基于WBEM的防火墙策略异常检测系统

WBEM-based anomaly detection system of firewall policies

面对网络规模的无限量扩大以及新型攻击的不断出现,企业开始采用多级防火墙机制加强对整个网络的安全保护。然而这种保护机制同时向人们提出了如何保证策略与策略之间无异常的问题。因此,从防火墙底层的规则入手,主要针对防火墙的包过滤规则,定义了规则之间可能存在的异常,同时提出相应的检测算法以及基于WBEM架构的异常检测系统,在解决策略异常问题的同时实现防火墙策略整体上的对外一致性。

With the development of Internet and the emergency of new attacks, enterprises adopt cascaded firewalls to protect their network. While this way is effective, administrators also encounter the problem of how to avoid anomalies caused by different policies. So starting from the low-level rules, particularly on the filtering rules, different anomalies were identified and also algorithm used to discover anomalies and a WBEM-based model used to rectify the anomalies were propased, which not only solved anomaly discovery problem but realized the coherence of the whole policies as well.