防火墙策略冲突检测及冲突策略可视化

为了检测防火墙策略中的所有冲突,避免修改冲突时引入新冲突,文中采用对规则进行分割来检测冲突。其中,冲突检测包括3个部分:防火墙策略分割、对分割的结果进行分析和计算,以及冲突域提取。同时,为了对冲突规则以及产生冲突的原因进行分析,文中采用网格的可视化方法实现了对防火墙规则之间以及规则与冲突域之间的关系。采用这种技术能够提高管理员发现、分析和修改策略冲突的效率和准确性,并通过实验验证了该方法的有效性。

Firewall Policy Conflict Detection and Conflict Rules Visualization

In order to detect all conflicts existing in firewall policy and visualize the relationships between rules and the reasons that generate conflicts, the rule segmentation is adopted to detect conflicts, and grids visualization method to visualize the relationships between rules and the reasons that generates conflicts. Conflict detection contains three functional parts, including segmentation of firewall policy, analysis on the segmentation result and extraction of the conflict domain. Thus the administrator could clearly know the anomaly cause, enhance the understanding, inspect the firewall policies, and avoid the introduction of new conflicts while modifying existing conflicts. And the experiment indicates the feasibility and effectiveness of this method.