Firewall Policy Advisor for anomaly discovery and rule editing
Firewall Policy Advisor for anomaly discovery and rule editing
复制标题
DOI：
10.1109/inm.2003.1194157
复制
发表时间：
2003-03
期刊：
影响因子：
--
通讯作者：
E. Al-Shaer;H. Hamed
中科院分区：
文献类型：
--
作者：
E. Al-Shaer;H. Hamed
防火墙是网络安全的核心要素。然而，管理防火墙规则，尤其是企业网络的防火墙规则，已经变得复杂且容易出错。必须仔细编写和组织防火墙过滤规则，才能正确实施安全策略。此外，插入或修改过滤规则需要彻底分析该规则与其他规则之间的关系，以确定该规则的正确顺序并提交更新。在本文中，我们提出了一组技术和算法，它们提供（1）防火墙策略异常的自动发现，以揭示旧防火墙中的规则冲突和潜在问题，以及（2）用于规则插入、删除和修改的无异常策略编辑。这是通过名为“防火墙策略顾问”的用户友好工具实现的。防火墙策略顾问显着简化了对任何编写为过滤规则的通用防火墙策略的管理，同时最大限度地减少由于防火墙规则配置错误而导致的网络漏洞。
Firewalls are core elements in network security. However, managing firewall rules, especially for enterprize networks, has become complex and error-prone. Firewall filtering rules have to be carefully written and organized in order to correctly implement the security policy. In addition, inserting or modifying a filtering rule requires thorough analysis of the relationship between this rule and other rules in order to determine the proper order of this rule and commit the updates. In this paper, we present a set of techniques and algorithms that provide (1) automatic discovery of firewall policy anomalies to reveal rule conflicts and potential problems in legacy firewalls, and (2) anomaly-free policy editing for rule insertion, removal and modification. This is implemented in a user-friendly tool called "Firewall Policy Advisor". The Firewall Policy Advisor significantly simplifies the management of any generic firewall policy written as filtering rules, while minimizing network vulnerability due to firewall rule misconfiguration.