A Real-Time Firewall Policy Rule Set Anomaly-Free Mechanism

摘要

a lot of work has been done on detecting firewall policy anomalies. There are tools have been proposed to help dependent on these studies, for example, Policy Advisor Tool. However, it dependent on the insertion of policy rules manually into the tool. There is a real need for a tool that acquire the firewall policy rules in realtime. There are also tools produced by firewall vendors developed for firewall systems to work on the management of their devices only and therefore does not work with the devices produced by other companies. Due to the growing network and its dependence on many of the firewall devices of different types and brands, it has become difficult to manage policies on various Firewall of different types and vendors and rely on many different tools as well. In this paper we proposed a method for investigating the firewall ruleset anomalies and suggest how to fix them. We also have built a practical tool that can obtain a copy of the policy ruleset in real time and dealing with several devices of different brands using the same tool. The proposed tool is considered as a way to help the network administrator and not an alternative him.