Detecting and Resolving Firewall Policy Anomalies
Detecting and Resolving Firewall Policy Anomalies
复制标题
DOI：
10.1109/tdsc.2012.20
复制
发表时间：
2012-05-01
影响因子：
7.3
通讯作者：
Kulkarni, Ketan
中科院分区：
文献类型：
--
作者：
Hu, Hongxin;Ahn, Gail-Joon;Kulkarni, Ketan
面向服务的架构和云计算等新兴计算技术的出现使我们能够更高效地执行业务服务。然而，我们仍然遭受业务服务中未经授权的操作造成的意外安全泄漏。防火墙是最广泛部署的安全机制，以确保大多数企业和机构的专用网络安全。防火墙提供的安全保护的有效性主要取决于防火墙中配置的策略的质量。不幸的是，由于防火墙配置的复杂性以及缺乏系统的分析机制和工具，设计和管理防火墙策略往往容易出错。在本文中，我们提出了一个创新的防火墙策略异常管理框架，采用基于规则的分割技术来识别策略异常，并获得有效的异常解决方案。特别是，我们阐明了一个基于网格的表示技术，提供了一个直观的认知意义上的政策异常。我们还讨论了一个基于可视化的防火墙策略分析工具，称为防火墙异常管理环境（FAME）的概念验证实现。此外，我们证明了我们的方法可以有效地发现和解决防火墙策略中的异常，通过严格的实验。
The advent of emerging computing technologies such as service-oriented architecture and cloud computing has enabled us to perform business services more efficiently and effectively. However, we still suffer from unintended security leakages by unauthorized actions in business services. Firewalls are the most widely deployed security mechanism to ensure the security of private networks in most businesses and institutions. The effectiveness of security protection provided by a firewall mainly depends on the quality of policy configured in the firewall. Unfortunately, designing and managing firewall policies are often error prone due to the complex nature of firewall configurations as well as the lack of systematic analysis mechanisms and tools. In this paper, we represent an innovative policy anomaly management framework for firewalls, adopting a rule-based segmentation technique to identify policy anomalies and derive effective anomaly resolutions. In particular, we articulate a grid-based representation technique, providing an intuitive cognitive sense about policy anomaly. We also discuss a proof-of-concept implementation of a visualization-based firewall policy analysis tool called Firewall Anomaly Management Environment (FAME). In addition, we demonstrate how efficiently our approach can discover and resolve anomalies in firewall policies through rigorous experiments.