Firewall configuration: An application of multiagent metalevel argumentation

3.1.Argumentation

The formal structure, taken from [32] is as follows. As [32] points out, the formalization is based not on Dung’s classic presentation, but on the more recent labelling approach [15,16,45,48] (nicely summarised in [10]). The basic notion is that of a Dung argumentation framework, a tuple ⟨A,R⟩ where A is a set of arguments and R⊆A×A is a binary relation on A that identifies which arguments attack which other arguments.

In Dung’s approach, as in [32], arguments are taken to be completely abstract entities with no internal structure, and the attack relation R is given. However, as a number of authors have pointed out – for example [5,26,39] – it is possible to construct structured arguments from some logic, and use the relationship between arguments to determine what attacks what. For example, given some logical language L and an inference relation ⊢, we might follow [5] by defining an argument as a pair (S,p) where S is a minimal set of formulae in L such that S⊢p. p is the conclusion of such an argument and S is its support. In such a formulation, it is typical to say that one argument S⊢p attacks another S′⊢p′ if either p≡¬p′ or ¬p∈S′. That is (S,p) attacks another (S′,p′) if either the conclusions of the two arguments disagree, or the conclusion of the attacking argument disagrees with a member of the support of the attacked argument.22 A is then the set of all arguments that can be constructed from some set of data Δ, and R is the set of all attacks between these arguments.

Given a set of arguments and attacks between them, the core of Dung’s idea is that not all arguments are equal. It is possible to identify some arguments that we should consider acceptable – their conclusions are valid given what we know – and some that are not. The labelling approach gives us a simple way to determine whether an argument is acceptable or not. The approach can be described in terms of a labelling function L which maps from arguments to a set of labels {IN,OUT,UNDEC}. We then write in(L) to indicate all arguments that are labelled IN by L, out(L) to indicate all arguments that are labelled OUT, and undec(L) to indicate all arguments that are labelled UNDEC.

Defined in this way, there is no relationship between a labelling and the attack relation over a set of arguments. The two are combined through the idea of legality. For a labelling L, an argumentation framework ⟨A,R), and an argument x∈A:

With the notion of legality tying labellings to attack relations, it is possible to recover Dung’s idea that extensions, sets of arguments that are somehow coherent, can be identified within an argumentation framework. We do this through the notions of admissibility and completeness. An admissible labelling has no arguments that are illegally IN, and no arguments that are illegally OUT. A complete labelling is an admissible labelling that, in addition, has no arguments that are illegally UNDEC. Then, given a complete labelling L, we have that:

Based on extension membership, we can then define the status of arguments. If x is in at least one extension, then x is credulously justified; if x is in all extensions, then it is sceptically justified; and if x is in no extensions, then it is rejected.

Fig. 2.

The relationship between labellings.

3.2.Metalevel argumentation

In [32], a metalevel argumentation framework is defined33 as a tuple:

We next need to define AM, which is the union of AM1, AM2 and AM3 where:

As presented so far, and as described in [32], this metalevel argumentation system, just like Dung’s system [20], has an abstract notion of an argument. The members of AM have no internal structure. However, one can (and we will below) construct the members of AM from a set of statements ΔM in some language LM using an inference mechanism ⊢M. When this is done, LM, like LC, will contain constants ⌜x⌝ for every x∈A since LM will be statements about these arguments. For example, a sentence in LM might describe how one argument is preferred to another, and an argument in AM that is constructed from such statements might describe how an attack from R is not a defeat because of this preference. The attacks between these arguments then populate RM.

4.1.Scenario

We consider a simple scenario in which an organization operates a hierarchical network of routers (see Fig. 1 again). The root node, R, is the master router which ultimately implements the firewall policy for the organization. The child nodes, R1 and R2, are gateways to different departments within the organization which have different requirements. R1 and R2 are stakeholders in the implemented policy and send their preferred policies to R. R then combines these policies to create the overall policy P for the organization. If the policies put forward by R1 and R2 conflict, R must resolve the conflict in order to create this overall policy.

Currently this merging of policies would be done by hand. In the simplest case, this is done by just concatenating the firewall rules. It is not hard, though, to imagine the process being automated with the routers being under the control of software agents. AR is the agent controlling R and AR1 and AR2 are the agents controlling R1 and R2 respectively. Indeed, a process that implements a software-based packet filtering firewall would meet the description of a basic reactive agent [50], receiving a sequence of percepts in the form of data about incoming packets, and making a sequence of “accept”/“block” decisions. The policies for R1 and R2 are set by system administrators in the relevant departments, AR1 and AR2, and these advocate for their policies with AR. This agent (AR) merges the policies and the combined policy is set by the system administrator with overall responsibility for the whole organization, based on information provided by the agent controlling R.

The model of structured argumentation that we use in the following examples is that of [28], which is a defeasible subset of aspic+ [33]. In terms of the element introduced above, L contains a set of propositions pi, their negations ¬pi, and a set of defeasible rules p1,…,pn⇒pn+1. Inference in this system is achieved by the application of:

If p follows from a set of formulae S using this inference rule alone, we denote this by S⊢p, and, if S is minimal, (S,p) is an argument. Note that all we are doing here is to make it possible to use the metalevel argumentation model from [32] with structured arguments. Our intention is not to propose a new model of argumentation; we are just using an existing model of metalevel argumentation with a subset of the well-known aspic+ system.

4.2.A simple metalevel model of a firewall

Now suppose that R1 has a policy to deny all DNS traffic in order to enhance system security, while R2 has a policy to allow HTTP traffic in order to support web services. We can model R1’s policy as:

In addition to the justification of R1’s policy, this captures the fact that one approach to disallowing DNS traffic is to block all UDP traffic since DNS runs over UDP. (Such an approach would obviously block other protocols and applications that use UDP, and so this might be considered rather heavy-handed.) From this set of policy information, it is possible for AR1 to construct the argument:

We can imagine that AR engages both AR1 and AR2 in an inquiry dialogue [49] to discover their requirements (for example following the protocol in [38]), a process that results in both n and t (including all the information on which they are based) being passed to AR. In addition, AR knows that:

Fig. 3.

The metalevel argument graph for the basic firewall example. Each argument corresponds to an argument or an attack at the object level. A box is drawn around arguments that can legally be labelled IN.

An understandable question to ask at this point is what the metalevel framework brings over a formulation of the problem using a standard Dung framework, or a structured argumentation system like aspic+, which builds a Dung framework from a knowledge base. In terms of what can be represented, and what can be formally concluded, the metalevel approach brings nothing. As [32] clearly shows, the metalevel approach it suggests, the one we have used here, captures precisely what a Dung framework can capture, and draws exactly the same conclusions. We are, of course, using a structured argumentation framework to generate the arguments, but these could be generated by aspic+. Indeed, given that we are using a structured argumentation system which is a subset of aspic+, one might argue that we are using aspic+. However, to focus on what can be represented and what conclusions are drawn is to miss the point. The point of using the metalevel approach lies in what is computed along the way.

In a standard Dung framework, the output is a set of labellings, telling us which arguments are justified (IN) and which are not. Frequently, in implementations, this is presented to the user in the form of an argument graph, colour-coded to indicate which arguments are IN, OUT, and UNDEC. Such an output is clear about what the conclusions are, but not why. Even in systems such as ArgTrust [37], which present views of structured arguments, a user who wants to understand why has to reconstruct the inference process for themselves. The metalevel approach, both in the way it is presented in [32] and the way we are using it here, is one way to address the explanation of why. In the same way that a Dung argument graph makes clear the relationship between arguments, the metalevel argument graph exposes the relationship between the status of arguments and thus the reasoning process that leads to the labelling attached to each argument. We believe that this means that the metalevel approach can be of service in situations, like network security, where the users of argumentation technology are unlikely to also be experts in argumentation. In this particular case, we see that the advantage of AR using a metalevel framework, rather than a standard Dung framework (which would enable it to reach the same conclusion), is that AR can use the metalevel framework to explain the resulting policy to the administrator with overall responsibility for the organization. For example, the argument graph that results in this case is given in Fig. 3. This makes it clear that the fact there is no justified argument for w or n is the symmetry between them. Each attacks the other, and there is no reason to privilege one attack over the other.

4.3.A metalevel model using preferences

While the resolution of the conflicting policies achieved above is correct from the perspective of argumentation theory, it is not very satisfying from an application point of view – the resulting policy is unhelpful since it provides no decision on UDP traffic. A natural way to improve the situation is to express some kind of preference between web services and security (in our case) to resolve the conflict between w and n one way or the other. This is not a new idea, having been introduced at the object level in argumentation systems such as [4,40].

As discussed in [32], preferences can easily be introduced into a metalevel argumentation framework. If we follow the approach described in [32], we consider that stating a preference w≻Pn – that the argument in favor of allowing UDP to support web services is strictly preferred to the argument in favor of blocking UDP to enhance security – is equivalent to stating a metalevel argument that n does not defeat w.

The formal description of the metalevel system is that of the previous section, with the same set of arguments and attacks at the object level:

Fig. 4.

The metalevel argument graph for the firewall example with preferences. Each argument corresponds to an argument or an attack at the object level. A box is drawn around arguments that can legally be labelled IN.

Again, we believe that this metalevel structure provides a means to explain the outcome to the administrator. Comparing Fig. 4 and Fig. 3, it is clear that the preference for w over n “fixes” the cycle of arguments so that defeat(⌜n⌝,⌜w⌝) does not hold, resulting in w being justified.

4.4.A metalevel model using values

Metalevel argumentation can capture more than just the application of preferences. In this section, we briefly consider how we can use the same metalevel argumentation framework to apply ideas from value-based argumentation [12] to capture a situation in which different parties have different views about which policy to adopt.

In a Value-based Argumentation Framework (VAF), we are concerned with values promoted by each attack and their relative strengths. This is necessarily subjective and audience dependent [12,32] and provides a way for R to reason about implementing policies specific to R1 and R2. To see how this might work, consider a variation on the example discussed above, where the network is that of a research university.77 R1 belongs to a research computing facility (IT) which uses BitTorrent (BT) to provide updates to the host machines. This is deemed to be mission-critical by IT. R2 belongs to the Chancellor’s office (CO), which has deemed BitTorrent to be a legal liability and thus seeks to deny any BT traffic.

Let c denote the policy “Deny BitTorrent” and a denote the policy “Allow BitTorrent”. As in the examples in Section 4, we have a situation in which there are mutual attacks between the arguments. In a value-based framework, we can annotate the policies to introduce values associated with the arguments by different parties. For example, “Deny BitTorrent” may be associated with the “Preventing Piracy” (p) value, while “Allow BitTorrent” may be associated with the “Allowing Mission Critical Services” (m) value. R may use reasoning specific to audiences pertinent to R1 and R2. If R1 serves research-related computing facilities, the relevant audience is the advocate for the corresponding policy, IT (r1). And if R2 is controlling access to student dormitories, then the relevant audience is the advocate for the corresponding policy, CO (r2). Further, each audience indicates which values are more important: r1 prefers p to m, while r2 prefers m to p.

We can formulate this as a value-based argumentation framework in the language of metalevel argumentation as (following [32]):

4.5.Structured reasoning at the metalevel

As noted above, the idea of using preferences to resolve conflicting arguments is not new, and the same is true of values. The new aspect that the metalevel approach brings is the ability to clearly see what the preferences and values are doing, that is how they resolve the conflict. Examining the metalevel arguments and attacks in the example of Section 4.3, it is clear that the preferences are behind the resolution of the conflict by defeating defeat(n,w), and in turn preventing that argument from making w unjustified. Similarly, looking at the metalevel arguments and attacks in the example of Section 4.4, it is clear how the different preferred extensions relate to the two audiences R1 and R2. In applications such as ours, where the justification for using argumentation is to be able to explain to users the structure of the problem and how to reason about it, this ability to use the metalevel system to explain how arguments are resolved at the object level is a powerful feature.

However, the models that we have discussed so far do not fully exploit the power of the metalevel framework. The astute reader will have spotted that though we have described how structured arguments can be used at the object level to connect firewall rules to arguments – as in the argument labelled (1) for example – we have yet to explore the construction of arguments at the metalevel. Allowing reasoning at this level allows us to construct arbitrary arguments at the metalevel that can resolve conflicts at the object level.

Consider, as an example, this variation on the use of preferences, where AR has the following information in its ΔM:

From this information, it is clear that AR can construct an argument for

One kind of reasoning that one might perform at this level that is of particular interest to us is reasoning about trust. AR might wish to resolve the conflict between w and n based on what it knows about the trustworthiness of AR1 and AR2. In [36], we described an argumentation system that could be used to infer the degree of trust between agents, and how this derived information could be combined with beliefs from those agents. Such reasoning could be employed in the metalevel argumentation framework to identify attacks on defeat(⌜n⌝,⌜w⌝) or defeat(⌜w⌝,⌜n⌝). To give a very simple example:

4.6.Discussion

The examples in the previous section have demonstrated how metalevel argumentation can be used to represent firewall policies in such a way that a conflict in the rules is exposed at the metalevel. They have further shown how metalevel argumentation can capture the way that existing approaches, such as preference-based and value-based reasoning, can be used to resolve such conflicts. The key advantage that we see to using metalevel argumentation is that conflicts and their resolution are exposed at the metalevel, rather than being buried in the computation of justified arguments. The metalevel approach does not provide any reasoning that is not provided by existing approaches, but by handling arguments at the metalevel as objects that can be themselves the subject of arguments, reasoning about those arguments, and the conflicts between them, becomes explicit. In firewall configuration, the final decision about how to set the firewall up is going to be taken by a human system administrator – someone who is probably not an expert in argumentation – and our hypothesis is that any additional clarity will make their job much easier. We already have some evidence that providing arguments for and against decision options helps users to become more confident in their decisions [43], albeit in the domain of intelligence analysis rather than firewall configuration. More recent work [1], provides some support for the use of argumentation in maintaining secure services. In particular, this latter work showed that using argumentation to support the definition of firewall policies provided more complete and correct policies at the cost of some additional effort. However, we do not yet have any empirical evidence concerning the use of metalevel argumentation in handling firewall policies.

We also note that we started by discussing four kinds of anomaly in firewall rules – shadowing, correlation, redundancy and generalization. Our examples are all instances of shadowing. Before we can claim that metalevel argumentation can, in general, help with detecting and resolving firewall anomalies we must first also demonstrate that the approach can deal with the other forms of anomaly.

Finally, we point out a further extension of the approach we have been detailing in this paper. In [35], we identified a number of argumentation schemes for reasoning about trust. In particular, we identified two broad classes of scheme: schemes for deriving trust and schemes for propagating trust. The schemes for deriving trust are exemplified by the scheme for direct experience: if A has previous successful interactions with B, then that is the basis of an argument that A should trust B in future integrations. The schemes for propagating trust are exemplified by transitivity: if A trusts B and B trusts C, then that forms the basis for an argument that A should trust C. Of course, both these schemes can be flawed, and [35] captures these flaws as critical questions. These identify situations in which the argument generated by the scheme is not sound. For example, direct experience can be questioned if B is not known to be the same individual with whom A has interacted in the past. Similarly, transitivity can be questioned if the context in which A trusts B is not the same as the context in which B trusts C.

These trust schemes and the relevant critical questions could be implemented in the same metalevel argumentation framework that we have been discussing. At the object level we encode the schemes as defeasible rules that allow the relevant arguments to be constructed, for example capturing transitivity with the rule:

Now, one important difference between the example above, and that in Section 4.5, is that in the latter example, reasoning about trust was at the metalevel, and in our example here it is at the object level. There need be no conflict between the two approaches. As [51] points out, it is possible to have many levels of metalevel reasoning. We can easily construct a system in which arguments about policy happen at level 0, then level 1 contains rules, facts and arguments making inferences about trust, just as in Section 4.5. These level 1 arguments treat arguments at level 0 as object level arguments. Level 2 then contains fact rules and arguments about the applicability of arguments about trust (capturing critical questions about the schemes that generated level 1 arguments), and treating level 1 arguments as object level elements to be manipulated.