One of the primary challenges to apply the XACML access control policy language in
applications is the performance problem of policy evaluation engines, particularly when they …

Network designers perform challenging tasks with so many configuration options that it is
often hard or even impossible for a human to predict all potentially dangerous situations. In …

Network intrusion detection systems (NIDS) make extensive use of regular expressions as
attack signatures. Internally, NIDS represent and operate these signatures using finite …

We present PfComp, a verified compiler for stateless firewall policies. The policy is first
compiled into an intermediate representation taking the form of a binary decision diagram …

XACML policy evaluation efficiency is an important factor influencing the overall system
performance, especially when the number of policies grows. Some existing approaches on …

Modern network intrusion detection systems (NIDS) employ regular expressions as attack
signatures. Internally, NIDS represent and operate these regular expressions as finite …

With the emergence and fast development of cloud computing and outsourced services,
more and more companies start to use managed security service providers (MSSP) as their …

Computer based systems and methods for searching data transiting a network using a graph-
based search model. A set of rules that describe strings or patterns of data to be identified in …

As firewalls have increased in power and flexibility, the complexity of configuring them
correctly has grown significantly. An error in the firewall configuration can compromise the …

This dissertation describes a technique for formally analyzing a firewall security policy using
a quasi-reduced multiway decision diagram model. The analysis allows a system …