Firewall safety rule optimization method and device thereof

Abstract

The invention relates to a firewall safety rule optimization method and a device thereof. The method comprises the following steps: all safety rules are downloaded from firewall equipment; a streaming technical information and system log information of the firewall equipment are obtained; correspondence between the safety rules and matched data traffic is obtained according to the streaming technical information and the system log information; and the safety rules are sorted from large to small according to the matched data traffic, and the sorted safety rules are pushed back to the firewall equipment. According to the invention, matched data traffic of each safety rule in a firewall is determined by analyzing FLOW information and SYSLOG information of the firewall, sorting operation from large to small is carried out in allusion to the data traffic, and the sorted safety rules are pushed back to the firewall. Thus, safety rules such as heavy matched traffic and high frequency are adjusted to the forefront of a safety rule list. Based on a present matching mode of the safety rule list from top to bottom, firewall rule matching efficiency is raised after the safety rule list is adjusted.

Description

technical field [0001] The invention relates to network and information security technologies, in particular to a method and device for optimizing firewall security rules. Background technique [0002] A firewall is a combination of software and hardware devices, and is a protective barrier constructed between the internal network and the external network. It can allow or restrict the passage of transmitted data according to specific security rules, and protect the internal network from unauthorized users. intrusion. These security rules are usually defined or modified by network administrators. [0003] For enterprise-level firewall devices, as the configuration increases, the security rules will become more and more complex. In addition, there are multiple network administrators in the enterprise, resulting in difficulties in firewall management and configuration and logical confusion. When the data traffic reaches the firewall device, the firewall device always searches...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to propose a method and device for optimizing firewall security rules, which can solve the problems of low working efficiency and potential safety hazards of firewall equipment by optimizing the security rules of firewall equipment

Images