The Semantics Loss Tracker of Firewall Rules

Khummanee, Suchart

doi:10.1007/978-3-319-93692-5_22

Cited by 4 publications

(8 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The semantics loss anomaly [2] occurs due to the merger of any two rules, making the original meaning of some rule lose its meaning. According to Figure 7 (Left side), r x and r y were merged into r z , resulting in all meaning of the r x lost immediately.…”

Section: Semantics Loss Anomalymentioning

confidence: 99%

See 1 more Smart Citation

DSSF: Decision Support System to Detect and Solve Firewall Rule Anomalies based on a Probability Approach

Khummanee

Chomphuwiset

Pruksasri

2022

ECTI-CIT Transactions

Self Cite

View full text Add to dashboard Cite

Currently, establishing a private network on the Internet is highly hazardous for attacks as attackers continuously scan computers for vulnerabilities within the connected network. The firewall ranked the highest as a network device is selected to protect unauthorized accesses and attacks. However, firewalls can effectively protect against assaults based on adequately defined rules without any anomalies. In order to resolve anomaly problems and assist firewall admins with the ability to manage the rules effectively, in this paper, a prototype of the decision support system has been designed and developed for encouraging admins to optimize firewall rules and minimize deficiencies that occur in rules by using the probability approach. The experimental results clearly show that the developed model encourages experts and administrators of firewalls to make significant decisions to resolve rule anomalies by expert's confidence increases by 14.8 %, and administrators' confidence soars similarly about 44.2 %. Lastly, the accuracy of correcting rule anomalies is 83 %.

show abstract

Section: Semantics Loss Anomalymentioning

confidence: 99%

“…Recently, a new type of anomaly has been introduced. This new anomaly is semantics loss of rules [2]. In a nutshell, when merging any two rules that overlap, they may lose their original meaning.…”

Section: Introductionmentioning

confidence: 99%

DSSF: Decision Support System to Detect and Solve Firewall Rule Anomalies based on a Probability Approach

Khummanee

Chomphuwiset

Pruksasri

2022

ECTI-CIT Transactions

Self Cite

View full text Add to dashboard Cite

show abstract

“…One typical solution to resolve such conflicts, that is, firewalls choose a rule which matches with the packet being considered first, called the first-match approach. The firewall rules anomalies can be classified into six [1], [2] types representing each anomaly by the theorems:…”

Section: = →mentioning

confidence: 99%

“…Semantics loss anomaly: The semantics loss represented by [2] occurs when and are merged to by the meaning of both old rules that have been changed or replaced by a new meaning. This anomaly is mostly caused by redundant rules as shown in Figure 1(f).…”

Section: Redundancy Anomalymentioning

confidence: 99%

See 1 more Smart Citation

Decision Making System for Improving Firewall Rule Anomaly Based on Evidence and Behavior

Khummanee¹,

Chomphuwiset²,

Pruksasri³

2020

Adv. sci. technol. eng. syst. j.

Self Cite

View full text Add to dashboard Cite

Firewalls are controlled by rules which often incur anomalies. The anomalies are considered serious problems that administrators do not desire to happen over their firewalls because they cause more vulnerabilities and decrease the overall performance of the firewall. Resolving anomaly rules that have already occurred on the firewall is difficult and mainly depends on the firewall administrator's discretion. In this paper, a model is designed and developed to assist administrators to make effective decisions for optimizing anomaly rules using the probability approach (Bayesian). In this model, the firewall needs to add four property fields (Extra fields) to the firewall rules: frequency of packets matching against rules, evidence of creating rules, the expertise of rules creator and protocol priority. These fields are used to calculate the probability of each firewall rule. The probability for each rule is used while the rules conflict and administrators need to resolve them. The rule having the highest probability value indicates that it has the highest priority in consideration. Experimental results show that the proposed model allows firewall administrators to make significant decisions about solving anomaly rules. The data structure of this model is based on k-ary tree, therefore the speed of building tree, time complexity and space complexity: O(n), O(logmn) and O(m*n) respectively. Besides, the confidence of the proposed firewall for resolving firewall rule anomalies of the administrator increase by 29.6% against the traditional firewall, and the reliability value between the inter-raters also increase by 13.1%.

show abstract

Misconfiguration in Firewalls and Network Access Controls: Literature Review

Alicea

Alsmadi

2021

Future Internet

View full text Add to dashboard Cite

Firewalls and network access controls play important roles in security control and protection. Those firewalls may create an incorrect sense or state of protection if they are improperly configured. One of the major configuration problems in firewalls is related to misconfiguration in the access control roles added to the firewall that will control network traffic. In this paper, we evaluated recent research trends and open challenges related to firewalls and access controls in general and misconfiguration problems in particular. With the recent advances in next-generation (NG) firewalls, firewall roles can be auto-generated based on networks and threats. Nonetheless, and due to the large number of roles in any medium to large networks, roles’ misconfiguration may occur for several reasons and will impact the performance of the firewall and overall network and protection efficiency.

show abstract

The Semantics Loss Tracker of Firewall Rules

Cited by 4 publications

References 11 publications

DSSF: Decision Support System to Detect and Solve Firewall Rule Anomalies based on a Probability Approach

DSSF: Decision Support System to Detect and Solve Firewall Rule Anomalies based on a Probability Approach

Decision Making System for Improving Firewall Rule Anomaly Based on Evidence and Behavior

Misconfiguration in Firewalls and Network Access Controls: Literature Review

Contact Info

Product

Resources

About