Policy-based Security Surveillance Framework on a Large Scale Network

Security management and maintenance are difficult in a large scale network because there are many different kinds of security tools which each has its own information model and policy. We introduce a framework for policy-based security surveillance in a large network which has various security tools. The framework is based on the manager-agent concept. The central manager stores security policies and monitors network topology and states in real time. An agent installed in a managed node reports the security related state to the manager and executes management commands received from the manager. When the manager finds a change in the network topology or state, it checks if the state of network after the change conforms to security policies. If any deviation is found, the manager plans/executes management commands to return the network into the state conforming to the policies.