Abstract:Firewalls are the mainstay of enterprise security and the most widely adopted technology for protecting private networks. As the quality of protection provided by a firewall directly depends on the quality of its policy (i.e., configuration), ensuring the correctness of firewall policies is important and yet difficult. To help ensure the correctness, we propose a systematic structural testing approach for firewall policies. We define structural coverage (based on coverage criteria of rules, predicates, and clauses) on the firewall policy under test. To achieve high structural coverage effectively, we have developed four automated packet generation techniques: the random packet generation, the one based on local constraint solving (considering individual rules locally in a policy), the one based on global constraint solving (considering multiple rules globally in a policy), and the one based on boundary values.We have conducted an experiment on a set of real policies and a set of faulty policies to detect faults with generated packet sets. Generally, our experimental results show that a packet set with higher structural coverage has higher fault-detection capability (i.e., detecting more injected faults). Our experimental results show that a reduced packet set (maintaining the same level of structural coverage with the corresponding original packet set) maintains similar fault-detection capability with the original set.

Applying static code analysis to firewall policies for the purpose of anomaly detection

Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems

A Firewall Policy Anomaly Detection Framework for Reliable Network Security

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

Systematic Structural Testing of Firewall Policies

Comparative Analysis of Anomaly Detection Approaches in Firewall Logs: Integrating Light-Weight Synthesis of Security Logs and Artificially Generated Attack Detection

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.

Platform-Independent Firewall Policy Representation

First Step Towards Automatic Correction of Firewall Policy Faults

Systematic review of automatic translation of high-level security policy into firewall rules

Dynamic Code Analysis and Its Implementation in Interpreted Languages

Abstract Interpretation-Based Data Leakage Static Analysis

Customizing Static Analysis using Codesearch

Automatic Conflict Analysis and Resolution of Traffic Filtering Policy for Firewall and Security Gateway

Bridging Static and Dynamic Program Analysis using Fuzzy Logic

Fault Localization for Firewall Policies.

ForestFirewalls: Getting Firewall Configuration Right in Critical Networks (Technical Report)

Verified iptables Firewall Analysis and Verification

Improving Dynamic Code Analysis by Code Abstraction

Implementing and Executing Static Analysis Using LLVM and CodeChecker

A Framework for Understanding Dynamic Anti-Analysis Defenses.