Decision tree-based firewall policy conflict detection method

A technology of firewall policy and conflict detection, which is applied in the field of network security, can solve problems such as slow detection speed, achieve the effects of reducing the number of judgments, avoiding policy traversal comparison, and reducing the number of policies

CN105743871AActive Publication Date: 2016-07-06STATE GRID CORP OF CHINA +5
4 Cites 12 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Publication Date
2016-07-06

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

The invention relates to a decision tree-based firewall policy conflict detection method. The method includes the following steps that: decision tree transformation is performed on each rule in a firewall rule set; the rules are stored in a tree data structure form; and each policy is corresponding to a unique path in a tree. With the method provided by the technical schemes of the invention adopted, defects in an existing decision tree-based firewall policy conflict detection method can be eliminated, and the time complexity of the method of the invention can be reduced, and conflict detection efficiency can be greatly improved.
Need to check novelty before this filing date? Find Prior Art

Description

technical field

[0001] The invention relates to the technical field of network security, in particular to a decision tree-based firewall policy conflict detection method. Background technique

[0002] In the era of knowledge economy and information resource sharing, the Internet is developing vigorously and getting closer to all aspects of social life. The attendant threats are inevitable, and the related technologies are getting better and better. Therefore, the maintenance of network security is particularly important, and the setting of a firewall is an effective measure for computer network security maintenance.

[0003] The firewall is an integral part of the network system. It controls the unsafe data packets trying to enter the internal security network and the outside world through clear security policies. It can selectively block bad information and set access rights to external sites. When there is access, the system Automatically audit access rights, identify ba...

Examples

Embodiment Construction

[0044] The specific implementation manners of the present invention will be further described in detail below in conjunction with the accompanying drawings.

[0045]In view of the problem of slow detection speed caused by too many judgment sentences in the existing method, the embodiment of the present invention uses a tree structure to store and classify strategies based on the existing method, so as to reduce the number of judgments and avoid In addition to the strategy traversal comparison, it is even possible to directly detect whether there is a duplicate path in the tree, which saves the comparison of obvious conflict redundant strategies, and thus can achieve the effect of conflict detection faster.

[0046] Such as figure 2 As shown, it is the implementation principle flow of the method for detecting firewall policy conflicts in the embodiment of the present invention. It mainly includes the following steps:

[0047] Step 201, initialize the storage tree; when inser...