网络安全策略模型及冲突检测研究

发布时间：2018-08-17 09:00

【摘要】：基于策略的网络管理由于具有灵活、易用、自动化等特点,在网络安全管理领域得到了广泛的运用。策略是由网络管理员配置的约束规则集,用于保护系统安全。对当前网络安全策略模型研究发现,模型中往往忽略了网络拓扑结构,然而网络拓扑是基于策略的网络管理中的一个重要考虑因素,网络拓扑的改变会使网络管理策略也随之改变。与此同时,随着网络的结构变得越来越复杂,策略的配置不可避免的存在冲突。所以,几乎所有的基于策略的网络安全模型都需要对策略进行一致性检测,消除策略系统中存在的冲突,否则系统将存在安全漏洞。目前的策略冲突检测方法分为单点检测和全局检测两类,均存在缺陷:若进行单点检测,只能检测到网络设备内部的策略冲突,并不能检测网络设备之间的策略冲突;而全局检测则是把所有设备的规则集中起来进行全部检测,此时可能会造成冲突误报。因为在大型网络中,不同路径之间的策略不一致是完全合理的。针对当前网络安全策略模型中存在忽略网络拓扑结构的问题,本文提出了基于网络拓扑的网络安全策略模型,即把网络拓扑和网络设备中的策略规则进行统一建模。在模型中,把网络拓扑抽象为无向图,网络设备之间的数据通信路径抽象为无向图中两个结点之间的路径。同时,对端口及策略规则进行形式化描述,实现策略和无向图的有机联系。针对当前网络安全策略冲突检测中单点检测或全局检测过程所存在的问题,本文提出了基于路径的策略冲突检测方法,即冲突检测的策略为网络路径中的路径规则集。通过此方法,可以精确地检测出网络设备配置中可能存在的冲突。同时,为了提高策略冲突的检测效率,本文提出了基于决策树的策略冲突检测算法。算法根据规则中的维度对规则进行分类,构造出一棵决策树,然后对决策树中叶子结点中包含的规则进行冲突检测。通过决策树对规则的分类,把可能存在冲突的规则分类到同一叶子结点,减少了规则之间的比较次数,进而提高冲突检测效率。最后,本文基于上述模型和算法,设计了网络安全策略冲突检测原型系统。通过测试用例验证,系统能够准确地检测出网络中的策略冲突,基于决策树的分类算法也能够显著地提高策略冲突检测效率。
[Abstract]:Policy-based network management has been widely used in the field of network security management because of its flexibility, ease of use and automation. A policy is a set of constraint rules configured by a network administrator to secure the system. It is found that the network topology structure is often neglected in the current network security policy model. However, network topology is an important consideration in policy-based network management. The change of network topology will change the network management strategy. At the same time, as the network structure becomes more and more complex, the configuration of the policy inevitably conflicts. Therefore, almost all policy-based network security models need to check the policy consistency to eliminate the conflicts in the policy system, otherwise, there will be security vulnerabilities in the system. The current policy conflict detection methods are divided into two categories: single point detection and global detection. If single point detection is carried out, only the policy conflict within the network equipment can be detected, but the policy conflict between the network devices can not be detected. Global detection is a set of rules for all devices, which may cause conflict false positives. Because in large networks, policy inconsistency between different paths is perfectly reasonable. Aiming at the problem of neglecting the network topology in the current network security policy model, this paper proposes a network security policy model based on network topology, that is, the unified modeling of network topology and policy rules in network devices. In the model, the network topology is abstracted as an undirected graph, and the data communication path between network devices is abstracted as a path between two nodes in an undirected graph. At the same time, the port and policy rules are formalized to realize the organic relation between policy and undirected graph. Aiming at the problems of single point detection or global detection in current network security policy conflict detection, a path-based policy conflict detection method is proposed in this paper, that is, the conflict detection strategy is the path rule set in the network path. By this method, the possible conflicts in network device configuration can be detected accurately. At the same time, in order to improve the efficiency of policy conflict detection, this paper proposes a policy conflict detection algorithm based on decision tree. The algorithm classifies the rules according to the dimension of the rules, constructs a decision tree, and then detects the conflict of the rules contained in the leaf nodes in the decision tree. By classifying the rules into the same leaf node by the decision tree, the conflict detection efficiency can be improved by reducing the number of rules compared with each other. Finally, based on the above model and algorithm, the prototype system of network security policy conflict detection is designed. Through the test case verification the system can accurately detect the policy conflict in the network and the classification algorithm based on decision tree can significantly improve the efficiency of policy conflict detection.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【参考文献】