Research on computer network defense policy conflict detection

Policy is an essential part of computer network defense, which also has important guidance effect in the deployment, implementation, and configuration of the defense system. Thus, the possibility of conflicts existing in defense policies is becoming more and more crucial for ensuring the security of policies themselves. In this paper, we use a computer network defense policy specification language called CNDPSL, according to a model called CNDPM, to describe computer network defense policies, which can provide a uniform method of specifying policies of protection, detection and response. First, this article analyses conflicts existing in defense policies and shows the classification of these conflicts. Then, it gives a computer network defense policy detection model. Finally, this article shows a prototype system of computer network defense policy conflict detection, and validates the effectiveness of the prototype system with experiments.