Semantics-based compliance analysis of network security policy hierarchies

Network security policy and the auto-mated refinement of its hierarchies aims to simplify the administration of security services in complex network environments. The semantic gap be-tween the policy hierarchies reflects the validity of the policy hierarchies yielded by the automated policy refinement process. However, little attention has been paid to the evaluation of the compliance between the derived lower level policy and the higher level policy. We present an ontology based on Ontology Web Language (OWL) to describe the semantics of security policy and their implementation. We also propose a method of estimating the semantic similarity between a given higher level security policy and the lower level ones to evaluate the compliance for the policy refinement approach. The method is verified in the case study. The experimental results demonstrate that the proposed method evaluates the semantic similarity between policy and implementation accurately, and that the algorithm of concept similarity analysis reflects the subjective similarity judgment of policy and implementation more accurate than the other algorithms.