  This paper presents a classification of the anomalies that can appear when
designing or implementing communication protection policies. Together with the
already known intra- and inter-policy anomaly types, we introduce a novel
category, the inter-technology anomalies, related to security controls
implementing different technologies, both within the same network node and
among different network nodes. Through an empirical assessment, we prove the
practical significance of detecting this new anomaly class. Furthermore, this
paper introduces a formal model, based on first-order logic rules that analyses
the network topology and the security controls at each node to identify the
detected anomalies and suggest the strategies to resolve them. This formal
model has manageable computational complexity and its implementation has shown
excellent performance and good scalability.
