Fault Detection in Rule-Based Software Systems

Transcription

1 Fault Detecton n Rule-Based Software Systems Dong Wang, Rubng Hao and Davd Lee Bell Labs Research Chna Bejng, Chna, {wangd, rbhao, leedavd}@lucent.com Abstract Motvated by packet flterng of frewall systems n Internet applcatons, we study the fault detecton problem n the general rule-based software systems. We dscuss algorthms for the detecton of conflcts n a gven set of rules. We frst study a constraned verson of the fault detecton problem and propose a two-phase algorthm. The frst phase s to do the rule normalzaton. The second phase s to detect conflctng rules. For ths constraned verson of the fault detecton problem, the algorthm takes polynomal tme. For the general problem, t s NP-hard. We apply the algorthms to the rule table gettng from one of the frewalls n Bell Labs and report the experment result. Keywords Rule-Based Software system, fault detecton, Packet Flter 1 Introducton Wth the complexty and dynamc nature of communcaton systems, fault detecton s the center of focus n communcaton network management and yet has proved to be a formdable task. Fault detecton problem has been nvestgated heavly by many researchers from varous aspects n the past. Exstng fault detecton approaches can be classfed nto the followng categores accordng to the technques they use: expert systems, fnte state machnes, advanced database technques, and probablstc approaches [1]. The followng papers offer a glmpse of the arena [2][3][4]. Fault detecton s also a more complex problem when compared wth the general conformance testng, n that the latter just needs to check f an mplementaton s dfferent from ts specfcaton, whle the former needs to locate the dfference found [5]. In ths paper, we nvestgate the fault detecton problem from a dfferent perspectve, or say the fault detecton problem n a rule-based communcaton software system, whch has not been formally nvestgated before. In modern communcaton software systems, Rule-Based Software systems (RBS) are commonly used where program actons are determned by a group of pre-defned rules. Its desred functonng largely depends on the correctness and coherence of all the rules. However, because the rules n an RBS are confgured manually, conflcts among these rules may lead to unexpected program actons from the RBS. For example, a typcal scenaro of conflct s that for some specfc nputs of the RBS, multple rules are elgble and can be appled. Whle the rule selected by the RBS s not what the desgner or admnstrator has expected. So t s necessary to detect and remove conflcts among rules of an RBS to prevent the above scenaro from happenng. We call ths problem the fault detecton problem n RBS. When the rule set s small, for example four to fve rules, t s easy to detect all the conflct manually. But t s extremely hard to fnd out the conflcts manually when the number of rules n the RBS grows very large. So we need to nvestgate how to do fault detecton for an RBS

2 automatcally. Ths paper presents a method to solve ths problem for the packet flterng software n the frewall system, whch s a typcal type of RBS. We frst nvestgate a constraned verson of ths fault detecton problem and then relax the constrants to fnd more general solutons. We propose a two-phase algorthm to solve ths constraned verson of fault detecton problem. The frst phase s to do the rule normalzaton. The second phase s to detect conflctng rules. For ths constraned verson of the fault detecton problem, the algorthm takes polynomal tme. We also dscuss solutons for the more general fault detecton problem, n whch the above two assumptons do not hold. For RBS that has multple actons n the acton part of each rule, there s a polynomal algorthm to check f the actons of two rules conflct. If the assumpton about the condtonal part does not hold, we need to solve a more general problem: to decde whether or not the ntersecton of two condtonal expressons s satsfable. We beleve t s an NP-complete problem by reducng the well-known SAT problem to ths problem. Ths paper s an extended verson of [10], t s organzed as follows: The fault detecton problem of RBS s defned n Secton 2 by usng the packet flters n frewall systems as an example. In secton 3, we present our soluton to a constraned verson of the fault detecton problem. In secton 4 we extend our soluton to deal wth composte-actons. In secton 5 we present that n general the fault detecton problem s an NP-complete problem. In secton 6, we do a case study on the data collected from a real frewall system n Bell Labs and report the experment result. Secton 7 concludes ths paper wth future works. 2 Fault Detecton Problem for Packet Flters a Case Study Network securty s one of the most mportant concerns of enterprse networks connected to the Internet. To prevent malcous denal-of-servce attack and unauthorzed access to or from a prvate network, frewall systems have been wdely deployed n enterprse networks to enhance network securty by separatng the prvate Intranet from the publc Internet. All messages enterng or leavng the ntranet pass through the frewall, whch examnes each message and blocks those that do not meet the specfed securty crtera. There are several types of frewall technques: packet flter, applcaton gateway, crcut-level gateway, and proxy server [6]. Packet flter s one of the most effectve frewall technques. A packet flter looks at each packet enterng or leavng the network and accepts or rejects t based on user-defned rules. Packet flterng s farly effectve and transparent to users, but t s dffcult to confgure. 2.1 Rules n a Packet Flter Packet flter s a typcal type of RBS. Tradtonally a packet flter examnes packets at IP layer, or TCP/UDP layer, or both. Usually t checks the values of the fve felds n the TCP/IP header, ncludng destnaton address, source address, destnaton port, source port and transport layer protocol type, aganst a set of flterng rules. A rule n the packet flter usually conssts of two parts: the condton part and the acton parts. It descrbes the actons the packet flter wll take when the packet satsfes or fals the logcal expresson n the condton part. For example, If ( packet s destnaton port equals 21 ) then ( dscard t ) else (forward t) (1)

3 Rule (1) specfes a pass-acton dscard t and a fal-acton forward t for condtonal expresson destnaton port equals 21. When the Boolean value of the condtonal expresson s true, the packet flter wll take the pass-acton; otherwse the fal-acton. The fal-acton part s optonal. A packet flter usually has more than one rules, all the rules n a packet flter form a so-called Rule Table (RT). Rules n a rule table can be chaned together by a specal acton goto. Table 1 shows an example rule table. For each receved packet, the packet flter works as follows. It wll test the packet aganst the rules accordng to the order that rules are lsted n the rule table. The frst rule n the rule table wll be checked frst. If the packet satsfes the condtonal expresson of the rule, the pass-acton of ths rule wll be taken; otherwse the fal-acton wll be taken. If the packet fals the current condtonal expresson and the fal-acton part s not presented n the rule, the next rule n the rule table wll be checked. If the acton taken by the packet flter s a goto acton, then the next rule ponted by goto wll be checked. If the checkng falls off the table then the packet s dscarded. No. Content of rule R1 If (packet s destnaton port equals 21) then (dscard t) R2 If (packet s destnaton port small than 255) then (goto3) else (dscard t) R3 If (packet s source s subnet /16) then (forward t) 2.2 Fault Detecton Problem Table 1. Example Rule Table The desred functonng of a packet flter largely depends on the correctness and coherence of all the rules. But because the rules n a packet flter are confgured manually, conflcts among these rules may lead to unexpected actons from the packet flter. For example, n Table 1 the goal of R1 s to dscard all the packets wth destnaton port 21. R2 s not a complete rule for ts pass-acton s goto 3. Ths means that R2 must be used n combnaton wth R3. R3 s to forward all the packets from subnet /16, so the combned result of R2 and R3 s to forward all the packets comng from subnet /16 and wth destnaton port small than 255. There s a hdden conflct n ths rule table. Assume a packet arrves wth destnaton port 21, whch s obvously small than 255, and source address Certanly f the packet flter starts the checkng process from rule R1, the packet wll be dscarded. But ths may not be the result the rule desgner or the admnstrator has expected. There are many reasons why ths knd of hdden conflcts exsts. The most reasonable one s that the rule desgner does not have a clear and complete understandng of the former confgured rules when addng new rules to the rule table. Ths stuaton actually happens qute often when the number of rules n the rule table s very large. So t s necessary to detect these hdden conflcts among rules. If conflcts among rules exst, rule desgner can refne the conflctng rules n case an undesred acton s taken. We call the problem of detectng conflcts among rules n an RBS as the fault detecton problem of RBS. When the rule set s small, for example four to fve rules, t s easy to detect all the conflcts manually. But t s extremely hard to do t manually when the number of rules n the RBS grows very large. So we need to nvestgate how to do fault detecton for an RBS automatcally.

4 3 Soluton to a Constraned Verson of Fault Detecton Problem In ths secton, we frst gve the defnton of rules and conflct rules, and then nvestgate the soluton to a constraned verson of the fault detecton problem. We propose a two-phase algorthm to solve ths constraned verson of fault detecton problem. The frst phase s to do the rule normalzaton. The second phase s to detect conflct rules. For ths constraned verson of the fault detecton problem, the algorthm takes polynomal tme. 3.1 Conflct Rules Suppose all rules n the rule table of a packet flter can be converted nto the followng format, f (C) then (A), (2) C s a condtonal expresson and A s pass-acton part of the rule. We wll show how to do the rule converson n next secton. Conflct rules can be defned as: Defnton 1. Conflct rules Gven a rule table of a packet flter, whch has N peces of rules, R : f (C ) then ( A ) 1 N We say that two peces of rules R and R j conflct f and only f A conflcts wth A j and C C j s satsfable. So the fault detecton problem n an RBS such as packet flter s to fnd all possble conflcts n ts rule table. 3.2 Rule normalzaton As we can see from Table 1, there exst many rules that do not match the general f-then format as n (2). Usually these rules can be expressed as followng, If ( C ) then ( A y ) else (A n ) (3) So we need to do rule normalzaton to convert rules wth the f-then-else format as n (3) to the requred f-then format as n (2). As we ponted out n Secton 2, rule desgners often use a specal acton goto to chan rules together, whch makes the confguraton of packet flter easer and more flexble. But for a rule wth the specal acton goto, we cannot decde ts fnal acton drectly. We need to further check the rule lnked by the goto acton. Ths wll lead to trouble when dong fault detecton. So another task of rule normalzaton s to get rd of all the goto acton. The basc dea of rule normalzaton s to represent the rule table by a drected graph, whch s called as the Rule Relaton Graph (RRG). Then every path from the source node to the snk node n the RRG forms a new rule, whch s free of goto and else.

5 Defnton 2. Rule Relaton Graph A Rule Relaton Graph (RRG) s a graph G = (V, E) n whch, V = { C1, C2,..., CN, A1, A2,..., AN, S} s the node set of graph G, n whch S s a pseudo source node; C represents a condton node; A represents an acton node. Every acton node A s also a snk node. E s the edge set of graph G. Every edge n E, except the edges startng from the pseudo source node S, has a label, ether YES or NO. The algorthm n Fgure 1 shows how to form the RRG from a rule table, whose tme complexty s O (N ), the value of N ranges from tens to hundreds n practce. Algorthm 1: Input: Output: Formng RRG Rule table wth N rules RRG G 1 V = {S}; E = Φ; set each rule as unvsted ; 2 For each R =(C, A y, A n ), = 1 to N 3 f rule R s unvsted 4 set rule R as vsted ; 5 V = V {node C }; 6 E = E {edge from S to node C }; 7 f ( A y s goto j ) 8 f rule R j s unvsted 9 V = V {node C j }; 10 E = E {edge from node C to node C j } wth label YES; 11 else 12 V = V {node A y }; 13 E = E {edge from node C to node A y } wth label YES; 14 f ( A n s goto k ) 15 f rule R k s unvsted 16 V = V {node C k }; 17 E = E {edge from node C to node C k } wth label NO; 18 else 19 V = V {node A n }; 20 E = E {edge from node C to node A n } wth label NO; Fgure 1. Algorthm for formng RRG For example, the RRG n Fgure 2 corresponds to rule table n Table 1.

6 Fgure 2. RRG for the rule table n Table 1 Then every source to snk path n RRG represents a new rule. Every path can be rewrtten nto a new rule satsfyng the standard f-then format by followng the procedure below: The snk node of the path forms the acton part of the new rule; The conjuncton of all the ntermedate nodes forms the condton part of the new rule, the conjuncton s generated as follows: f the edge comng out of node M s labeled wth YES, we use node M tself n the condton part, otherwse we use negaton of M ( M ) nstead. From Fgure 2, three paths can be found. YES 1) S ( DP = 21) ( Dscard ) NO 2) S ( DP < 255) ( Dscard) YES YES 3) S ( DP < 255) ( SD = 166*) ( Forward) So three new rules can be generated from Fgure 2, as shown n Table 2. No. Content of rule 1 If (packet wth destnaton port equals 21) then (dscard t) 2 If (packet wth destnaton port large than or equals 255) then (dscard t) 3 If (packet wth destnaton port small than 255 and from subnet /16) then (forward t) 3.3 Fault Detecton Table 2. Normalzed Rule Table The second phase of our soluton s to detect conflctng rules n the normalzed rule table. We frst check f the acton part of every par of rules conflct. If they do, we then check f the ntersecton of the two condtonal expressons s satsfable. If yes, a conflct s found. To make ths problem easer to solve, we frst make two assumptons. Later we wll relax these two assumptons and dscuss general solutons. The frst assumpton s that there s only one acton n every pece of rule, for example, n packet flter, ether forward or dscard, and these two conflct. So n the rule table, dfferent actons means conflct.

7 The second assumpton s about the condtonal expressons of rules. We assume that we have lmted number (K) of varables n the condtonal expressons, X, 1 K. Each varable corresponds to a dmenson n a K-dmenson space. And the possble values n each dmenson are lmted n a fnte, contnuous and ordered nteger nterval represented by S. We call the general fault detecton problem wth these two assumptons as a constraned verson of the fault detecton problem. For packet flter, fve felds n the TCP/IP header (see secton 2.1) have been used n the condtonal expressons. Suppose we use fve dmensons, da, sa, dp, sp and tp, to represent these fve felds. The values of each feld form an nterval met the above condton n the correspondng dmenson. And an arbtrary sub-nterval of each of the fve dmensons can be denoted by S, S, S, S and S respectvely. da sa dp sp tp Gven an arbtrary condtonal expresson C, we can transform t nto a dsjunctve normal form [7]: X F = 1 ( S da 1 sa 1 dp 1 sp 1 tp ) ( S 2 da 2 sa 2 dp 2 sp 2 tp ) (4) ( S n1 da n1 sa n1 dp n1 sp n1 tp ) Because F s a condtonal expresson n dsjunctve normal form, we can make sure every nterval S, x { da, sa, dp, sp, tp} n expresson 4 s a sngle nterval n the correspondng dmenson. l x Sngle nterval means that for every possble value e n dmenson x, f MIN ( S ) < e <MAX ( S ), then l e S x. Fgure 3 contans an algorthm to check the satsfablty of the ntersecton of two condtonal expressons C 1 and C 2 n dsjunctve normal form. For two ntervals S and S n dfferent dmensons, there s no need to check for ntersecton. So we only need to consder ntervals belongng to the same dmenson. In the algorthm, we call every conjunctve form a clause, e.g. ( S ) s a clause. da sa dp sp tp m x l x k xj l x

8 Algorthm 2: Checkng satsfablty Input: Two condton expressons C 1 and C 2 n dsjunctve normal form Output: Boolean value to show f there s ntersecton between C 1 and C 2 1 For each clause n C 1 2 For each clause n C 2 3 For each dmenson n set {da, sa, dp, sp, tp} do 4 If both clauses have sngle ntervals n current dmenson 5 Check f these two sngle ntervals have ntersecton 6 If yes, return TRUE; 7 Return FALSE Fgure 3. Algorthm for checkng satsfablty It s easy to prove that the algorthm n Fgure 3 takes polynomal tme. Suppose the average number of clauses n each condtonal expresson s N c, then the tme complexty of Algorthm 2 s O(KN c 2 ), K s the number of varables n the condtonal parts, whch s 5 for packet flter example. In the worst case, N c can be equal to the length of a varable s value dmenson. 4 General Case of Actons: Composte-actons In the packet flter example we have dscussed above, an mportant constrant s that there s only one acton n the acton part of every rule. But ths s not always held for some other RBSs. For example, IP Securty Archtecture (IPsec) s another typcal RBS. In the rule table of IPsec, besdes forward and dscard, there are many other knds of actons, e.g., encryptng wth Authentcaton Header (AH), encryptng wth encapsulatng Securty Payload (ESP) and etc. Besde the ncrease of the acton types, another change les n that there can be multple actons n the acton part of each rule. We call an acton part that has multple actons as a composte-acton. The conflct between the sngle actons of any two composte-actons may result n the conflct between these two composte-actons. So we need an effcent algorthm to check whether two composte-actons conflct. In the rest of ths paper, unless we ndcate explctly, the term acton means sngle acton. 4.1 Conflct Between Composte-actons We need to formally defne the meanng of conflct between two composte-actons. Frst we defne a relaton R on the set of all possble actons. conflct Defnton 3. Conflct Relaton The conflct relaton R on acton set S = A, A,..., A } s defned as conflct conflct j A { 1 2 M j, A, Aj S A R = {( A, A ) : A conflcts wth A }. As mentoned above, a composte-acton has multple actons. Two composte-actons are conflctng f there s at least one par of actons, each of whch comes from a dfferent composte-acton and whch are conflctng. Defnton 4 gves a formal descrpton.

9 Defnton 4. Conflct Composte-actons For two rules R and R j : R f ( C ) then( A ; A ; ; A ) and : 1 2 m j : f ( C j ) then( Aj1; Aj 2; ; Ajn R ), ther acton parts conflct f and only f there s at least one par of actons ( 1 p m, 1 q M ). ( A, A p jq ) R conflct 4.2 Checkng Conflct Between Composte-actons Fgure 4 shows the algorthm to check conflct between two composte-actons. In ths algorthm, we use a graph to represent the conflct relaton R. We call ths graph the conflct acton graph. Every node n ths graph stands for an acton and there s an edge between two nodes f and 2 only f the correspondng two actons conflct. The tme complexty of ths algorthm s O ( M ). M s the maxmal number of actons. conflct Algorthm 3: Input: Output: Checkng conflct composte-actons Two composed-actons A and A j, conflct acton graph Boolean value to show f they are conflct 1 Intalze all entres n array color[m] to whte; 2 For every node a k n the conflct acton graph of R conflct do 3 f a k A - A j, then color[k]=blue; 4 f a k A j - A, then color[k]=red; 5 f a k A A j, then color[k]=green; 6 For every node a p A do 7 For every node a q A j do 8 f (color[p] color[q]) or (color[p] == color[q] == green) 9 return true; 10 Return false; Fgure 4. Algorthm for checkng conflct composte-actons In ths algorthm, we use a color array to keep a record for the appearance of each node n the two composte-actons. If a node s n A, we set ts color to blue; f a node s n A j, we set ts color to red; and f a node s n both A and A j, we set ts color to green. After that, every edge related to the two composte actons s checked. If the colors of one edge s two end ponts are ether both green or dfferent, we say these two composte-actons conflct wth each other. In Algorthm 3, we treat composte-actons as sets of actons, so set operators can apply [8]. 5 General Case of Condtonal Expressons In ths secton, we dscuss the general case of condtonal expressons. In Secton 3, we assumed that the values of each of the varables used n the condtonal expressons of rules are a fnte set of ntegers. For most RBSs, beng dscrete s stll a general attrbute of varables, but the other two

10 attrbutes, fnte and ordered, may not hold any more. In ths secton we relax our requrement for the varables and gve the defnton of condtonal expressons n general case usng Boolean Logc. In Boolean Logc we use Boolean varables x 1, x 2, for the ndvdual statement such as destnaton port lower than 255. That s, each Boolean varable denotes a statement that can n prncple be true or false ndependently of the truth-value of the others [8]. Let X = {x 1, x 2, x n } be a fnte set of Boolean varables, and let X = x, x,..., x }, where the { 1 2 n x 1, x2,..., x n are new symbols standng for the negatons of x 1, x 2, x n. We call the elements of X X lterals; varables are postve lterals, whereas negatons of varables are negatve lterals. A clause L s a nonempty set of lterals: L X X. Fnally a Boolean formula n conjunctve normal form s a set of clauses defned on X. For example, f we have X = {x 1, x 2, x 3 }, and therefore X = { x1, x2, x3}. L = { x1, x2, x3} s a clause. If we use parentheses nstead of the usual set brackets and also separate the lterals by the delmter or nstead of coma, clause L can be rewrtten as a dsjunctve only Boolean expresson L = ( x ) 1 x2 x3. So a Boolean formula can be rewrtten as a Boolean expresson n conjunctve normal form, nterested readers can refer to [8][9] for algorthms and examples. Because any condtonal expresson can be transformed nto a conjunctve normal form, we defne the condtonal expresson n general case as: Defnton 5. Condton expresson n general case The condtonal expresson of a rule s a Boolean formula n conjunctve normal form. Because every condtonal expresson can be represented by a Boolean formula n conjunctve normal form, the ntersecton of two condtonal expressons s the conjuncton of the two correspondng Boolean formulas, whch s stll a Boolean formula n conjunctve normal form. So the problem of checkng whether two generalzed condton expressons are ntersected equals to check the satsfablty of a Boolean formula n conjunctve normal form. It takes lnear tme to check the satsfablty of a Boolean formula n a normal form. 6 Case study We mplement our algorthms under LINUX and apply t on a set of rules collected from one of the frewall systems n Bell Labs. Because of securty reason, we do not nclude the source data n ths paper but only report our expermental results. The rule table we have checked ncludes a total of 48 rules. They do flterng on varous types of IP traffc, for example, TCP packet of mal servce wth destnaton port 25, vrus alert on specfc IP address, and even popular ICQ traffc (UDP traffc send to destnaton port 4000), etc. The felds n the IP header beng checked nclude source address, destnaton address, protocol type, source port and destnaton port. The dfference between ths real table and the one mentoned n the prevous sectons s that the real rule s attached wth another attrbute, drecton. The drecton may be IN, OUT and BOTH, wth

11 the meanng that ths rule should be appled on a packet when the packet s receved, forwarded or both respectvely. Because the IN rules and OUT rules are appled at dfferent tme and cannot conflct wth each other, we rewrte the orgnal table to two separate tables n accordance wth the dfferent drectons. There s a default rule n every table, whch s the last rule be appled when all other rules are faled. It s always wth the followng format, f (( src = *) and( dst = *) and( ptl = *) and( srcport = *) and( dstport = *)) then( dscard) Here the star (*) means all possble values. For example, (src = *) means the source IP address can be anyone between and Accordng to our defnton of conflct, the last rule wll conflct wth every rule wth the acton forward. To smplfy our analyss, we gnore ths default last rule when applyng our algorthms. In the remanng 47 rules, we have found 43 potental conflcts. We say a par of rules conflcts when the traffc descrbed by the two rules has overlap (or there s traffc that can satsfy both rules) but the actons taken by the two rules are dfferent. Ths s consstent wth our defnton of conflct n Defnton 1. Followng we analyze two of potental conflcts we found. 1) Rule 4 and 7, No. Content of rule 4 If (packets wth src address drect_mal and servce mal) then (forward t) 7 If (packets wth dst address russtroj) then (dscard t) Here the term mal stands for the mal servce that has protocol type TCP and destnaton port 25. So f a mal packet from the host drect_mal to host russtroj comes, rule 4 tells the packet should be forwarded, whle rule 7 states t should be dscarded. Because rule 4 s appled before rule 7, the acton taken by the frewall wll be forward t. But s ths the desred acton by the system admnstrator? 2) Rule 9 and 14, No. Content of rule 9 If (packets wth src address mh and servce sunrpc) then (dscard t) 14 If (packets wth src address bandt2 and servce bandt2_out) then (forward t) The IP addresses group bandt2 s part of mh, sunrpc s the UDP servce wth destnaton port 111, and bandt2_out means the servce wth protocol UDP and source port So f a packet from bandt2 to somewhere wth servce udp/7331/111 comes, rule 9 tells the packet should be dscarded, whle rule 14 says t should be forwarded. Because rule 9 s appled before rule 14, the acton taken by the frewall wll be dscard t. But s ths the desred acton by the system admnstrator? As we clamed, our fndngs are just potental conflcts. Only the system admnstrator who wrote these rules can decde f they are real conflcts. If the acton taken by the frewall system s not what the system admnstrator has desred, then t s a real conflct. Otherwse, t s only the real ntenton of the system admnstrator.

12 7 Concluson In ths paper, we proposed a soluton for the fault detecton problem for packet flter n frewall systems, whch s a typcal type of RBS. We also extended our soluton to deal wth composte-actons. For RBS wth generalzed condtonal expressons, the fault detecton problem s NP-hard. We also appled our algorthms on a set of real data and reported the result. Our future work wll nclude two aspects. One s to explore other applcatons than the packet flter n frewall systems; the other s to search for heurstc algorthms for the general RBS. Acknowledgements: We would lke to thank Erc Grosse for provdng us the real data collected from frewalls n Bell Labs and commentng on our expermental results. References 1. E. Ayanoglu and D. Lee, Readng Notes on Network Management: Part I Fault Detecton, Bell Labs, Lucent Technologes, June 4, C. S. Hood and C. J, Proactve Network-Fault Detecton, IEEE Trans. on Relablty, Vol. 46, No. 3, Sept A. Lazar, W. Wang and R. H. Deng, Models and Algorthms for Network Fault Detecton and Identfcaton: A Revew, Proc. ICCS/ISITA, Sngapore, R. Hao, D. Lee and R.K. Snha, SOCRATES on IP Router Fault Detecton, IEEE Globecom D. Lee and M. Yannakaks, Prncples and Methods of Testng Fnte State Machnes: A survey, Proceedngs of the IEEE, Vol.84, No.8, August S. Tanenbaum, Computer Networks, thrd edton, Prentce-Hall, M. M. Mano, Computer Logc Desgn, Prentce-Hall, H. R. Lews and C. H. Papadmtro, Elements of the theory of computaton, second edton, Prentce-Hall, M. R. Garey and D. S. Johnson, Computers and Intractablty: A Gude to the Theory of NP-Completeness, Freeman, D. Wang, R. Hao and D. Lee, Fault Detecton n Rule-Based Software Systems, Concorda Prestgous Workshop on Communcaton Software Engneerng 2001, September