Non‐dominated sorting particle swarm optimization (NSPSO) and network security policy enforcement for Policy Space Analysis. (1st March 2018)

• Record Type: Journal Article
• Authors: Sureshkumar, Thathan; Lingaraj, Mani; Anand, Bojan; Premkumar, Thathan
• Is Part Of: International journal of communication systems. Volume 31:Number 10(2018)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2018-03-01
• Subjects: computer network -- policy enforcement algorithm -- policy space analysis and fuzzy rule -- security; Telecommunication systems -- Periodicals; 621.382
• DOI: 10.1002/dac.3554
• Languages: English
• ISSNs: 1074-5351

Abstract

Summary: Network operators depend on security services with the aim of safeguarding their IT infrastructure. Various types of network security policies are employed on a global scale and are disseminated among several security middleboxes implemented in networks. But, owing to the complications in security policies, it is not quite efficient to directly use the path‐wise enforcement schemes that are prevalent. The major motivation of this work is to improve security levels and solve the policy enforcement problem. For the first time, this work reports the issue of policy enforcement on middleboxes. The major contribution of this work is to design security policy enforcement as a Weighted K Set Covering Problem, and we designed a Policy Space Analysis (PSA) tool intended for a group of operations in the security policy. This PSA tool was developed based on range‐signified hyper‐rectangles, which are indexed by the Hilbert R‐tree. Leveraging the PSA, we first investigated the topological features of various kinds of policies. Balancing the PSA tool in a non‐dominated sorting particle swarm optimization technique exposes the intrinsic difficulties of this security strategy and provides guidance for designing the enforcement approach. In addition, in this research, a new fuzzy rule‐based classification system is introduced for packet classification. A scope‐wise policy enforcement algorithm was proposed, which chooses a moderate number of enforcement network nodes for deploying multiple policy subsets in a greedy manner. This scheme is much quicker compared with the first one and therefore has found its application in real‐time deployments. Abstract : Network operators depend on security services with the aim of safeguarding their IT infrastructure. Various types of network security policies are employed on a global scale and are disseminated among several security middleboxes implemented in networks. But, owing to the complications in security policies, it is not quite efficient to directly use the path‐wise enforcement schemes that are prevalent. The major motivation of this work is to improve security levels and solve the policy enforcement problem. For the first time, this work reports the issue of policy enforcement on middleboxes.