Search

Intrusion detection technology aimed at identifying hidden illegal intrusion by the analysis of network traffic. To an attacker, if he wants to send malicious code to a protected host in the internal network, he has to firstly evade the detection of the intrusion detection system (IDS). The IDS evasion techniques enable IDS produce omission or misstatement, can greatly increase the probability of success attacks. But after years of the contest between evasion and anti-evasion, individual evasions and random combined evasions is difficult to implement and also inefficient. This paper is committed to providing a systematic and scientific generation method for multiple evasions. Using this framework, we are able to design a complete system for IDS anti-evasion testing, and provide recommendations for giving IDS policies.

Due to different class systems make access decision independently, in the cross class information system (Cross-Class-IS), the privilege may be out of control and the security policies may not be coincident. It is huge risk especially to the higher class system. Now, the system normally checks the security of the access between subject and object. But it cannot protect the indirect information caused by access cross class and domain. This article proposes an access control model, which can be used to analyze the security in Cross-Class-IS.

Security policy is the core to ensure the system operating safely, security policy conflict will cause the system to suffer a security threaten, which even make system crash, therefore security policy conflict detection is particularly important. This paper researches the type of intra-node security policy conflict detection, analyses the complexity of algorithm of security policy conflict detection, improves the algorithm of security policy conflict detection which based on state transition, proves that the algorithm improved efficiency of security policy conflict detection. Finally, we compare the performance of conflict detection algorithms between the previous and the improved one's, verify that the algorithm is correct, efficient, and has practical value.

Device and technology oriented policy making excessively depends on the knowledge and experiences of managers, but ignores the requirements and effects of the application environment. So the policy making is incomplete and liable to make mistakes. To solve the problem, hierarchy network security system model is designed. Policy making and representation methods are proposed based on the system modeling, which make the policy making is not limited to a single device and the only one security function. Upon the method, the policy auto making is implemented, and the policy correctness and integrity are insured, which decrease the burden of the manager and the possibilities of mistaking. According to the refinement of the policy basic attributes, multi-level policy representation described in BNF (Backus-Naur Form) form is promoted, which makes policy representation friendlier and more operable.

Policy monitoring is one of the most indispensable parts in the security policy management, which can improve the reliability of the system and offer the references to the other audit after some security incidentspsila occurrences. In this paper, the policy states are divided into several types. Also the policy states transition model based on the Mealy automata is promoted, which provides the objects and method for the policy monitoring. Finally, the programs implementation of the automata and the test results demonstrate the timely response as soon as events happen.