Improvement method of firewall adaptive capability based on rule lifecycle detection

Abstract

The invention relates to a firewall adaptive ability improvement method based on rule life cycle detection, and belongs to the technical field of computer and information sciences. The firewall adaptive ability improvement method comprises the steps of: firstly, carrying out extraction on data packet information in a firewall log, which is matched with a default rule for multiple times, generatingnew firewall rules according to the data packet information, carrying out merging on the newly generated rules, and adding the new rules which meet conditions into a rule set; then capturing data packets reaching a firewall, carrying out intrusion behavior detection on legal data packets, if an intrusion behavior exists, generating alarm information, generating new rules according to the information, and adding the new rules into the rule set; and finally, regularly carrying out life cycle detection on the new rules, and timely deleting rules of which life cycles are ended. According to the invention, in a case of not affecting a firewall policy, two methods of log analysis and intrusion detection are respectively adopted to generate the firewall rules, and a rule cycle detection mechanism is added, so that a problem of bloated rule set caused by excessive new rules is solved, average matching times of the data packets are reduced, filtering efficiency of the firewall is improved, andthe adaptive ability of the firewall is effectively implemented.

Description

technical field [0001] The invention relates to a method for improving the self-adaptive ability of a firewall based on rule life cycle detection, and belongs to the technical field of computer and information science. Background technique [0002] With the rapid development of network technology, it has brought convenience to our work and life, but various network security issues have also emerged. As an important tool to ensure network security, the performance of firewalls should also be continuously improved to adapt to current network conditions. So far, the trigger conditions for firewall rule generation are relatively single; at the same time, the existing firewall technology only considers the generation of firewall rules, but with more and more new rules, the number of invalid matches is also increasing, which eventually leads to a decrease in firewall filtering efficiency . Therefore, the present invention will provide a firewall self-adaptive capability improvem...

AI Technical Summary

Problems solved by technology

[0009] The purpose of the present invention is to solve the problem of reduced firewall filtering efficiency caused by the single trigger condition of firewall rules and the inability to dynamically delete new rules, so a method for improving the self-adaptive ability of firewalls based on rule life cycle detection is proposed

Images