Abnormal policy detection and correction using overlapping transition

Sunghyun Kim, Heejo Lee

Research output: Contribution to journalArticlepeer-review

2 Citations (Scopus)


Policy in security devices such as firewalls and Network Intrusion Prevention Systems (NIPS) is usually implemented as a sequence of rules. This allows network packets to proceed or to be discarded based on rule's decision. Since attack methods are increasing rapidly, a huge number of security rules are generated and maintained in security devices. Under attack or during heavy traffic, the policy configured wrong creates security holes and prevents the system from deciding quickly whether to allow or deny a packet. Anomalies between the rules occur when there is overlap among the rules. In this paper, we propose a new method to detect anomalies among rules and generate new rules without configuration error in multiple security devices as well as in a single security device. The proposed method cuts the overlap regions among rules into minimum overlap regions and finds the abnormal domain regions of rules' predicates. Classifying rules by the network traffic flow, the proposed method not only reduces computation overhead but blocks unnecessary traffic among distributed devices.

Original languageEnglish
Pages (from-to)1053-1061
Number of pages9
JournalIEICE Transactions on Information and Systems
Issue number5
Publication statusPublished - 2010


  • ACL
  • Firewall
  • Network security
  • Policy anomalies
  • Security policy

ASJC Scopus subject areas

  • Software
  • Hardware and Architecture
  • Computer Vision and Pattern Recognition
  • Electrical and Electronic Engineering
  • Artificial Intelligence


Dive into the research topics of 'Abnormal policy detection and correction using overlapping transition'. Together they form a unique fingerprint.

Cite this