基于决策树的安全策略冲突检测

Security Policy Conflict Detection Based on Decision Tree

目前一项重要研究方向是对策略进行冲突检测的研究,在进行对策略的冲突检测之前先分析策略可能存在的冲突分类,结合策略中可能存在的冲突类型和现有方法中对策略进行冲突检测的不足之处,提出决策树模型下对安全策略进行冲突检测的方法。目前对于冲突进行检测的方法大多是通过顺序表查找进行比较,这些方法需要进行大量的顺序查找比较,从而导致效率较差,论文提出的基于决策树的算法通过划分规则中的维度,将其构建为决策树,冲突检测时仅需将规则与其所落在的叶子节点中的规则进行比较,通过树状图减少了顺序查找数目,使冲突检测效率增加。

At present,an important research direction is the research on policy conflict detection.Before the policy conflict de⁃tection,the possible conflict classification of policy is analyzed.Combined with the possible conflict types in the policy and the shortcomings of existing methods for policy conflict detection,a method of conflict detection for security policy under decision tree model is proposed.At present,most of the methods for conflict detection are compared by sequence table search.These methods need a lot of sequential search and comparison,which leads to poor efficiency.The algorithm based on decision tree proposed in this paper divides the dimensions of rules into decision trees,and constructs them into decision trees.In conflict detection,the rules are only compared with the rules in the leaf nodes in order to improve the efficiency of conflict detection,the number of sequential search is reduced through tree view.