SRI Logo
About Us|R and D Divisions|Careers|Newsroom|Contact Us|SRI Home
  SRI Logo

Automatic Analysis of Firewall and Network Intrusion Detection System Configurations
 by Dr. Steven Cheung & Dr. Tomas Uribe.

Journal of Computer Security
Volume 15, Issue 6, Pages 691-715
December 2007

Firewalls and network intrusion detection systems (NIDSs) are widely used to secure computer networks. Given a network that deploys multiple firewalls and NIDSs, ensuring that these security components are correctly configured is a challenging problem. Although models have been developed to reason independently about the effectiveness of firewalls and NIDSs, there is no common framework to analyze their interaction. This paper presents an integrated, constraint-based approach for modeling and reasoning about these configurations. Our approach considers the dependencies among the two types of components, and can reason automatically about their combined behavior. We have developed a tool for the specification and verification of networks that include multiple firewalls and NIDSs, based on this approach. This tool can also be used to automatically generate NIDS configurations that are optimal relative to a given cost function.
BibTEX Entry
  title     = "Automatic Analysis of Firewall and Network Intrusion
               Detection System Configurations",
  author    = "Tom{\'a}s E. Uribe and Steven Cheung",
  journal   = "Journal of Computer Security",
  volume    = 15,
  number    = 6,
  pages     = "691--715",
  year      = "2007"


About Us  |  R&D Divisions  |  Careers  |  Newsroom  |  Contact Us
© 2019 SRI International 333 Ravenswood Avenue, Menlo Park, CA 94025-3493
SRI International is an independent, nonprofit corporation. Privacy policy