Abstract:Firewalls are the mainstay of enterprise security and the most widely adopted technology for protecting private networks. As the quality of protection provided by a firewall directly depends on the quality of its policy (i.e., configuration), ensuring the correctness of firewall policies is important and yet difficult. To help ensure the correctness, we propose a systematic structural testing approach for firewall policies. We define structural coverage (based on coverage criteria of rules, predicates, and clauses) on the firewall policy under test. To achieve high structural coverage effectively, we have developed four automated packet generation techniques: the random packet generation, the one based on local constraint solving (considering individual rules locally in a policy), the one based on global constraint solving (considering multiple rules globally in a policy), and the one based on boundary values.We have conducted an experiment on a set of real policies and a set of faulty policies to detect faults with generated packet sets. Generally, our experimental results show that a packet set with higher structural coverage has higher fault-detection capability (i.e., detecting more injected faults). Our experimental results show that a reduced packet set (maintaining the same level of structural coverage with the corresponding original packet set) maintains similar fault-detection capability with the original set.

Dynamic Update of Firewall Policy Based on MFDT

Comparison Model and Algorithm for Distributed Firewall Policy

Proactive Security Defense of Dynamic Network

Algorithm for detecting firewall policy inconsistency

Systematic Structural Testing of Firewall Policies

First Step Towards Automatic Correction of Firewall Policy Faults

Fault Localization for Firewall Policies.

Dynamic Allocation and Hash Table Based Match Algorithms for Firewall Rules

Optimization to Firewall Rule-Matching with Statistic Analysis

Modelling and Complete Rewritten of Firewall Filtering Rules Using Geometry Technique

Firewall Policy Conflict Detection and Conflict Rules Visualization

An Architecture Approach To Dynamic Policy In Rbac

RESEARCH AND IMPLEMENTATION ON A FIREWALL SYSTEM SUPPORTING LARGE SCALE AND MULTIPLE USERS′ CONCURRENT CONTROL

Analysis of distributed firewall policy configuration mistakes and their detection

Automatic Conflict Analysis and Resolution of Traffic Filtering Policy for Firewall and Security Gateway

Simplified Mfe With Power-Change Adaption Strategy For The Dynamic Optimization Of Htr-Pm

A Review on the Realization Methods of Dynamic Fault Tree

Algorithm for Fast Detecting Firewall Rule Configuration Mistakes

Implementation of Portion Approach in Distributed Firewall Application for Network Security Framework

Autonomous Attack Mitigation Through Firewall Reconfiguration

Research on Firewall Performance Optimization