Firewall policy optimization method, system and computer-readable storage medium

Abstract

The invention provides a firewall policy optimization method, system and computer-readable storage medium. Wherein, the firewall policy optimization method includes: obtaining all policies of the firewall, generating a first list; obtaining the number of hits of each policy, and generating a second list based on the number of hits sorted from large to small; taking out the policies one by one from the second list, And judge whether the ranking number of the strategy in the second list is less than the ranking number in the first list; Based on the judgment result that the ranking number of the strategy in the second list is less than the ranking number in the first list, The ranking of policies in the first list is optimized; according to the optimized ranking number of each policy, a third list is generated for the firewall to perform policy matching on data packets according to the ranking order in the third list. Through the firewall policy optimization method of the present invention, the policy optimization can be carried out aiming at the use of the hit number intelligent identification policy, and the overall performance and efficiency of the firewall are greatly improved.

Description

Firewall policy optimization method, system and computer-readable storage medium technical field The present invention relates to network security technical field, specifically, relate to a kind of firewall policy optimization method, a kind of prevention A firewall policy optimization system, and a computer-readable storage medium. Background technique [0002] In traditional telecommunications operators, e-government, and mobile Internet companies, firewalls are in use due to Many business rules on the network are often configured with a lot of firewall policies, and after the policy configuration, they often cannot be arbitrarily configured. Delete, if the deletion is wrong, the service access will be abnormal. For the firewall policy configuration, only adding but not deleting is already OK. industry de facto standard. Based on this contradiction, there will be more and more firewall policies, and some core firewall policies often reach the Ten thousand rules. ...

AI Technical Summary

Problems solved by technology

With more and more rules, the efficiency and performance of the firewall will be lower and lower, because the data packets need to match more and more rules, and the following rules will not be matched until the matching rules are matched.

Images