Abstract:Firewalls are the mainstay of enterprise security and the most widely adopted technology for protecting private networks. As the quality of protection provided by a firewall directly depends on the quality of its policy (i.e., configuration), ensuring the correctness of firewall policies is important and yet difficult. To help ensure the correctness, we propose a systematic structural testing approach for firewall policies. We define structural coverage (based on coverage criteria of rules, predicates, and clauses) on the firewall policy under test. To achieve high structural coverage effectively, we have developed four automated packet generation techniques: the random packet generation, the one based on local constraint solving (considering individual rules locally in a policy), the one based on global constraint solving (considering multiple rules globally in a policy), and the one based on boundary values.We have conducted an experiment on a set of real policies and a set of faulty policies to detect faults with generated packet sets. Generally, our experimental results show that a packet set with higher structural coverage has higher fault-detection capability (i.e., detecting more injected faults). Our experimental results show that a reduced packet set (maintaining the same level of structural coverage with the corresponding original packet set) maintains similar fault-detection capability with the original set.

Automatic Conflict Analysis and Resolution of Traffic Filtering Policy for Firewall and Security Gateway

Automated firewall configuration in virtual networks

Autonomous Attack Mitigation Through Firewall Reconfiguration

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

First Step Towards Automatic Correction of Firewall Policy Faults

Systematic review of automatic translation of high-level security policy into firewall rules

ForestFirewalls: Getting Firewall Configuration Right in Critical Networks (Technical Report)

A Two-Fold Traffic Flow Model for Network Security Management

Systematic Structural Testing of Firewall Policies

A Firewall Policy Anomaly Detection Framework for Reliable Network Security

Formal Checking of Multiple Firewalls

Conflicts detection in policy-driven multi-agent system

Fault Localization for Firewall Policies.

Modeling on Policy Conflict for Managing Heterogeneous Security Systems in Distributed Network Environment

Research on traffic conflict automatic discrimination based on support vector machine

Control Framework for Large Networks

The Design and Implementation of IPSec Conflict Avoiding and Recovering System

Conflict Probability Analysis of Automatic Air Traffic Control

Policy Based Access Control Framework for Large Networks

Research on Network Security Policy Refinement Consistency of Detection and Conflict Resolution Mechanisms

Transaction-Based Flow Rule Conflict Detection And Resolution In Sdn