Transition consistency verification method of computer network defending strategy

Abstract

Disclosed is a transition consistency verification method of a computer network defending (CND) strategy. The steps are as follows: (1) strategy preprocessing is firstly carried out; the input strategy description files and topology description files are analyzed through a lexical analyzer and a grammar analyzer generated by a lex (lexical analyzer) / yacc (yet another compiler compiler) tool, and a data package range of processing actions of each kind is obtained. A corresponding subject and a corresponding object are elaborated; (2) then measure preprocessing is carried out: the input measure description files are analyzed through the lexical analyzer and the grammar analyzer generated by the lex / yacc tool so as to confirm a protection domain managed by the equipment, irrelevant configuration rules are removed, and the data package range processed by the regulated actions is taken out; (3) data package ranges of actions of various kinds are formed in logical expressions, and the logical expressions correspond to related safety equipment. Solving of a property decision tool Yices can be met by propositional logic, all the data package ranges are browsed, and whether redundancy or deficiency of the measures exists is detected.

Description

technical field [0001] The invention belongs to the technical field of computer network security, specifically a method for verifying the consistency between high-level strategies and bottom-layer equipment measures in computer network defense, and extends the idea of ​​consistency analysis from firewall rules to computer network defense strategies Environment. Background technique [0002] Computer network defense strategy refers to the rules for computer network and information systems to choose defense measures according to certain conditions in order to achieve specific security goals. With the increasing frequency of attacks on large-scale networks and information systems, the research on network security has entered the stage of dynamic defense. Policies have always played an important role in the management of security devices, influencing and guiding the configuration of security measures. Usually, policies are abstract cognitions based on human thinking and cannot...

AI Technical Summary

Problems solved by technology

[0004] (2) At present, the consistency detection model based on colored Petri nets can only verify whether the system has logical errors, but cannot locate the cause of the error

Moreover, the state explosion problem of colored Petri nets limits the network size that he can verify

[0005] (3) The research method based on semantic similarity, due to the participation of subjective factors, the judgment of consistency is not accurate

Moreover, the similarity is only a numerical value, and it is impossible to precisely point out the location of the inconsistency

Images