure, a few different places exist in the condition that specific nodes deployed by different measures are not consistent or specific instances IP (Internet protocol) referred by the same term are different, the placed nodes are called organization mechanisms in the strategy, and the measures follow the term. Therefore, the protection domain managed by the device is determined, irrelevant configuration rules are eliminated, and the range of the data packets processed by the action specified by the configuration rules is extracted.
Through Lex, Yacc's syntax analysis, the policy statement is identified as the corresponding syntax unit. Since only the behavior semantics need to be extracted, all the statements containing < measure > non-terminal characters are extracted, including < measure > (< protect _ measure >, < detect _ measure >, < response _ measure >) in different categories in the above production formula. Since the non-terminal will generate a fixed and unique terminal action finally, the views and roles related to the statement are classified accordingly according to the final terminal action. Wherein, the terminator includes limit, dent, detect _ ICMPLOOD, detect _ SYNFLOOD, detect _ UDPFLOOD, detect _ Slammer, detect _ IPSpoof, detect _ PassWordCracker, detect _ Smurf, detect _ authypelixoid, detect _ informationthief, detect _ servicedense, detect _ troman, detect _ work, detect _ all, promote _ source, stop _ service, etc. in the above-mentioned generation formula. And for the classified roles, views and the like, corresponding statement sentences need to be found and are refined into data domain tuples. The input condition is used for further generating the satisfiability expression by marking and storing the objects of different actions respectively. The extraction process is shown in fig. 4.
3. Satisfiability expression generation and verification
The data domain tuples obtained by semantic extraction cannot be directly identified by an SMT solver. Therefore, there is a need for an automated conversion of data field tuples into first order logical expressions described in an SMT specified language. Secondly, the generated satisfiability expressions need to be combined and constructed as expressions that are never satisfiable. If the policy can be satisfied, the policy and the measure are inconsistent, and the satisfied solution is the opposite example of the inconsistency. Two aspects of the consistency verification test are given below: no missing and no redundancy. First, start with a doublet (MC, D). Where MC is a sequence of measures (filtering rules) and D is a subset of the full set of data fields P, with D being used to store the range of data fields accumulated by the rules processing before MC.
As shown in fig. 5, Recurcall is the most dominant derivation rule. It first follows the first rule in the (MC, D) pairIt is extracted that if it satisfies the rule that the packet in question is before this rule, is not processed and is within the scope of the packet as stated by the policy, then this rule is marked as processed and rejected in the MC. And D is expanded to Duom (r). Thus, such an iterative process can process the entire measure rule.
Conditions of success. Successful conditions include two. First, all action rules are processed, i.e.This means that the packets processed in all measures are declared in the policy, i.e. the definition of no redundancy is satisfied. Second, to satisfyI.e. the data packets of the policy statement should be within the scope of the processing of the measure, which is a definition of absence.
A failure condition. During execution, there are two types of errors. First, MC is not processed. It stops at the rule currently being processed and prompts the administrator for redundancy for this rule. Since the scope of the packet that this rule states is not stated in the policy. Second, do not satisfyThis means that after all the measure processing is completed, there is still a part of the data packets that need to be processed and are declared by the policy, which are not processed, i.e. there is a miss.
And expressing the strategy and the data packet range dom (Ri) expressed by the measures by using a satisfiability method, and further performing the property verification of the redundancy and the deficiency of the measures. The main requirement is that the following two expressions are never satisfied. For no redundancy, i.e. requiring that for each rule Ri,it is never satisfied. Wherein,ΦAiis the satisfiability expression for the packet range of the action as Ai in the strategy. On the other hand, for Φ obtained without deficiency, i.e. requiring rule for all measures to be processediAnd corresponding actions in the strategy phiAiTo ensureCannot be satisfied.
4. Data counter example structure
Due to the validation results obtained by the SMT solver, only one counter-example of a packet is returned when there is a satisfactory solution. This is not enough for the administrator to be aware of the security risks present in the entire network. Therefore, a plurality of counter examples existing in expressions are converged into a data packet range meeting the solution by a min term resolution method. The flow chart is shown in fig. 6.
Firstly, the constructed satisfiability expressions are verified one by utilizing a solver of the SMT, and when verification is not lacked, the condition of verification failure may exist. At this point, the SMT solver provides a solution that satisfies the expression. This solution is in the form of a satisfiability expression for counter-example packets. And recording the counter-example data packet so as to extract the expression from the counter-example data packet. Since the SMT solver can only provide one counter-example and then return. Therefore, it is necessary to temporarily ignore the counter-example and keep the policy and measures consistent, and then start a new round of verification, and by continuously establishing a new counter-example and its corresponding satisfiability expression, merge the same polynomials in the expression, so as to obtain the scope of the counter-example packet, and provide an improved opinion for the device configuration management of the administrator.
5. Error tracking
The error tracking module mainly accomplishes two aspects of work. First, the location where the inconsistency occurred is located. Where the corresponding satisfiable expression yields a satisfiable solution, it may be determined that a miss or redundancy has occurred therein. Second, construct a packet counterexample. Since the SMT solver can only give one tuple of packets that satisfies the expression, it is not enough to guide the administrator to improve the inconsistency. Therefore, by combining the minimum terms in the expression, the range of the data packet with counterexample is constructed, and all the range of the inconsistent data packet is found.
Claims (4)
1. The method for verifying the conversion consistency of the computer network defense strategy is characterized by comprising the following steps of:
(1) in the data preprocessing part, a strategy file described by a computer network defense strategy description language and a measure file described by a defense measure description language DMDL are automatically analyzed by utilizing Lex and Yacc, so that a protection strategy, a detection strategy and a response strategy, as well as a protection measure, a detection measure and a response measure can be analyzed, wherein a plurality of strategies are stored in the strategy file, and a plurality of measures are stored in the measure file;
(2) extracting the behavior semantics of the strategies and measures in the step (1), obtaining data domain tuples of various behaviors, and giving a structural schematic diagram of the data domain tuples of the strategies and measures;
(3) after the data domain tuples of different behaviors of the strategy and the measure are obtained through the step (2), a satisfiability expression can be generated according to the data domain tuples of the strategy and the measure, the satisfiability expression is input into a satisfiability model theory SMT judgment tool YIces, and the consistency is verified according to the reliability and the completeness defined in the model;
(4) if inconsistency is detected in step (3), an error tracking stage is entered, and at this time, a data packet generator is adopted to observe whether the data is indeed declared in the policy and is not configured in the measure by sending a data packet corresponding to the data domain tuple, so that the correctness of the consistency analysis system is verified, and measure counterexamples and improvement suggestions which do not meet the consistency can be given based on the policy.
2. The method of claim 1, wherein the method comprises: one computer network defense CND policy in step (1) includes organizational structure, role, activity, view, context and measure elements.
3. The method of claim 1, wherein the method comprises: the DMDL language adopted by the description measure file in step (1) can describe the defense measures in the dynamic defense model, and the defense measures mainly described in step (1) include: the description of the static packet filtering rule, the description of the state firewall and the description of the flow filtering parameters of SYNFlood, UDPStorm and ICMPPFlod in the protective measure; describing intrusion detection rules and describing intrusion detection node configuration information in detection measures; configuration description of the response measure.
4. The method of claim 1, wherein the method comprises: the method for converting the data domain tuple to the satisfiability expression in the step (3) is to perform iterative processing on all measures by repeatedly calling three derivation rules of receurcall, success and failure, and mark the measures at the same time, wherein two conditions are adopted for successful processing: firstly, all measure rules are processed, which means that data packets processed in all measures are declared in a strategy, namely, the definition of no redundancy is met; the data packet of the strategy statement is in the processing range of the measure, which is the definition without loss; there are also two conditions for process failure: firstly, the measure set is not processed; it will stop at the rule currently being processed, prompting the administrator that there is redundancy for this rule; because the scope of the packet that this rule states is not declared in the policy; and secondly, failure derivation rules are met, which means that after all measures are processed, a part of data packets which need to be processed and are declared by the strategy are still unprocessed, namely, the data packets are missing.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310033121.1A CN103116670B (en) | 2013-01-28 | 2013-01-28 | The switching consistency verification method of computer network defense strategy |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310033121.1A CN103116670B (en) | 2013-01-28 | 2013-01-28 | The switching consistency verification method of computer network defense strategy |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103116670A CN103116670A (en) | 2013-05-22 |
| CN103116670B true CN103116670B (en) | 2015-12-23 |
Family
ID=48415043
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310033121.1A Expired - Fee Related CN103116670B (en) | 2013-01-28 | 2013-01-28 | The switching consistency verification method of computer network defense strategy |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN103116670B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109246159B (en) * | 2018-11-27 | 2021-09-21 | 杭州迪普科技股份有限公司 | Method and device for verifying security policy |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101950340A (en) * | 2010-09-17 | 2011-01-19 | 北京航空航天大学 | Computer network defensive strategy conversion-oriented semantic similarity detection system |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7353468B2 (en) * | 2003-09-26 | 2008-04-01 | Ferguson John G | Secure exchange of information in electronic design automation |
-
2013
- 2013-01-28 CN CN201310033121.1A patent/CN103116670B/en not_active Expired - Fee Related
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101950340A (en) * | 2010-09-17 | 2011-01-19 | 北京航空航天大学 | Computer network defensive strategy conversion-oriented semantic similarity detection system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN103116670A (en) | 2013-05-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112131882A (en) | Multi-source heterogeneous network security knowledge graph construction method and device | |
| CN111163086A (en) | Multi-source heterogeneous network security knowledge graph construction and application method | |
| CN105637519A (en) | Cognitive information security using a behavior recognition system | |
| US10261967B2 (en) | Data extraction | |
| CN102611713B (en) | Entropy operation-based network intrusion detection method and device | |
| CN101447991A (en) | Test device used for testing intrusion detection system and test method thereof | |
| CN102457414A (en) | Network security automatic assessment method and system adopting same used in classified security protection assessment | |
| CN104766015B (en) | A kind of buffer-overflow vulnerability dynamic testing method based on function call | |
| CN109800258A (en) | Data file dispositions method, device, computer equipment and storage medium | |
| Gutiérrez‐Madroñal et al. | Evolutionary mutation testing for IoT with recorded and generated events | |
| CN114547415A (en) | Attack simulation method based on network threat information in industrial Internet of things | |
| CN116405246A (en) | Vulnerability exploitation chain construction technology based on attack and defense combination | |
| CN107231383A (en) | The detection method and device of CC attacks | |
| CN112882899B (en) | Log abnormality detection method and device | |
| CN103116670B (en) | The switching consistency verification method of computer network defense strategy | |
| Wang et al. | Nlp-based cross-layer 5g vulnerabilities detection via fuzzing generated run-time profiling | |
| CN116248393A (en) | Intranet data transmission loophole scanning device and system | |
| Urbanska et al. | Structuring a vulnerability description for comprehensive single system security analysis | |
| CN104050151A (en) | Security incident feature analysis method and system based on predicate deduction | |
| Milov et al. | Development of a scenario modeling of conflict tools in a security system based on formal grammars | |
| CN104933357A (en) | Flooding attack detection system based on data mining | |
| Li et al. | Research on network protocol vulnerability discovery based on fuzz testing | |
| Cheng et al. | MSFuzz: Augmenting Protocol Fuzzing with Message Syntax Comprehension via Large Language Models. | |
| Cardoso et al. | Extending Attack-Fault Trees with Runtime Verification | |
| Irani et al. | ArguSense: Argument-Centric Analysis of Online Discourse |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20151223 Termination date: 20180128 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |