GET/INT Olivier Paul
email: olivier.paul@int-evry.fr

Improving web servers focused DoS attacks detection

Keywords:

On the Internet, web servers are often the main interface between companies or individuals and the rest of the world. As a result they represent valuable targets for attackers. Although several types of attacks are possible against web server we focus in this paper on flooding based denial of service attacks. We explore the detection of saturation attacks against web servers as well as the precise identification of attack participants. Compared to other approaches this model provides improved detection capability for focused attacks.

INTRODUCTION

Over le last ten years, the Internet has become an everincreasing marketplace for most companies. Even if large companies occupy today well known locations in the Internet, the Internet space is also filled with a large number of smaller companies providing services or information to their customers through the Internet. As business operations are gradually ported to the Internet, mobsters have also turned part of their activities into this world. Usually these organizations take advantage of infected computers owned by unaware users in order to attack their victim. Although vulnerability based attacks can bring large benefits to attackers, systematic saturation attacks are largely employed since they are likely to succeed and do not require any prerequisite from the victim. Large companies are usually able to protect themselves from these threats preventively by over-dimensioning their systems, using replication services or when attacks occur by using network operator services (blackhole filtering, sinkhole...). These services are unfortunately often unavailable for small or medium companies for cost reasons.

Today, many "in network" detection schemes are based on packet based or flow based measures for performance reasons [START_REF] Gil | MULTOPS: a data-structure for bandwidth attack detection[END_REF], [START_REF] Huang | A Non-intrusive, Wavelet-based Approach to Detecting Network Performance Problems[END_REF], [START_REF] Peng | Protection from Distributed Denial of Service Attack Using History-based IP Filtering[END_REF], [START_REF] Wang | Detecting SYN flooding attacks[END_REF], [START_REF] Cheng | Use of Spectral Analysis in Defense Against DoS Attacks[END_REF]. This often leads to coarse grain attack detection signatures based on network level parameters such as the destination address and port. Such coarse grain signatures are not always sufficient to block attack traffic appropriately. For example during the MyDoom worm attack in 2004, web servers of Microsoft and SCO were saturated through continuous HTTP requests to specific web pages from worm instances [23]. Such requests could not be blocked since distinguishing between correct and worm generated requests would have required HTTP request URI analysis which was impossible for performance reasons.

In this paper we restrict ourselves to the analysis of HTTP traffic. In [START_REF] Paul | Tradeoffs for Web Communications Fast Analysis[END_REF] we introduce a tool allowing HTTP traffic information to be inferred from network level measures at multi gigabit speeds for small and medium sized servers. In this paper we investigate how such a tool might be used to protect such servers against some of existing saturation threats [START_REF]Phatbot Trojan Analysis[END_REF]. Compared to existing work [START_REF] Brutlag | Aberrant Behavior Detection in Time Series for Network Monitoring[END_REF], [START_REF] Kargl | Protecting Web Servers from Distributed Denial of Service Attacks[END_REF], we expect to improve the detection speed in the case of attacks using focused requests by monitoring less aggregated parameters when taking application level information into account. We also expect to improve the detection precision in the case of attacks using focused requests by generating precise attack signatures including application level descriptors allowing more legitimate users to be excluded from mitigation measures.

We position ourselves in a multiplexed mitigation environment such as the one found in [START_REF] Peng | Protection from Distributed Denial of Service Attack Using History-based IP Filtering[END_REF]. The paper is organized as follows: Section II describes the architecture our proposal is based on. Section III presents our overuse detection model. The next section presents an implementation of our proposal as well as tuning issues. It also provides tests results performed on a local web server. Finally we conclude in section V.

II. WEB TRAFFIC INFERENCE

The core of our architecture is based on RequIn [START_REF] Paul | Tradeoffs for Web Communications Fast Analysis[END_REF]. RequIn is a web traffic inference tool that uses network level measures (flow sizes, number of packets, source and destination addresses and ports...) to infer application level information. The amount of information inferred from network level measures depends on the type of request performed (GET, HEAD, POST...) and the corresponding result code (200, 404, 304...). These two parameters are themselves inferred from network level measures. TABLE I. provides the relation between inferred result code, method, URI and object size.

A. Detection Model

Statistical Process Control techniques (SPC) have been used for decades for controlling the quality of manufacturing or industrial processes. Recently research on the application of SPC techniques for denial of service detection has been a very active field. For example Cumulative Sum (CUSUM) based techniques have been successfully used with quasi-stationary processes such as TCP SYN/FIN segments numbers ratio [START_REF] Wang | Detecting SYN flooding attacks[END_REF] or the number of IP addresses in use in a network [START_REF] Peng | Protection from Distributed Denial of Service Attack Using History-based IP Filtering[END_REF] as well as non stationary processes (number of TCP SYN packets [START_REF] Vasilios | Application of Anomaly Detection Algorithms for Detecting SYN Flooding Attacks[END_REF]). Other SPC related techniques such as Holt-Winters forecasting [START_REF] Brutlag | Aberrant Behavior Detection in Time Series for Network Monitoring[END_REF] have also proven useful.

In this paper we investigate another commonly used SPC class of techniques based on the Exponentially Weighted Moving Average (EWMA). EWMA based techniques have been successfully used for computer intrusion detection by Ye and al. [START_REF] Ye | Computer Intrusion Detection Through EWMA for Autocorrelated and Uncorrelated Data[END_REF]. In this paper we however investigate how EWMA could be used in a denial of service attacks detection context.

EWMA charts are usually used to monitor changes in the mean of a process. If the data to be monitored results is a sequence of independently distributed observations X t the value of the EWMA statistic can be computed as follows:

1 , , ) 1 ( - ⋅ - + = t X t t X W X W λ λ
Where λ is a constant belonging to the ]0;1] interval. In that case upper (UCL) and lower (LCL) control limits can be computed. However in practice, observations are not always independent and uncorrelated. Several techniques exist in order to cope with correlated data including changing the control limits computation scheme or removing the correlation for the measured signal by modeling the correlative structure with an appropriate time series model [START_REF] Edo | Statistical Process Control for Serially Correlated Data[END_REF]. Such a task can however be a time consuming. When the signal follows particular models, approximate techniques have been developed in order avoid this task. For example Montgomery and al. [START_REF] Montgomery | Some statistical process control methods for autocorrelated data[END_REF] have suggested using the EWMA statistic W X,t as a one step ahead predictor for X t allowing the e t residuals to be computed as follows.

, - - = t X t t W X e
In the case of signals following an IMA(1) (First order Integrated Moving Average) model, the residual function is expected to be independently and identically distributed with mean zero [START_REF] Montgomery | Some statistical process control methods for autocorrelated data[END_REF]. A moving centerline EWMA control chart can then be constructed combining the state of statistical control and process dynamics. In such a chart, control limits can be constructed as follows:

e t X t c W UCL σ ⋅ + = ' , e t X t c W LCL σ ⋅ - = ' ,
Where σ e is the variance of the e t process and c' a positive constant tuning value. σ e can be estimated using a smoothed variance. Such smoothed variance can be obtained by applying an EWMA to the e t residual values. Where α is a constant belonging to the ]0;1] interval. [START_REF] Montgomery | Some statistical process control methods for autocorrelated data[END_REF] notes that even a process that is not pure IMA(1) should be manageable using this technique if the process mean does not drift too quickly.

In order to keep detection time as short as possible, we use short monitoring intervals. However because of the bursty nature of web traffic, using direct values of the monitored process would lead to a large number of false detection events. In order to avoid this, we use a smoothed version of the monitored process where x t is the true monitored process and β a smoothing constant belonging to the ]0;1] interval.

t t t X x X ⋅ - + = ) 1 ( . β β

B. Monitored parameters

Our goal is to discover attacks whether they target a specific type of request or use more general patterns by frequently changing the method, the object or the operation result. In order to do so we monitor fine grain parameters such as the number of requests performed on every object present on the server as well as more aggregated parameters allowing more diffuse attacks to be detected. Figure 1. describes the different levels of aggregation used in our detection scheme. As shown in Figure 1. , URI variables are aggregated according to the method and result for selected values.

As requests are often described using 2 or 3 parameters, several variables in Figure 1. can change simultaneously. These variables are moreover often correlated. This correlation can result in either false out of control detection events or lack of detection [START_REF] Montgomery | Introduction to Statistical Quality Control[END_REF]. Using multivariate control techniques might be an option to solve this problem. However the number of monitored variables as well as the need to identify precisely variables responsible for out of control events led us to choose an ad hoc procedure. Detection operations on correlated parameters are organized from the most specific parameters to the least specifics. We do so by checking, at each level from bottom to top, whether an out of control event at a given level can be explained by out of control events at a lower level in the tree. To do so we maintain aggregated attack rates associated with square nodes in Figure 1. These rates represent the sum of the rate of ongoing attacks on children nodes and are subtracted from monitored values of upper nodes for detection operations. Using this strategy, we should only detect attacks on aggregated descriptors once every more precise "explanation" has been considered. Among events observed in Figure 1. , some happen very rarely. For instance, on our test server some URIs were only requested once over the log file in our possession. Because formulas presented in section III.A would not provide us with any valuable bounds for such rare events, we monitor such events by assigning them with a fixed maximum frequency.

C. Volume based filtering

When a set of requests generates an out of control detection event an attack event is created and associated with the corresponding node. This parameter called signature is used to aggregate future attack events with the same characteristics. We associate to each attack event the IP addresses of the source of the requests sharing the same signature. This aggregation is currently controlled by two parameters, the maximum number of aggregated attack events and the maximum aggregation time.

Because attackers might perform random requests on the server, the attack signature might be sufficiently wide to encompass almost any type of requests. In such a case, any user performing a request is likely to share the same signature and be included in the list of attack sources. In order to limit this problem it would be desirable to sort attack sources according their contribution to the attack in term of number of requests. In order to avoid storing any possible source, we use an address cache with a predefined size where sources are maintained using a least recently used strategy.

IV. IMPLEMENTATION AND TESTS

A. Implementation

For testing purposes we developed an HTTP aware monitor based on an extension to FreeBSD IPFilter packet filter. This monitor is able to export IPFIX compliant (netflow like) records to an IPFIX collector using the Vermont [START_REF]VERsatile MONitoring Toolkit[END_REF] monitoring package. IPFIX allows data to be transported in an inexpensive manner by allowing records aggregation as well as using template/data separation.

As represented in Figure 2. , the detection algorithm presented in section III was implemented as a part of a detection module [START_REF] Münz | Initial Violation Detection Prototype[END_REF]. The whole configuration of the detection module is performed through an external configuration file. Initial control limits are computed at startup using a simplified training log file provided to the detection module. Within the detection module, the detection engine receives inferred requests from the inference engine. This inference is performed using IPFIX records after extracting and in some case translating (i.e. estimation function in Figure 2. ) IPFIX record information element values. Estimation functions are meant to adapt the received information to the inference model. When an attack is detected, an IDMEF [START_REF] Debar | The Intrusion Detection Message Exchange Format[END_REF] compliant notification is generated through a notification module.

B. Tests

The inferred information from the inference engine is passed to the detection engine for detection operations. This detection engine implements the moving centerline EWMA described earlier over 10 seconds intervals. We performed several series of tests using a local web server. This server contains roughly 20k objects and receives 7.5k requests everyday. During the tests a group of attackers sends attack requests to the server while a group of normal users sends normal requests. Normal requests are expected to mimic legitimate traffic and are generated using the server logs. For each test, attack and normal traffic with different characteristics were generated by changing :

• The focus of the attack (ie, requests with a fixed set of object/operation values or requests with randomly chosen object/operation values). • The number of attack requests that were generated per second. (i.e. 1/2, 1, 2). • The duration of the attack in number of requests (i.e. 60, 600).

In this test, addresses are not taken into account in the detection step. As a result legitimate and attack requests are performed from a single device. The monitoring element currently also running the detection module acts as a router between the traffic generator and the server. For every attack we measured the number of correctly detected attack events (number of requests detected as belonging to the attack during an attack session) as well as the percentage of attack requests correctly detected (true positive ratio, TP). We also measured the number of incorrectly detected attack events (number of requests detected as belonging to an attack outside an attack session) as well as the percentage of attack requests wrongly detected (false positive ratio, FP).

In order to compute the benefits and costs associated with using application level information we performed two kinds of tests. In a first step we use the change point detection strategy described in section III.A but only taking the total number of requests into account. In a second step we test our proposal using application level information as previously described. We then compute for each scenario the difference between the FP and TP rates during both tests. This difference represents the benefit (for the TP rate) and cost (for the FP rate) associated with our technique. They are represented in Figure 3. for parameters (β=0. [START_REF] Hernández-Campos | Tracking the Evolution of Web Traffic: 1995-2003[END_REF] Overall, our technique provides faster detection in all cases at the cost of an increase in the number of falsely detected attack events (between 0.1% and 0.8% on average). When aggregated according to the aggregation scheme described in section III.C these false detection events occur on average once every 4.5 hours. The benefits are, as expected, much higher in the case of focused requests in particular for slow or short attacks.

Increasing the value of the β smoothing parameter increases the sensitivity of the detection that translates in a higher number of detected attack events but also increases the number of false positives. In practice β values in the [0.1;0.2] range brought good results. Other λ and α values where tested without bringing better results.

V. DISCUSSION AND CONCLUSION

In this paper we explore the benefits that might be obtained by combining application level information with a well-known change detection algorithm. Our conclusion is that such an approach is mainly beneficial when focused requests are used by attack tools. In such a case, not only do we learn about the attack faster but we can also provide precise information about the attack. This information could be useful when addresses are not sufficient to identify attackers (proxies, NAT...) or as a part of a preventive strategy. Although a strategy of attack using one or a few focused requests is widespread today as witnessed by existing bots available functions [START_REF]Phatbot Trojan Analysis[END_REF] or by some attacks analysis [START_REF] Jung | Flash Crowds and Denial of Service Attacks: Characterization and Implications for CDNs and Web Sites[END_REF], it would be easy for potential attackers to modify existing tools to generate random requests from a predefined list. In such a case our proposal provides detection results similar to those obtained when not taking application level information into account.

A potential problem with our approach in the case of a nonfocused attack is the fact that legitimate users can, in a case of a largely distributed attack, generate more traffic than most attackers. In order to solve this problem with suggest to combine the approach presented here with an approach as the one we developed in [START_REF] Paul | Scalable fine grain monitoring against web servers overuses[END_REF] where detection operations are no longer based on traffic requests volumes variations.

1

 1

Figure 1 .

 1 Figure 1. Monitored variables.

Figure 2 .

 2 Figure 2. Detection Module Architecture.

Figure 3 .

 3 Figure 3. Benefit and costs when using application level information.

  , λ=0.1, α=0.0001, c'=3).

			Attack Requests/s
		0.5	1	2	4
		100
		10
	% gained (TP)/lost (FP)	0.1 1
		0.01
		TP, Fixed, 60	FP, Fixed, 60	TP, Fixed, 600	FP, Fixed, 600
		TP, Random, 60	FP, Random, 60	TP, Random, 600	FP, Random, 600

/HEAD No No 404 PUT/POST No Yes This work is funded through the IST DIADEM Firewall project. TRACE No No GET/HEAD/ TRACE No No 304 PUT/POST No Yes Other Any No No III. OVERUSE DETECTION


Olivier Paul
email: olivier.paul@enst-bretagne.fr

Improving Network Access Control Integrity Through Redundant Mechanisms

Introduction

With the deployment of the internet, security in general and access control in particular are becoming a major problem in the design of communication networks. As a consequence, much attention has been paid to develop mechanisms to provide the access control service for every kind of networks. These developments have been mainly conducted by security working groups within companies and academic organizations and gave birth to the today's most common network access control tool, called firewall. Today, a new kind of firewall is appearing ( [START_REF] Multilayer Firewall | NDSS'98 Conference[END_REF], [START_REF] Distributed Firewalls | [END_REF], [START_REF] Paul | An Asynchronous and Distributed Access Control Architecture for ATM networks[END_REF]). This technology relies on a distribution of the access control process on several access control devices. This distribution has several advantages (performance, security and quality of service preservation). However some of these devices may be end systems and can be logically or physically modified by users. As a result, the integrity of the access control process is an important issue. How can the security officer be sure that the access control process is implemented correctly ? In this paper we show how the integrity of the access control process can be insured by adding some redundancy on the configuration of access control devices. This paper is organized in four parts. We first describe in section 2 some of the distributed access control proposals. We then describe a scheme that gives the security officer some insurance about the access control process integrity. We provide in section 4 computational and simulation results showing that the overhead generated by our scheme can be very low with networks including a large number of access control devices which is usually the case in distributed access control architecture. Finally section 5 compares the benefits and drawbacks of such optimization and talks about future works.

Distributed Access Control

The main difference between distributed access control mechanisms and traditional access control mechanisms used by firewalls is the place where the access control process takes place. By opposition to traditional access control devices who provide the access control service in the border between a public unsafe network and a private secured network, distributed access control schemes propose to provide the access control service through a set of access control tools distributed across the network. For example [START_REF] Multilayer Firewall | NDSS'98 Conference[END_REF] suggests to place the access control in the network internal devices by using the access control capabilities of these devices at the LLC, network and transport levels. [START_REF] Distributed Firewalls | [END_REF] suggests to locate the access control process in end devices by taking advantage of operating systems protocol stacks access control capabilities. This proposal also show how to provide some access control at the application level through relevant software configuration. [START_REF] Paul | An Asynchronous and Distributed Access Control Architecture for ATM networks[END_REF] proposes to provide the access control on internal devices and on end devices through software agents. These agents are requested to watch and control ongoing communications in a non blocking way.

In order to provide each access controller with a relevant access control policy, the access control Abstract Distributed access control schemes usually use automatic access control configuration schemes. These methods rely on three criteria to improve the positioning of access control rules. In this paper we show that the alteration of one of these criteria can bring some redundancy in the access control configuration. This redundancy can be used to improve the trust a security officer can have in the access control process integrity. We demonstrate that the overhead generated by this redundancy is generally negligible when the underlying network is sufficiently big.

Key-Words

Access Control, Integrity, Management, Security.

policy is generally globally defined by the security officer and then distributed to access control devices. However a brute distribution of the access control policy can result in a very inefficient access control process. As a result, access control distribution methods have been defined to configure each access control device with the smallest subset of access control rules allowing the access control policy to be enforced. These access control distribution methods ( [START_REF] Falk | Integrated Management of Network and Host Based Security Mechanisms[END_REF], [START_REF] Firmato | A Novell Firewall Management Toolkit[END_REF], [START_REF] Guttman | Filtering Postures: Local Enforcement for Global Policies[END_REF], [START_REF]Policy-Based Management: Bridging the Gap[END_REF], [START_REF] Hyland | Management of Network Security Application[END_REF], [START_REF] Paul | An Asynchronous and Distributed Access Control Architecture for ATM networks[END_REF]) are usually based on three parameters:

-The network topology.

-The rules content.

-The devices access control capabilities.

We show in the next section how these distribution methods can be lightly modified to give the security officer some insurance about the integrity of the access control process. The current optimizations take advantage of the routing protocols to restrict the set of devices that have to be configured with an access control rule. Since the routing information defines the path between the source and the destination of the communication expressed by a rule, the distribution of the access control rule describing a communication can be restricted to the nodes located on this path. The routing information is usually static and provided by the security officer at configuration time.

Proposed Solution

The second optimization (later called rule type optimization) applies when the type of the access control policy is "What is not explicitly permitted is prohibited". In this case, a "Deny rule" always describes a subset of a "Permit rule". As a consequence, a single "Deny rule" can be used to block a communication. This means that a single device on the path between the source and the destination described by a rule has to be configured with the "Deny rule". On the other hand each "Permit rule" has to be assigned to each device on the paths between its source and destination.

Our integrity scheme is based on this last optimization. We claim that allowing some redundancy on "Deny rules" can provide some insurance about the integrity of the access control process. This insurance is particularly strong when a physically secured access control device enforces one of these rules. This property can be explained by several reasons. Taking control of an end system can be quite easy when this system is not protected through tamper proof hardware. However taking control of a system that is not physically accessible is a much more difficult task. If we consider that users only have a physical access to their own personal computer we can claim that the access control processing that is not performed by their own computer can be classified as safer. Some access control management architectures assign "Deny rules" to end devices. As a consequence these rules can easily be bypassed by the computer owner. However other access control rules are much more difficult to bypass because these rules are generally attributed to other access control devices across the network. As a consequence configuring other access control devices with "Deny rules" is sufficient to block communications that could be generated by a user bypassing the access control process located on his computer. Our approach is different from the classical centralized firewall approach since:

-The access control process remains distributed. As a consequence the performance speedup provided by the distribution is not avoided. Access control devices only enforce a part of the access control policy. -As demonstrated in section 4, the overhead generated by the duplication of "Deny rules" is generally small. -The "Deny rule" based optimization can be partially used by limiting the duplication of "Deny rules". -The security officer has the ability to make a tradeoff between performance and integrity by choosing the level of access control redundancy for "Deny rules".

The overhead generated by our scheme is based on two parameters:

-The proportion of "Deny rule" in the access control policy.

-The size of the network since the size of the network will change the average length of the paths of the communications described by the access control rules.

From an implementation point of view, the changes introduced by our approach remain small since a single test on the number of devices configured with a rule has to be included in the existing optimization algorithms.

We show in the next section the impact of our proposal on the current distribution process performance.

Simulation Results

In order to evaluate the impact of the access control integrity on the current access control distribution performance, we simulate two distribution processes. The first one is based on a single optimization parameter (topology) whereas the second one is based on both optimization criteria (topology and type of the rule). We then compare both optimizations in order evaluate the overhead generated by the redundancy. The overhead computed in this section is a worse case overhead that could be reduced by using a partial implementation of the type of rule optimization.

Our simulations are based on an implementation of algorithms implementing both criteria with the ns simulator [START_REF] Fall | [END_REF]. The ns simulator is a discrete events simulator targeted at network research. The resulting implementation is made of about one thousand lines in O-tcl and one hundred lines in C++. A complete package including the implementation and several test suites is available at [9].

Access control policy modeling

In order to have interesting simulation results we used the structure of our simulation software to represent real access control rules. Since access control policies can greatly vary from one site to another, defining a typical access control policy is not an easy task. Moreover the language used to define the policy can bring a lot of changes in the way to express the access control policy. As a result we took examples from [START_REF]Firewalls and internet security, repelling the wily hacker[END_REF] and [1] which present typical access control policies for various internet services and we then added some changes in order to reflect what can be found in a real configuration.

In order to model these rules we classify access control rules according to two parameters:

-The action specified by the rule. This action can permit or deny the communication. As a result we have two classes of rules called ALLOW and DENY.

-The addressing information described by the rule.

-Rules providing addressing information (i.e. a source and a destination descriptors) are called specified rules. -Rules not providing addressing information are called unspecified rules.

Rule

Theoretical results

The network used in our simulation is well known and based on a tree of order 3 topology. Therefore, evaluating theoretically the impact of the type of rule criterion is possible if we suppose that each node is able to implement access control functions. We can then check if our simulations match our calculus in order to verify their accuracy. As stated in the previous section, the overhead generated by the use of the criterion depends on the size of the network and on the access control policy composition. The average number of rules produced by the distribution of an access control policy by using the both optimizations can be expressed by the following function: Nr0 = u ⋅ n + avgl(n) ⋅ sa + sd Where u is the number of unspecified rules, sa the number of specified allow rules, sd the number of specified deny rules, and avgl(n) is the average length between two leaves in a tree of order 3 with n nodes. When a single optimization is used the average number of rules can be expressed by: Nr1 = u ⋅ n + avgl(n) ⋅ (sa + sd) As a consequence the gain involved by the type of rule criterion can be expressed by: G = Nr1 -Nr0 = sd ⋅ (avgl(n) -1)

Simulation results

In order to evaluate the impact of our scheme on the distribution we make the network size vary from 4 to 121 (4, 13, 40 and 121) nodes and simulate the distribution for each policy. We assume that each node is able to implement access control functions. For each simulation we compare the results based on our two criteria (topology and type of rule) with the results obtained with a single criterion (topology). When compared with the efficiency brought by the "topology optimization" (depicted with a gray line), our integrity scheme provides good results for big networks. As depicted in figure 3, the overhead becomes smaller as the size of the network. increases (less than 3% with a 121 nodes network for both policies). However the overhead can be quite large for very small networks (around 18% with a 4 nodes network). Hopefully such a kind of networks is not very usual in real networks.

Conclusion

In this article, we introduce a scheme to improve the integrity of the access control process in a distributed access control environment. We show that this scheme can provide the security officer some insurance about the integrity of the access control process while limiting the overhead of such service. We show that our scheme is particularly interesting for big networks where the overhead can be as low as 2%. As a consequence, our criterion is especially interesting when used with a policy including a small ratio of deny rules in a large sized network. This work could be usefully continued by integrating our scheme in a real access control management tool. This would allow us to test its efficiency in real world configurations.

Figure 1

 1 Figure 1 provides an example of an access control policy allowing the workstation with address 192.165.203.5 to communicate with the WWW server located on station 121.6.7.3. The policy is expressed by a set of rules, each rule describing a part of the communication. ipfwadm -F -a accept -b -P tcp -S 192.165.203.5 1024:65535 -D 121.6.7.3 80 ipfwadm -F -a deny -b -P tcp -S 121.6.7.3 80 -k -D 192.165.203.5 1024:65535 ipfwadm -F -a accept -b -P tcp -S 121.6.7.3 80 -D 192.165.203.5 1024:65535 Figure 1. Access Control Policy

Figure 2 .Figure 2

 22 Figure 2. Criterion efficiency (in rules)Figure2provides the gain in rules when two criteria are used. The results for policy1 are displayed by the plain line whereas the results for policy2 are displayed by the dotted line. The figure shows that the gain increases with the size of the network. However the parameters which impacts our results the most is the composition of the access control policy. Figure2also shows a comparison between the gain experimented in our simulations and the theoretical gain expressed in the previous section. This theoretical gain is represented by a dashed line. The comparison shows that simulation and theoretical results are very close. When compared with the efficiency brought by the "topology optimization" (depicted with a gray line), our integrity scheme provides good results for big networks. As depicted in figure3, the overhead becomes smaller as the size of the network. increases (less than 3% with a 121 nodes network for both policies). However the overhead can be quite large for very small networks (around 18% with a 4 nodes network). Hopefully such a kind of networks is not very usual in real networks.

Figure 3 .

 3 Figure 3. Criteria Global Efficiency (in %)

Table 1 . policy1 description

 1 To reflect real configurations, we consider two opposite kinds of policies. A first one called policy1, described in table 1 includes a small number of DENY rules. A second one called policy2 described in table 2 includes a large number of DENY rules.

	types	ALLOW	DENY
	Unspecified	5	5
	Specified	60	10
	Rule types	ALLOW	DENY
	Unspecified	5	5
	Specified	40	30

Table 2 . policy2 description

 2

This work is funded by DRET. sad