Audit and Processing of Anormaly Firewall Rules

Abstract

1. Objectiv ： Firewall rules configuration has been the focus of network security research and this paper studies and improves the firewall rule audit method to improve the matching efficiency of firewall rules. 2. Method: This paper makes a detailed study of the relationship between firewall rules, and explain them by the concept of the collection, then summarizes anormaly conflicts, then the rule of the firewall is optimized by using statistical algorithm. 3. Results: This paper designs the hierarchical audit structure, simplifies the audit work, and applies the policy tree algorithm to audit the rule set of the firewall. At last, the model of the different anomaly is given. 4. Conclusion: The 7 anormalies in the experimental rule set are all discoveried, and the average matching times is reduced from 4.624 to 3.544.