Conflict detection system and method for computer network defense (CND) policy

Abstract

The invention relates to a conflict detection system and method for a computer network defense (CND) policy. According to the method, a CND policy description file is read and parsed by using a morphology parser and a grammar parser; an initial policy body is artificially constructed by using a body modeling tool, only comprises concepts for policy tuples in a CND policy and the relationship among the concepts, and does not include policy examples and the relationship among the policy examples; a local policy body including the policy examples is generated according to the initial policy body and a loaded and parsed policy ordered set, a semantic inclusion relationship among the tuples is then obtained according to the semantic mapping of the policy tuples in a defense policy information base, and a CND policy semantic model is constructed based on the semantic inclusion relationship; a relational diagram for all the tuples of the policy is constructed and traversed, and the relationship among the policy tuples is obtained through analysis; and through the measure of tuple comparison, the policy conflict analysis is completed, and the objects, types and reasons for conflict generation are finally provided by algorithms in the form of conflict reports. According to the system and the method, conflicts can be more effectively detected, security problems, such as unauthorized access and the like, are prevented from easily occurring, and the security of a computer network system is greatly improved.

Description

technical field [0001] The invention relates to a conflict detection system and detection method for computer network defense strategies, which belong to the technical field of computer network security, relate to the problem of strategy configuration in computer network defense, and change the idea of ​​conflict detection from firewall rules and other network security equipment The low-level description is extended to the high-level description of the CND strategy. Background technique [0002] In recent years, with the continuous development of computer technology, the network presents the characteristics of large-scale distribution, the number of policies and policy configuration personnel required to be configured in the system will increase, and the difficulty of maintaining network defense strategies will gradually increase. , conflicts are likely to occur during policy configuration, which affects the security of the entire system. Policies are translated into rules ...

AI Technical Summary

Problems solved by technology

[0004] First of all, many researchers have done a lot of research on the problem of policy rule conflict analysis, and have made a lot of achievements, but it must be pointed out that most of these works are aimed at solving specific policy management problems, or research The target of attention is a series of access control policy conflict detection issues such as the conflict of policy rules, and the detection and response policy conflict detection in CND policy (Computer Network Defense, CND) is rarely involved in the research

Images