A Novel and Feasible System for Rule Anomaly and Behavior Mismatching Diagnosis Among Firewalls

Tree Based Diagnosis Mechanisms for Rule Anomalies among Internet Firewalls

“…The experimental results would not include those of [2][3][4] this time, which needs a substantial amount of pair-wise rule comparisons to do anomaly diagnosis and has been shown an exponential growth of computing time with the number of rules in our previous work [9]. In this paper, three developed systems based on different tree-based data structures/algorithms are compared.…”

“…Referring to the coding tree data structure widely used in data/video compression [6], the traffic plane will be split recursively as well as exponentially if a split block finds there are more than two rules within it (Fig. 4), rather than splitting the traffic plane into a matrix consisting of fixedsized smaller blocks as done in our previous work [7]. After that, the address space of a filtering rule can be recorded in our ARAR tree in the form of --, where contains the values of the conditional fields of the rule, is used to indicate the split block(s) spanned by the address space of the rule, shows the label (or the order) of the rule.…”

“…9). Then we can combine the two FSTs from firewall B and firewall D without any tree-height adaption, like ARAR Tree [9], and a new FST suitable for diagnosis of inter-ACL/inter-firewall anomalies between firewall B and firewall D is created. Likewise, we can use it and easily figure out anomalies among firewalls; for example, in Fig.…”

“…In this paper, three developed systems based on different tree-based data structures/algorithms are compared. Please be kindly noticed that our first RAR-tree-based system is done and tested in 2013 [7], which splits the traffic plane into fixed-sized smaller blocks (where A is the size of blocks in Fig. 12).…”