A Rule Sets Comparing Algorithm for Diverse Firewall Design

Li Lin; 卢显良; 李泽平

您当前的位置：

首页 >

文章列表页 >

A Rule Sets Comparing Algorithm for Diverse Firewall Design

更新时间：2023-11-28

- A Rule Sets Comparing Algorithm for Diverse Firewall Design
- Advanced Engineering Sciences Vol. 41, Issue 5, Pages: 160-164(2009)
- 作者机构：
  
  1. 电子科技大学
  2. 电子科技大学计算机科学与工程学院四川,成都,610054
- 作者简介：
- 基金信息：
- DOI：
  CLC：
- Published：2009，
  
  Published Online：1 September 2008，
扫描看全文
李林,卢显良,李泽平.一种适用于Diverse Firewall Design的规则集比较算法[J].工程科学与技术,2009,41(5):160-164.

Li Lin, 卢显良, 李泽平. A Rule Sets Comparing Algorithm for Diverse Firewall Design. [J]. Advanced Engineering Sciences 41(5):160-164(2009)
李林,卢显良,李泽平.一种适用于Diverse Firewall Design的规则集比较算法[J].工程科学与技术,2009,41(5):160-164. DOI：

Li Lin, 卢显良, 李泽平. A Rule Sets Comparing Algorithm for Diverse Firewall Design. [J]. Advanced Engineering Sciences 41(5):160-164(2009) DOI：

摘要

中文摘要: 随着防火墙规则数目的增多，Diverse Firewall Design设计方法越来越受到重视。在应用该方法进行规则集设计时，多个开发团队会独立地编写若干规则集。由于规则集配置的复杂性，这些规则集有可能不一致。因此，需要使用规则集比较算法，判断这些规则集是否等价，以达到检测出错误配置的目的。然而现有规则集比较算法，实现复杂且效率较低。针对这一问题，提出了一种基于规则交集运算的规则集比较算法。该算法首先使用规则冲突消除算法对规则集进行预处理，将规则集比较问题，转换成多维空间中的图形比较问题；然后利用规则交集运算，判断图形所占区域和颜色是否一致，进而确定规则集是否等价。理论分析和测试表明，算法能检测出规则集之间的不同点，且时空效率优于现有算法。

Abstract

Abstract:When Diverse Firewall Design was employed to configure a firewall rule set

multiple teams

who got the same requirement specification of the firewall rule set

independently configured different versions of the rule set. And then rule sets comparing algorithms could be employed to decide whether multiple rule sets were equal or not. However

the performance of the present algorithm was not very good. A rule sets comparing algorithm based on rules intersection was proposed by this paper. First

rule conflicts resolving was employed to eliminate conflicts among rule sets. And then the problem of rule sets comparing was transformed into the problem of pictures comparing in multi-dimensional space. At last

the algorithm proposed by this paper compared the areas and the color of pictures to decide the rule sets were equal or not by employing rules intersection. The results of experiments not only showed that the algorithm could find out all discrepancies among rule sets

but also verified that the performance of the algorithm was better than that of the present algorithm.

关键词

规则集规则集比较图形比较防火墙规则集正确性

Keywords

rule setsrule sets comparingpictures comparingfirewallrule sets correctness

references

Taylor, D. E. ；Turner, J. S.,ClassBench: A Packet Classification Benchmark,IEEE/ACM Transactions on Networking ,2007, 15(3).

Mohamed G. Gouda ；Alex X. Liu,Structured firewall design,Computer Networks ,2007, 51(4).

Begel A;McCanne Steven;Graham S L,BPF:exploiting global data-flow optimization in a generalized packet fiher architecture,ACM SIGCOMM Computer Communication Review

Bartal Y;Mayer A;Nissim K,Firmato:a novel firewall management toolkit,Oakland:IEEE,1999.

Lannay A

Allen J,The CERT guide to system and network security practices,New York:Addison-Wesley,2001.

李林,卢显良.-种基于切割映射的规则冲突消除算法[J].电子学报,2008(2)

Liu Alex X;Gouda M C,Diverse firewall design,Florence:IEEE,2004.

A;-Tawil Khalid;Al-Kahham I A,Evaluation and testing of intemet firowalls,International Journal of Network Management,2004(3).

Jurjens J;Wimmel G,Specification-based testing of firewalls,Novosibirsk:Springer-Verlag,2001.

Adel El-Atawy;Khaled Ibrahim,Policy segmentation for intelligent firewall testing,Chicago:IEEE,2005.

更多指标>

Views

100

下载量

CNKI被引量

Alert me when the article has been cited

提交

Tools

Publicity Resources

A Fast Firewall Packet Classification Algorithm Using Unit Space Partitions

Related Author

No data

Related Institution

School of Info. Sci.and Eng., Central South Univ.

⁰