Classification and Analysis of Communication Protection Policy Anomalies

Fulvio Valenza, Cataldo Basile, Daniele Canavese, Antonio Lioy
2017 IEEE/ACM Transactions on Networking  
This paper presents a classification of the anomalies that can appear when designing or implementing communication protection policies. Together with the already known intra- and inter-policy anomaly types, we introduce a novel category, the inter-technology anomalies, related to security controls implementing different technologies, both within the same network node and among different network nodes. Through an empirical assessment, we prove the practical significance of detecting this new
more » ... aly class. Furthermore, this paper introduces a formal model, based on first-order logic rules that analyses the network topology and the security controls at each node to identify the detected anomalies and suggest the strategies to resolve them. This formal model has manageable computational complexity and its implementation has shown excellent performance and good scalability.
doi:10.1109/tnet.2017.2708096 fatcat:2q6oknnrlfg6vdn7tujayipoke