防火墙策略异常检测与处理

发布时间：2019-03-20 20:30

【摘要】：防火墙是最广泛部署的安全机制之一,其有效性取决于网络过滤策略的配置。如今,防火墙策略异常检测与处理技术已经普遍应用于现实场景中。在防火墙中存在异常策略时,系统会对异常策略进行风险评估并自动化解决冲突。该技术的应用大大提高了防火墙的稳定性和安全性。在互联网的高速发展的形势下,对防火墙的安全性要求不断提高,防火墙策略异常检测与处理技术成为一个研究热点。由于防火墙中的策略数量十分庞大,策略之间的关系十分复杂,依靠人工手段解决冲突基本是不可能的。因此,人们逐渐采用自动化的技术来处理异常。现在的异常检测技术已经可以准确的检测出异常策略,但是异常处理的效果仍然不尽如人意。当评估一条异常规则的动作存在偏差时,往往会导致多条规则异常。与此同时,在检测与处理方法的效率上也亟待提高。在以往的方法中,处理异常通常采取分治的方法,将规则集合划分为多个子集,每个子集包含几十乃至上百条规则,随后进行风险评估从而处理子集中的异常。这种方式在评估出现偏差时会造成规则影响域变小,产生严重的安全漏洞。同时,在过去的方法中评估异常处理效果的标准过于宽松,无法准确的评估方法的处理效果导致处理后的规则冲突仍然比较严重。为了解决上述问题,本文中我们设计了高效的异常检测算法用于检测异常规则并保留有效信息,提出了基于异常域的异常处理算法,利用异常检测算法保存的有效信息来优化后续的异常处理过程。我们首先将规则的异常域保存标记,而后在异常处理阶段构建风险评估模型来评估异常域的风险等级,并针对模型参数进行优化,从而提高异常处理的准确率,同时利用检测阶段保存的有效信息,加快异常处理的进程,提高处理效率,并在不影响其他策略的前提下处理异常规则,提高系统的稳定性和可维护性。我们与Hongxin Hu,Haris等人的方法进行了对比实验,实验结果表明本文方法显著的降低了异常域的影响范围,验证了本文方法的优越性。
[Abstract]:Firewall is one of the most widely deployed security mechanisms, and its effectiveness depends on the configuration of network filtering policies. Nowadays, firewall policy anomaly detection and processing technology has been widely used in real world. When an exception policy exists in a firewall, the system assesses the risk of the exception policy and automates conflict resolution. The application of this technology greatly improves the stability and security of the firewall. With the rapid development of Internet, the security requirements of firewall are increasing constantly, and firewall policy anomaly detection and processing technology has become a hot research topic. Because the number of policies in firewall is very large and the relationship between policies is very complex, it is impossible to solve conflicts by manual means. As a result, people are gradually using automated technology to handle exceptions. At present, the anomaly detection technology can detect the anomaly strategy accurately, but the effect of exception handling is still not satisfactory. When there is a deviation in the evaluation of an exception rule, it often results in multiple rule anomalies. At the same time, the efficiency of detection and processing methods also need to be improved. In previous methods, the rule set is divided into several subsets, each subset contains dozens or even hundreds of rules, and then risk assessment is carried out to deal with the exceptions in the subset. This approach can result in a smaller rule impact domain and a serious security vulnerability when there is a bias in the assessment. At the same time, the criteria for evaluating the effect of exception handling in the past methods are too loose, and the rule conflicts after processing are still serious due to the inability to accurately evaluate the effect of the methods. In order to solve the above problems, we design an efficient anomaly detection algorithm to detect anomaly rules and retain valid information, and propose an exception handling algorithm based on anomaly domain. The efficient information saved by the anomaly detection algorithm is used to optimize the subsequent exception handling process. We first store the exception domain marker of the rule, and then construct a risk assessment model in the exception handling phase to evaluate the risk level of the anomaly domain, and optimize the model parameters to improve the accuracy of exception handling. At the same time, the effective information stored in the detection phase is used to speed up the process of exception handling, improve the processing efficiency, and deal with the exception rules without affecting other strategies, so as to improve the stability and maintainability of the system. Compared with Hongxin Hu,Haris 's method, the experimental results show that this method can significantly reduce the influence range of the anomaly domain, and verify the superiority of the proposed method.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】