A flexible and feasible anomaly diagnosis system for Internet firewall rules

Chao, Chi-Shih

doi:10.1109/apnoms.2011.6077012

Cited by 8 publications

(3 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another relevant classes of related work about the topic of firewall anomaly analysis is composed of studies ( [27], [28], [29], [30], [31], [32], [33], [34]) that propose platforms based on Graphic User Interfaces (GUIs), which provide functionalities such as zooming and manual adjustment of the firewall filtering effect areas to help human administrators to identify firewall policy anomalies. Specifically, Tran et al [27] propose PolicyVis, a 2D graphic interface that allows a thorough visualization of all possible firewall behaviors by considering all rules fields, actions and orders.…”

Section: A Firewall Policy Anomaly Analysismentioning

confidence: 99%

“…PolicyVis is flexible enough to let users choose their desired fields as 2D graph coordinates, and eases the anomaly analysis operation introducing the features of compressing, focusing, zooming, and segmentation. Chao [28] creates a systematic visualization for the firewall Rule Anomaly Relation tree (RAR tree) that is created on the basis of the investigated firewall rules. Callouts, arrays and other graphical symbols are used to depict intuitively the presence of anomalies, and a specific GUI view is employed to categorize them.…”

Section: A Firewall Policy Anomaly Analysismentioning

confidence: 99%

See 1 more Smart Citation

An Optimized Approach for Assisted Firewall Anomaly Resolution

Bringhenti,

Seno,

Valenza

2023

IEEE Access

View full text Add to dashboard Cite

The security configuration of firewalls is a complex task that is commonly performed manually by network administrators. As a consequence, among the rules composing firewall policies, they often introduce anomalies, which can be classified into sub-optimizations and conflicts, and which must be solved to allow the expected firewall behavior. The severity of this problem has been recently exacerbated by the increasing size and heterogeneity of next-generation computer networks. In this context, a main research challenge is the definition of approaches that may help the administrators in identifying and resolving the anomalies afflicting the policies they write. However, the strategies proposed in literature are fully automated, and thus potentially dangerous because the error-fixing process is not under human control. Therefore, this paper proposes an optimized approach to provide assisted firewall anomaly detection and resolution. This approach solves automatically only sub-optimizations, while it interacts with human users through explicit queries related to the resolution of conflicts, as their automatic resolution may lead to undesired configurations. The proposed approach also reduces the number of required interactions, with the aim to reduce the workload required to administrators, and employs satisfiability checking techniques to provide a correct-by-construction result. A framework implementing this methodology has been finally evaluated in use cases showcasing its applicability and optimization.INDEX TERMS Firewall, policy anomaly management, policy-based systems.

show abstract

Section: A Firewall Policy Anomaly Analysismentioning

confidence: 99%

Section: A Firewall Policy Anomaly Analysismentioning

confidence: 99%

An Optimized Approach for Assisted Firewall Anomaly Resolution

Bringhenti,

Seno,

Valenza

2023

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Two fuzzy variables including «Low» and «High» are used to describe both the receive rate counter r A and the rejection rate r R . The result of the fuzzy system is the computed rate r C , which characterizes the rate of rejection and acceptance in packet traffic and is described by three fuzzy variables, including High Rejec-tion, Equal, and High Accept [11]. Figure 4 shows packet filtering rules flowcharts (Second level).…”

Section: Fig 2 Two-level Fuzzy Packet Filtering Modelmentioning

confidence: 99%

Method of Risk Detection Model in Packet Filtering

Gulyamov

Sagatova

2021

mcm-tech

View full text Add to dashboard Cite

This article describes Petri net diagrams for fuzzy knowledge and reasoning. A mathematical model of fuzzy Petri nets to detect risks in rules by packet filtering is formed. A model of a two-level fuzzy packet filtering system that provides packet filtering perfor-mance is presented. This model uses fuzzy Petri net as a graphical method to describe the fuzzy logical control of the movement of packets through the firewall and allows it to determine the level of threat embedded in packets from the Internet and to change the or-der of ACLs by determining the rating of acceptance and rejection of packets. In the proposed model, the packet is represented by a token in place of fuzzy Petri nets, and the operation of the packet is illustrated by the transition of fuzzy Petri net, which is responsible for moving the packet from one place to another.

show abstract