The Experts below are selected from a list of 2874 Experts worldwide ranked by ideXlab platform

Xiangke Liao - One of the best experts on this subject based on the ideXlab platform.

  • do you really know how to configure your software configuration constraints in source code may help
    IEEE Transactions on Reliability, 2018
    Co-Authors: Xiangke Liao, Shulin Zhou, Zhouyang Jia, Xiaodong Liu
    Abstract:

    Misconfigurations have become one of the major causes of software failures because of their increasing prevalence and severity. The complexity of configurations and users’ lack of domain knowledge are the main reasons for massive Misconfigurations. Users usually identify and diagnose Misconfigurations by making a comparison against the conditions that configuration options should satisfy, which we refer to as configuration constraints ; however, sometimes it is hard for users to accomplish this work. Some work has been done on obtaining configuration constraints, especially from source code; nevertheless, only part of the situation has been considered, such as if-statement code snippets, limiting its help in misconfiguration diagnosis. In order to better extract configuration constraints for users’ guidance and misconfiguration diagnosis, we carried out a comprehensive manual study on the existence and variance of the configuration constraints in the source code of five different pieces of widely used open-source software. Three categories of findings are summarized based on our study, namely the general statistics, the general features of specific kinds of constraints, and the obstacles to the automatic extraction of configuration constraints. With these findings, we proposed several suggestions to maximize the automatic extraction of configuration constraints. The results show that our suggestions could improve the extraction of configuration constraints compared to existing methods.

  • QRS - MisconfDoctor: Diagnosing Misconfiguration via Log-Based Configuration Testing
    2018 IEEE International Conference on Software Quality Reliability and Security (QRS), 2018
    Co-Authors: Teng Wang, Xiaodong Liu, Xiangke Liao, Qing Liao
    Abstract:

    As software configurations continue to grow in complexity, misconfiguration has become one of major causes of software failure. Software configuration errors can have catastrophic consequences, seriously affecting the normal use of software and quality of service. And misconfiguration diagnosis faces many challenges, such as path-explosion problems and incomplete statistical data. Our study of the log that is generated in response to Misconfigurations by six widely used pieces of software highlights some interesting characteristics. These observations have influenced the design of MisconfDoctor, a misconfiguration diagnosis tool via log-based configuration testing. Through comprehensive misconfiguration testing, MisconfDoctor first extracts log features for every misconfiguration and builds a feature database. When a system misconfiguration occurs, MisconfDoctor suggests potential Misconfigurations by calculating the similarity of the new exception log to the feature database. We use manual and real-world error cases from Httpd, MySQL and PostgreSQL in order to evaluate the effectiveness of the tool. Experimental results demonstrate that the tool's accuracy reaches 85% when applied to manual-error cases, and 78% for real-world cases.

  • MaLTeSQuE@SANER - ConfigFile++: Automatic comment enhancement for misconfiguration prevention
    2018 IEEE Workshop on Machine Learning Techniques for Software Quality Evaluation (MaLTeSQuE), 2018
    Co-Authors: Yuanliang Zhang, Xiangke Liao, Shazhou Yang, Yun Xiong
    Abstract:

    Nowadays, misconfiguration has become one of the key factors leading to system problems. Most current research on the topic explores misconfiguration diagnosis, but is less concerned with educating users about how to configure correctly in order to prevent misconfiguration before it happens. In this paper, we manually study 22 open source software projects and summarize several observations on the comments of their configuration files, most of which lack sufficient information and are poorly formatted. Based on these observations and the general process of misconfiguration diagnosis, we design and implement a tool called ConfigFile++ that automatically enhances the comment in configuration files. By using name-based analysis and machine learning, ConfigFile++ extracts guiding information about the configuration option from the user manual and source code, and inserts it into the configuration files. The format of insert comment is also designed to make enhanced comments concise and clear. We use real-world examples of Misconfigurations to evaluate our tool. The results show that ConfigFile++ can prevent 33 out of 50 Misconfigurations.

  • ConfVD: System Reactions Analysis and Evaluation Through Misconfiguration Injection
    IEEE Transactions on Reliability, 2018
    Co-Authors: Xiangke Liao, Shaoliang Peng, Shulin Zhou, Zhouyang Jia, Teng Wang
    Abstract:

    In recent years, Misconfigurations have become one of the major causes of software system failures, resulting in numerous service outages. What is worse, Misconfigurations are also costly to diagnose and troubleshoot. This remains a great challenge for sysadmins (system administrators) to detect, diagnose, or troubleshoot these Misconfigurations. Unlike software bugs, Misconfigurations are more vulnerable to sysadmins’ mistakes. Developers and researchers are attempting to improve system reactions to Misconfigurations to ease the burden of sysadmins’ diagnoses. Such efforts would greatly benefit from the techniques that can comprehensively detect bad system reactions through injected Misconfigurations. Unfortunately, few such studies have achieved the above goal in the past, primarily because they only relied on generic alterations and failed to find a way to systematically generate Misconfigurations. In this paper, we study eight mature open-source and commercial software packages and summarize a fine-grained classification of option types. Based on this classification, we use Augmented Backus–Naur Form to summarize and extract syntactic and semantic constraints of each type. In order to generate comprehensive Misconfigurations in the test systems, we propose misconfiguration generation methods for our constraints. We implement a tool named Configuration Vulnerability Detector (ConfVD) to conduct misconfiguration injection and further analyze the systems’ reaction abilities to various Misconfigurations. We carried out comprehensive analyses upon Apache Httpd, MySQL, PostgreSQL, and Yum. The results of our analysis show that our option classification covers 96% of 1582 options from the above-mentioned systems. Our constraints are more fine grained than previous works and their accuracy was found to be 91% (ascertained by manual verification). Our technique could improve generic alteration approaches without constraints, and we found that ConfVD could find nearly three times the bad reactions that were found by ConfErr. In total, we found 65 bad reactions from the systems being tested and our fine-grained constraints contributed 27.7% more bad reactions than techniques only using coarse-grained constraints.

  • EASE - ConfTest: Generating Comprehensive Misconfiguration for System Reaction Ability Evaluation
    Proceedings of the 21st International Conference on Evaluation and Assessment in Software Engineering, 2017
    Co-Authors: Xiangke Liao, Shulin Zhou, Zhouyang Jia
    Abstract:

    Misconfigurations are not only prevalent, but also costly on diagnosing and troubleshooting. Unlike software bugs, Misconfigurations are more vulnerable to users' mistakes. Improving system reaction to Misconfigurations would ease the burden of users' diagnoses. Such effort can greatly benefit from a comprehensive study of system reaction ability towards Misconfigurations based on errors injection method. Unfortunately, few such studies have achieved the above goal in the past, primarily because they fail to provide rich error types or only rely on generic alternations to generate Misconfigurations. In this paper, we studied 8 mature opensource and commercial software and summarized a fine-grained classification of option types. On the basis of this classification, we could extract syntactic and semantic constraints of each type to generate Misconfigurations. We implemented a tool named ConfTest to conduct misconfiguration injection and further analyze system reaction abilities to various of Misconfigurations. We carried out comprehensive analyses upon 4 open-source software systems. Our evaluation results show that our option classification covers over 96% of 1582 options from Httpd, Yum, PostgreSQL and MySQL.Our constraint is more fined-grained and the accuracy is more than 90% of of real constraints through manual verification. We compared the capability in finding bad system reactions between ConfTest and ConfErr, showing that the ConfTest can find nearly 3 times the bad reactions found by ConfErr.

Adel Bouhoula - One of the best experts on this subject based on the ideXlab platform.

  • CNSM - A Formal Approach for Automatic Detection and Correction of SDN Switch Misconfigurations
    2020 16th International Conference on Network and Service Management (CNSM), 2020
    Co-Authors: Wejdene Saied, Adel Bouhoula
    Abstract:

    Software-defined networking (SDN) is a network architecture that enables the network to be centrally controlled using software. The network administrators can reprogram the network using SDN without changing hardware devices to provide new solutions for controlling network traffic. However, SDN has its drawbacks in security, scalability, and elasticity. The security validation of SDN configurations is an important issue that should be addressed. Therefore, there is a need for automated methods to analyze, investigate and fix switch configurations faults. The objective of our work is to propose: (1) a new formal approach to discover security challenges using Flow entries Decision Diagram (FeDD) analysis, to identify loop freedom, access violation, black-holes, and controller misconfiguration; (2) an optimal and fine-grained resolution mechanisms to correct these Misconfigurations in different topologies: (3) a tool that implements the proposed techniques and effectively helps administrators in detecting and resolving switch Misconfigurations.

  • a formal approach for automatic detection and correction of sdn switch Misconfigurations
    Conference on Network and Service Management, 2020
    Co-Authors: Wejdene Saied, Adel Bouhoula
    Abstract:

    Software-defined networking (SDN) is a network architecture that enables the network to be centrally controlled using software. The network administrators can reprogram the network using SDN without changing hardware devices to provide new solutions for controlling network traffic. However, SDN has its drawbacks in security, scalability, and elasticity. The security validation of SDN configurations is an important issue that should be addressed. Therefore, there is a need for automated methods to analyze, investigate and fix switch configurations faults. The objective of our work is to propose: (1) a new formal approach to discover security challenges using Flow entries Decision Diagram (FeDD) analysis, to identify loop freedom, access violation, black-holes, and controller misconfiguration; (2) an optimal and fine-grained resolution mechanisms to correct these Misconfigurations in different topologies: (3) a tool that implements the proposed techniques and effectively helps administrators in detecting and resolving switch Misconfigurations.

  • Automated and Optimized Formal Approach to Verify SDN Access-Control Misconfigurations
    2019
    Co-Authors: Amina Saâdaoui, Nihel Ben Youssef Ben Souayeh, Adel Bouhoula
    Abstract:

    Software-Defined Networking (SDN) brings a significant flexibility and visibility to networking, but at the same time creates new security challenges. SDN allows networks to keep pace with the speed of change by facilitating frequent modifications to the network configuration. However, these changes may introduce Misconfigurations by writing inconsistent rules for Flow-tables. Misconfigurations can arise also between firewalls and Flow-tables in OpenFlow-based networks. Problems arising from these Misconfigurations are common and have dramatic consequences for networks operations. Therefore, there is a need of automatic methods to detect and fix these Misconfigurations. Given these issues, some methods have been proposed. Though these methods are useful for managing Flow-tables rules, they still have limitations in term of low granularity level and the lack of precise details of analyzed flow entries. To address these challenges, we present in this paper a formal approach that allows to discover Flow-tables Misconfigurations using inference systems. The contributions of our work are the following: automatically identifying Flow-tables anomalies, using the Firewall to bring out real Misconfigurations and proposing automatic method to deal with set-field action of flow entries.

  • TRIDENTCOM - Automated and Optimized Formal Approach to Verify SDN Access-Control Misconfigurations
    Lecture Notes of the Institute for Computer Sciences Social Informatics and Telecommunications Engineering, 2019
    Co-Authors: Amina Saâdaoui, Nihel Ben Youssef Ben Souayeh, Adel Bouhoula
    Abstract:

    Software-Defined Networking (SDN) brings a significant flexibility and visibility to networking, but at the same time creates new security challenges. SDN allows networks to keep pace with the speed of change by facilitating frequent modifications to the network configuration. However, these changes may introduce Misconfigurations by writing inconsistent rules for Flow-tables. Misconfigurations can arise also between firewalls and Flow-tables in OpenFlow-based networks. Problems arising from these Misconfigurations are common and have dramatic consequences for networks operations. Therefore, there is a need of automatic methods to detect and fix these Misconfigurations. Given these issues, some methods have been proposed. Though these methods are useful for managing Flow-tables rules, they still have limitations in term of low granularity level and the lack of precise details of analyzed flow entries. To address these challenges, we present in this paper a formal approach that allows to discover Flow-tables Misconfigurations using inference systems. The contributions of our work are the following: automatically identifying Flow-tables anomalies, using the Firewall to bring out real Misconfigurations and proposing automatic method to deal with set-field action of flow entries.

  • FARE: FDD-based firewall anomalies resolution tool
    Journal of Computational Science, 2017
    Co-Authors: Amina Saâdaoui, Nihel Ben Youssef Ben Souayeh, Adel Bouhoula
    Abstract:

    Abstract Problems arising from firewall Misconfigurations are common and have dramatic consequences for networks operations. Therefore, the discovery and removal of these Misconfigurations is a serious and complex problem to solve. In this paper, we address this problem using a data structure (FDD: firewall decision diagram). We propose a new approach to rule-set optimization and clean-up, by removing superfluous rules from a simple firewall and a totally automatic method to detect and fix Misconfigurations. We present also a new classification of anomalies in multi-firewall environment bringing out real configurations errors. We proved the correctness and completeness of our method and demonstrated its scalability and applicability on configurations provided by the Tunisian Ministry of Finance Computer Centre (CIMF), and found promising results.

Shulin Zhou - One of the best experts on this subject based on the ideXlab platform.

  • do you really know how to configure your software configuration constraints in source code may help
    IEEE Transactions on Reliability, 2018
    Co-Authors: Xiangke Liao, Shulin Zhou, Zhouyang Jia, Xiaodong Liu
    Abstract:

    Misconfigurations have become one of the major causes of software failures because of their increasing prevalence and severity. The complexity of configurations and users’ lack of domain knowledge are the main reasons for massive Misconfigurations. Users usually identify and diagnose Misconfigurations by making a comparison against the conditions that configuration options should satisfy, which we refer to as configuration constraints ; however, sometimes it is hard for users to accomplish this work. Some work has been done on obtaining configuration constraints, especially from source code; nevertheless, only part of the situation has been considered, such as if-statement code snippets, limiting its help in misconfiguration diagnosis. In order to better extract configuration constraints for users’ guidance and misconfiguration diagnosis, we carried out a comprehensive manual study on the existence and variance of the configuration constraints in the source code of five different pieces of widely used open-source software. Three categories of findings are summarized based on our study, namely the general statistics, the general features of specific kinds of constraints, and the obstacles to the automatic extraction of configuration constraints. With these findings, we proposed several suggestions to maximize the automatic extraction of configuration constraints. The results show that our suggestions could improve the extraction of configuration constraints compared to existing methods.

  • ConfVD: System Reactions Analysis and Evaluation Through Misconfiguration Injection
    IEEE Transactions on Reliability, 2018
    Co-Authors: Xiangke Liao, Shaoliang Peng, Shulin Zhou, Zhouyang Jia, Teng Wang
    Abstract:

    In recent years, Misconfigurations have become one of the major causes of software system failures, resulting in numerous service outages. What is worse, Misconfigurations are also costly to diagnose and troubleshoot. This remains a great challenge for sysadmins (system administrators) to detect, diagnose, or troubleshoot these Misconfigurations. Unlike software bugs, Misconfigurations are more vulnerable to sysadmins’ mistakes. Developers and researchers are attempting to improve system reactions to Misconfigurations to ease the burden of sysadmins’ diagnoses. Such efforts would greatly benefit from the techniques that can comprehensively detect bad system reactions through injected Misconfigurations. Unfortunately, few such studies have achieved the above goal in the past, primarily because they only relied on generic alterations and failed to find a way to systematically generate Misconfigurations. In this paper, we study eight mature open-source and commercial software packages and summarize a fine-grained classification of option types. Based on this classification, we use Augmented Backus–Naur Form to summarize and extract syntactic and semantic constraints of each type. In order to generate comprehensive Misconfigurations in the test systems, we propose misconfiguration generation methods for our constraints. We implement a tool named Configuration Vulnerability Detector (ConfVD) to conduct misconfiguration injection and further analyze the systems’ reaction abilities to various Misconfigurations. We carried out comprehensive analyses upon Apache Httpd, MySQL, PostgreSQL, and Yum. The results of our analysis show that our option classification covers 96% of 1582 options from the above-mentioned systems. Our constraints are more fine grained than previous works and their accuracy was found to be 91% (ascertained by manual verification). Our technique could improve generic alteration approaches without constraints, and we found that ConfVD could find nearly three times the bad reactions that were found by ConfErr. In total, we found 65 bad reactions from the systems being tested and our fine-grained constraints contributed 27.7% more bad reactions than techniques only using coarse-grained constraints.

  • EASE - ConfTest: Generating Comprehensive Misconfiguration for System Reaction Ability Evaluation
    Proceedings of the 21st International Conference on Evaluation and Assessment in Software Engineering, 2017
    Co-Authors: Xiangke Liao, Shulin Zhou, Zhouyang Jia
    Abstract:

    Misconfigurations are not only prevalent, but also costly on diagnosing and troubleshooting. Unlike software bugs, Misconfigurations are more vulnerable to users' mistakes. Improving system reaction to Misconfigurations would ease the burden of users' diagnoses. Such effort can greatly benefit from a comprehensive study of system reaction ability towards Misconfigurations based on errors injection method. Unfortunately, few such studies have achieved the above goal in the past, primarily because they fail to provide rich error types or only rely on generic alternations to generate Misconfigurations. In this paper, we studied 8 mature opensource and commercial software and summarized a fine-grained classification of option types. On the basis of this classification, we could extract syntactic and semantic constraints of each type to generate Misconfigurations. We implemented a tool named ConfTest to conduct misconfiguration injection and further analyze system reaction abilities to various of Misconfigurations. We carried out comprehensive analyses upon 4 open-source software systems. Our evaluation results show that our option classification covers over 96% of 1582 options from Httpd, Yum, PostgreSQL and MySQL.Our constraint is more fined-grained and the accuracy is more than 90% of of real constraints through manual verification. We compared the capability in finding bad system reactions between ConfTest and ConfErr, showing that the ConfTest can find nearly 3 times the bad reactions found by ConfErr.

  • easier said than done diagnosing misconfiguration via configuration constraints analysis a study of the variance of configuration constraints in source code
    Evaluation and Assessment in Software Engineering, 2017
    Co-Authors: Shulin Zhou, Xiaodong Liu, Xiangke Liao, Si Zheng, Yun Xiong
    Abstract:

    Misconfigurations have drawn tremendous attention for their increasing prevalence and severity, and the main causes are the complexity of configurations as well as the lack of domain knowledge for software. To diagnose Misconfigurations, one typical approach is to find out the conditions that configuration options should satisfy, which we refer to as configuration constraints. Current researches only handled part of the situations of configuration constraints in source code, which provide only limited help for misconfiguration diagnosis. To better extract configuration constraints, we conduct a comprehensive manual study on the existence and variance of the configuration constraints in source code from five pieces of popular open-source software. We summarized several findings from different aspects, including the general statistics about configuration constraints, the general features for specific configurations, and the obstacles in extraction of configuration constraints. Based on the findings, we propose several suggestions to maximize the automation of constraints extraction.

  • EASE - Easier Said Than Done: Diagnosing Misconfiguration via Configuration Constraints Analysis: A Study of the Variance of Configuration Constraints in Source Code
    Proceedings of the 21st International Conference on Evaluation and Assessment in Software Engineering, 2017
    Co-Authors: Shulin Zhou, Xiaodong Liu, Xiangke Liao, Si Zheng, Yun Xiong
    Abstract:

    Misconfigurations have drawn tremendous attention for their increasing prevalence and severity, and the main causes are the complexity of configurations as well as the lack of domain knowledge for software. To diagnose Misconfigurations, one typical approach is to find out the conditions that configuration options should satisfy, which we refer to as configuration constraints. Current researches only handled part of the situations of configuration constraints in source code, which provide only limited help for misconfiguration diagnosis. To better extract configuration constraints, we conduct a comprehensive manual study on the existence and variance of the configuration constraints in source code from five pieces of popular open-source software. We summarized several findings from different aspects, including the general statistics about configuration constraints, the general features for specific configurations, and the obstacles in extraction of configuration constraints. Based on the findings, we propose several suggestions to maximize the automation of constraints extraction.

Yasuhide Matsumoto - One of the best experts on this subject based on the ideXlab platform.

  • Learning from Before and After Recovery to Detect Latent Misconfiguration
    2015 IEEE 39th Annual Computer Software and Applications Conference, 2015
    Co-Authors: Hiroshi Otsuka, Yukihiro Watanabe, Yasuhide Matsumoto
    Abstract:

    Preventing system failure in cloud has become more important as a result of the prevalence of cloud use for mission-critical applications. One of the major causes of system failure in clouds is misconfiguration, as shown in recent studies. Hence, it is essential first to detect misconfiguration before it causes outage or degradation of service. Although cloud provides us flexible and auto-configurable infrastructure for expeditious implementation of systems, this also provokes frequent changes and complexity of the implementation, and leads to difficulty in verifying its configuration. In this paper, we present a method to detect latent Misconfigurations. Our method is designed on the basis of our misconfiguration categorizations which gives us the capability to choose detection tactics by misconfiguration pattern, so the administrator can diagnose with less knowledge of configuration details. By generalized preprocessing of configuration data in which configuration files are input as-is, our method does not limit its target to a specific type of component. This enables us to diagnose system-wide misconfiguration while system configuration is frequently changed. The results of our experiment show that misconfiguration of a single configuration parameter is detected with over 90% F-measure.

  • COMPSAC Workshops - Learning from Before and After Recovery to Detect Latent Misconfiguration.
    2015
    Co-Authors: Hiroshi Otsuka, Yukihiro Watanabe, Yasuhide Matsumoto
    Abstract:

    Preventing system failure in cloud has become more important as a result of the prevalence of cloud use for mission-critical applications. One of the major causes of system failure in clouds is misconfiguration, as shown in recent studies. Hence, it is essential first to detect misconfiguration before it causes outage or degradation of service. Although cloud provides us flexible and auto-configurable infrastructure for expeditious implementation of systems, this also provokes frequent changes and complexity of the implementation, and leads to difficulty in verifying its configuration. In this paper, we present a method to detect latent Misconfigurations. Our method is designed on the basis of our misconfiguration categorizations which gives us the capability to choose detection tactics by misconfiguration pattern, so the administrator can diagnose with less knowledge of configuration details. By generalized preprocessing of configuration data in which configuration files are input as-is, our method does not limit its target to a specific type of component. This enables us to diagnose system-wide misconfiguration while system configuration is frequently changed. The results of our experiment show that misconfiguration of a single configuration parameter is detected with over 90% F-measure.

  • misconfiguration detection for cloud datacenters using decision tree analysis
    Asia-Pacific Network Operations and Management Symposium, 2012
    Co-Authors: Tetsuya Uchiumi, Shinji Kikuchi, Yasuhide Matsumoto
    Abstract:

    Since many components comprising large scale cloud datacenters have a great number of configuration parameters (e.g. hostnames, languages, and time zones), it is difficult to keep consistencies in the configuration parameters. In such cases, misconfigured parameters can cause service failures. For this reason, we propose a misconfiguration detection method for large-scale cloud datacenters, which can automatically determine possible Misconfigurations by identifying the relations existing among majority of the parameters using statistical decision tree analysis. We have also developed a pattern modification method to improve the accuracy of the decision tree approach. We evaluated the misconfiguration detection performance of the proposed method by using both artificial data and actual data. The results show that we can achieve higher accuracy (78.6% in the actual data) in misconfiguration detection by using the pattern modification.

  • APNOMS - Misconfiguration detection for cloud datacenters using decision tree analysis
    2012 14th Asia-Pacific Network Operations and Management Symposium (APNOMS), 2012
    Co-Authors: Tetsuya Uchiumi, Shinji Kikuchi, Yasuhide Matsumoto
    Abstract:

    Since many components comprising large scale cloud datacenters have a great number of configuration parameters (e.g. hostnames, languages, and time zones), it is difficult to keep consistencies in the configuration parameters. In such cases, misconfigured parameters can cause service failures. For this reason, we propose a misconfiguration detection method for large-scale cloud datacenters, which can automatically determine possible Misconfigurations by identifying the relations existing among majority of the parameters using statistical decision tree analysis. We have also developed a pattern modification method to improve the accuracy of the decision tree approach. We evaluated the misconfiguration detection performance of the proposed method by using both artificial data and actual data. The results show that we can achieve higher accuracy (78.6% in the actual data) in misconfiguration detection by using the pattern modification.

Amina Saâdaoui - One of the best experts on this subject based on the ideXlab platform.

  • Automated and Optimized Formal Approach to Verify SDN Access-Control Misconfigurations
    2019
    Co-Authors: Amina Saâdaoui, Nihel Ben Youssef Ben Souayeh, Adel Bouhoula
    Abstract:

    Software-Defined Networking (SDN) brings a significant flexibility and visibility to networking, but at the same time creates new security challenges. SDN allows networks to keep pace with the speed of change by facilitating frequent modifications to the network configuration. However, these changes may introduce Misconfigurations by writing inconsistent rules for Flow-tables. Misconfigurations can arise also between firewalls and Flow-tables in OpenFlow-based networks. Problems arising from these Misconfigurations are common and have dramatic consequences for networks operations. Therefore, there is a need of automatic methods to detect and fix these Misconfigurations. Given these issues, some methods have been proposed. Though these methods are useful for managing Flow-tables rules, they still have limitations in term of low granularity level and the lack of precise details of analyzed flow entries. To address these challenges, we present in this paper a formal approach that allows to discover Flow-tables Misconfigurations using inference systems. The contributions of our work are the following: automatically identifying Flow-tables anomalies, using the Firewall to bring out real Misconfigurations and proposing automatic method to deal with set-field action of flow entries.

  • TRIDENTCOM - Automated and Optimized Formal Approach to Verify SDN Access-Control Misconfigurations
    Lecture Notes of the Institute for Computer Sciences Social Informatics and Telecommunications Engineering, 2019
    Co-Authors: Amina Saâdaoui, Nihel Ben Youssef Ben Souayeh, Adel Bouhoula
    Abstract:

    Software-Defined Networking (SDN) brings a significant flexibility and visibility to networking, but at the same time creates new security challenges. SDN allows networks to keep pace with the speed of change by facilitating frequent modifications to the network configuration. However, these changes may introduce Misconfigurations by writing inconsistent rules for Flow-tables. Misconfigurations can arise also between firewalls and Flow-tables in OpenFlow-based networks. Problems arising from these Misconfigurations are common and have dramatic consequences for networks operations. Therefore, there is a need of automatic methods to detect and fix these Misconfigurations. Given these issues, some methods have been proposed. Though these methods are useful for managing Flow-tables rules, they still have limitations in term of low granularity level and the lack of precise details of analyzed flow entries. To address these challenges, we present in this paper a formal approach that allows to discover Flow-tables Misconfigurations using inference systems. The contributions of our work are the following: automatically identifying Flow-tables anomalies, using the Firewall to bring out real Misconfigurations and proposing automatic method to deal with set-field action of flow entries.

  • Toward Formal Verification of SDN Access-Control Misconfigurations
    Artificial Intelligence and Security Challenges in Emerging Networks, 2019
    Co-Authors: Amina Saâdaoui
    Abstract:

    Software-defined networking (SDN) allows centralizing and simplifying network management control. It brings a significant flexibility and visibility to networking, but at the same time creates new security challenges. The promise of SDN is the ability to allow networks to keep pace with the speed of change. It allows frequent modifications to the network configuration. However, these changes may introduce Misconfigurations by writing inconsistent rules for single flow table or within a multiple open flow switches that need multiple FlowTables to be maintained at the same time. Misconfigurations can arise also between firewalls and FlowTables in OpenFlow-based networks. Problems arising from these Misconfigurations are common and have dramatic consequences for networks operations. To avoid such scenarios, mechanisms to prevent these anomalies and inconsistencies are of paramount importance. To address these challenges, the authors present a new method that allows the automatic identification of inter and inter Flowtables anomalies. They also use the Firewall to bring out real Misconfigurations.

  • FARE: FDD-based firewall anomalies resolution tool
    Journal of Computational Science, 2017
    Co-Authors: Amina Saâdaoui, Nihel Ben Youssef Ben Souayeh, Adel Bouhoula
    Abstract:

    Abstract Problems arising from firewall Misconfigurations are common and have dramatic consequences for networks operations. Therefore, the discovery and removal of these Misconfigurations is a serious and complex problem to solve. In this paper, we address this problem using a data structure (FDD: firewall decision diagram). We propose a new approach to rule-set optimization and clean-up, by removing superfluous rules from a simple firewall and a totally automatic method to detect and fix Misconfigurations. We present also a new classification of anomalies in multi-firewall environment bringing out real configurations errors. We proved the correctness and completeness of our method and demonstrated its scalability and applicability on configurations provided by the Tunisian Ministry of Finance Computer Centre (CIMF), and found promising results.

  • An Accurate FDD-Based Approach for Discovering Distributed Firewalls Misconfigurations
    2016 IEEE Trustcom BigDataSE ISPA, 2016
    Co-Authors: Amina Saâdaoui, Nihel Ben Youssef Ben Souayeh, Adel Bouhoula
    Abstract:

    Problems arising from firewalls are common, cost time and money and have dramatic consequences for the operations of networks, especially in multi-firewall enterprise network. In fact, any misconfiguration that can arise between rules creates ambiguity in classification and filtering of the traffic. The discovery and removal of these Misconfigurations is a serious and complex problem to solve. Several solutions have been proposed, though these methods are useful for discovering anomalies, most of them identify each overlap between two rules with different actions as a configuration error while, in some cases, network administrator add, intentionally, overlapping rules. Also, in a distributed environment, they deal only with pair-wise filtering rules in a simple firewall and they consider relations between only two firewalls even if a network path could contain more than two firewalls and anomaly could happen between different rules from different firewalls. In this paper, we present (1) a new classification of anomalies in multi-firewall environment bringing out real configurations errors, (2) we use a data structure (FDD) to represent relations between different rules in different firewalls in the network, (3) a new approach to rule-set optimization and clean-up by removing superfluous rules from a simple firewall and firewalls in a distributed environment and (4) formal specification and validation of proposed techniques, we also proved its correctness and completeness and demonstrated its scalability and applicability.