一种适用于Diverse Firewall Design的规则集比较算法

随着防火墙规则数目的增多,Diverse Firewall Design设计方法越来越受到重视.在应用该方法进行规则集设计时,多个开发团队会独立地编写若干规则集.由于规则集配置的复杂性,这些规则集有可能不一致.因此,需要使用规则集比较算法,判断这些规则集是否等价,以达到检测出错误配置的目的.然而现有规则集比较算法,实现复杂且效率较低.针对这一问题,提出了一种基于规则交集运算的规则集比较算法.该算法首先使用规则冲突消除算法对规则集进行预处理,将规则集比较问题,转换成多维空间中的图形比较问题;然后利用规则交集运算,判断图形所占区域和颜色是否一致,进而确定规则集是否等价.理论分析和测试表明,算法能检测出规则集之间的不同点,且时空效率优于现有算法.

A Rule Sets Comparing Algorithm for Diverse Firewall Design

When Diverse Firewall Design was employed to configure a firewall rule set, multiple teams, who got the same requirement specification of the firewall rule set, independently configured different versions of the rule set. And then rule sets comparing algorithms could be employed to decide whether multiple rule sets were equal or not. However, the performance of the present algorithm was not very good. A rule sets comparing algorithm based on rules intersection was proposed by this paper. First, rule conflicts resolving was employed to eliminate conflicts among rule sets. And then the problem of rule sets comparing was transformed into the problem of pictures comparing in multi-dimensional space. At last, the algorithm proposed by this paper compared the areas and the color of pictures to decide the rule sets were equal or not by employing rules intersection. The results of experiments not only showed that the algorithm could find out all discrepancies among rule sets, but also verified that the performance of the algorithm was better than that of the present algorithm.