Firewall policy optimization method, device, equipment and storage medium

Abstract

The present invention discloses a firewall policy optimization method, apparatus, device, and storage medium. The method comprises: collecting traffic data passing through the firewall, analyzing the collected traffic data, removing exploratory attack traffic from the traffic data to obtain a real traffic set; obtaining a policy configuration file in the firewall, parsing the policy configuration file to obtain an initial policy set for the firewall; performing a matching analysis between the real traffic set and the initial policy set to generate a traffic hit policy, and optimizing the initial policy in the initial policy set based on the traffic hit policy. This solution can eliminate the interference of exploratory attack traffic, audit and optimize firewall policies using only real business traffic, improve the accuracy of firewall policy auditing and optimization, and achieve dynamic auditing and continuous optimization of firewall policies.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a firewall policy optimization method, device, terminal equipment and storage medium. Background Art

[0002] With the increasing popularity of the Internet, people can easily obtain information and resources through the Internet, but they are also often attacked by viruses and hackers. Network security has also received more and more attention and attention. As an effective means of protecting network security, firewalls can build a relatively isolated protection barrier between the intranet and the extranet of a computer network to protect user data and information security. With the gradual increase in the number of firewall devices, the number of configuration policies on the firewall is huge and is still growing. The massive configuration of complex policies has brought huge challenges to the optimization and management of firewall policies. At present, some firewall policy auditing and optimization methods are disclosed in the existing technical solutions. For example, patents with application numbers 201910139126.X and 201410796184.7 both disclose a policy optimization device and method. Among them, the former splits the initial policy of the firewall into multiple sub-policies, determines the hit count of each sub-policy based on the collected traffic logs, and then audits the initial policy and outputs the audit results. The latter obtains the intermediate policy by splitting and flattening the source address set, destination address set, etc. in the initial policy of the firewall, and uses the intermediate policy to match the index traffic log and generate multiple hit policies, and generates an optimization plan for the initial policy based on the generated hit policies.

[0003] However, the traffic records used in these existing technologies all come from the firewall's built-in traffic recording module. Given the massive volume of service traffic in real-world scenarios, using the firewall's built-in traffic recording module would consume a significant amount of the firewall's storage space, impacting its performance. More importantly, when analyzing service traffic in the firewall's built-in traffic recording module, it is unable to distinguish between service traffic and exploratory attack traffic, treating exploratory attack traffic as service traffic. This interferes with the initial policy optimization solution and affects the accuracy of policy optimization. Summary of the Invention

[0004] The main purpose of the present invention is to provide a firewall policy optimization method, device, equipment and storage medium, aiming to audit and optimize the firewall policy using real business traffic without affecting the performance of the firewall itself, and to continuously and dynamically optimize the firewall policy based on the audit results to improve the accuracy of policy optimization.

[0005] To achieve the above objectives, an embodiment of the present invention provides a firewall policy optimization method, which includes the following steps:

[0006] Collecting traffic data passing through the firewall, analyzing the collected traffic data, and removing tentative attack traffic from the traffic data to obtain a real traffic set;

[0007] Obtaining a policy configuration file in the firewall, and parsing the policy configuration file to obtain an initial policy set of the firewall;

[0008] A matching analysis is performed on the real traffic set and the initial policy set to generate a traffic hit policy, and the initial policy in the initial policy set is optimized according to the traffic hit policy.

[0009] In addition, an embodiment of the present invention further provides a firewall policy optimization device, the device comprising:

[0010] A traffic collection and analysis module is used to collect traffic data passing through the firewall, analyze the collected traffic data, and remove tentative attack traffic from the traffic data to obtain a real traffic set;

[0011] A policy parsing module is used to obtain a policy configuration file in the firewall and parse the policy configuration file to obtain an initial policy set of the firewall;

[0012] The policy optimization module is used to perform matching analysis on the real traffic set and the initial policy set, generate a traffic hit policy, and optimize the initial policy in the initial policy set according to the traffic hit policy.

[0013] In addition, an embodiment of the present invention also proposes a terminal device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the firewall policy optimization method described above is implemented.

[0014] In addition, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the firewall policy optimization method described above is implemented.

[0015] In addition, an embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the firewall policy optimization method described above is implemented.

[0016] The firewall policy optimization method, apparatus, terminal device, and storage medium proposed in the embodiments of the present invention collect traffic data passing through the firewall and analyze the collected traffic data, eliminating exploratory attack traffic from the traffic data to obtain a real traffic set; obtain a policy configuration file in the firewall, and parse the policy configuration file to obtain the firewall's initial policy set; perform a matching analysis on the real traffic set and the initial policy set to generate a traffic hit policy, and optimize the initial policy in the initial policy set based on the traffic hit policy. By eliminating exploratory attack traffic, using real business traffic to generate a traffic hit policy for the firewall's initial policy, and optimizing the initial policy based on the generated traffic hit policy, the interference of exploratory attack traffic on policy optimization is reduced. Compared with the existing static auditing and optimization solutions, on the one hand, the traffic data passing through the firewall is collected from the terminal devices connected before and after the firewall, which reduces the storage space occupied by the firewall itself for traffic recording and ensures the performance of the firewall itself. On the other hand, the offensive probing traffic can be distinguished from the collected traffic data and eliminated, and only the real business traffic is used to audit and optimize the firewall policy, thereby reducing the interference of probing attack traffic on policy auditing and optimization, improving the accuracy of policy auditing and optimization, and realizing dynamic auditing and continuous optimization of firewall policies. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a schematic diagram of the functional modules of the terminal device to which the firewall policy optimization device of the present invention belongs;

[0018] Figure 2 A flowchart of an exemplary embodiment of a method for optimizing firewall policies according to the present invention;

[0019] Figure 3 A schematic diagram of the traffic flow process in an exemplary embodiment of the firewall policy optimization method of the present invention;

[0020] Figure 4 This is a schematic diagram of traffic duration distribution in an exemplary embodiment of the firewall policy optimization method of the present invention;

[0021] Figure 5 A flowchart of another exemplary embodiment of the firewall policy optimization method of the present invention;

[0022] Figure 6 A flowchart of another exemplary embodiment of the firewall policy optimization method of the present invention;

[0023] Figure 7 A detailed flowchart of an embodiment of the firewall policy optimization method of the present invention;

[0024] Figure 8This is a functional module diagram of an embodiment of a firewall policy optimization device of the present invention.

[0025] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0026] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0027] The main solution of the embodiment of the present invention is: collecting traffic data passing through the firewall, analyzing the collected traffic data, eliminating the tentative attack traffic from the traffic data to obtain a real traffic set; obtaining the policy configuration file in the firewall, and parsing the policy configuration file to obtain the initial policy set of the firewall; matching and analyzing the real traffic set and the initial policy set to generate a traffic hit policy, and optimizing the initial policy in the initial policy set based on the generated traffic hit policy. Thus, by collecting traffic data passing through the firewall from the terminal devices connected before and after the firewall, the storage space occupied by the firewall itself for traffic recording is reduced, the performance of the firewall itself is guaranteed, and the aggressive tentative traffic can be distinguished from the collected traffic data and eliminated, thereby reducing the interference of the tentative attack traffic on the policy optimization scheme. Compared with the existing static audit and optimization scheme, on the one hand, the accuracy of policy optimization can be improved, and on the other hand, continuous optimization of the firewall policy can be achieved.

[0028] Technical terms involved in the embodiments of the present invention:

[0029] Firewall: A technology that combines security management and screening software and hardware to create a relatively isolated protective barrier between the internal and external computer networks, protecting user data and information. The most basic function of a firewall is to ensure the legitimacy of network traffic and promptly identify and address potential security risks and data transmission issues during network operation. These measures include isolation and protection, as well as logging and monitoring of various network security operations to ensure the security of network operations and safeguard the integrity of user data and information, providing users with a better and more secure network experience.

[0030] Firewall policy: A firewall policy generally refers to a firewall's security policy. It's a basic security control mechanism that checks data flows according to specific rules. Essentially, these rules filter data flows (or packets). The primary function of a security policy is to verify data flows passing through the firewall, ensuring that only legitimate data flows that comply with the security policy can pass through. Firewall security policies can be used to control intranet access to the extranet, control access rights between intranet subnets with different security levels, and control access to the device itself.

[0031] The present invention addresses the problem that existing solutions typically utilize traffic logs collected from the firewall's built-in traffic recording module to perform traffic analysis and generate targeted strategies and optimization solutions. These solutions only allow for static auditing of firewall policies based on the business traffic in the traffic logs, and are unable to effectively utilize the audit results to continuously optimize firewall policies. Furthermore, when analyzing the collected traffic logs, it is impossible to distinguish between exploratory attack traffic and actual business traffic. Consequently, when generating targeted strategies and optimization solutions, the interference of exploratory attack traffic cannot be eliminated, thereby affecting the accuracy of firewall policy optimization.

[0032] Therefore, an embodiment of the present invention proposes a solution by directly collecting the traffic passing through the firewall from the terminal devices connected before and after the firewall, thereby reducing the occupation of the firewall storage space by the traffic log. At the same time, when performing traffic analysis, the interference of tentative attack traffic is eliminated, and only real business traffic is used to generate traffic hit strategies and optimization plans, thereby reducing the interference of tentative attack traffic, improving the accuracy of firewall policy optimization, and realizing dynamic auditing and continuous optimization of firewall policies.

[0033] Specifically, refer to Figure 1 , Figure 1 This is a schematic diagram of the functional modules of a terminal device to which the firewall policy optimization device of the present invention belongs. The firewall policy optimization device can be a device independent of the terminal device that can perform firewall policy optimization calculations in mobile scenarios. It can be hosted on the terminal device in the form of hardware or software. The terminal device can be a smart mobile terminal such as a mobile phone or tablet computer.

[0034] In this embodiment, the terminal device to which the firewall policy optimization apparatus belongs includes at least an output module 110 , a processor 120 , a memory 130 and a communication module 140 .

[0035] The memory 130 stores an operating system and a firewall policy optimization program. The firewall policy optimization device can store collected traffic data and other information in the memory 130. The output module 110 can be a display screen, a speaker, etc. The communication module 140 can include a Wi-Fi module, a mobile communication module, and a Bluetooth module, etc., and communicates with external devices or servers through the communication module 140.

[0036] As an embodiment, the firewall policy optimization program in the memory 130 implements the steps of the following embodiments of the firewall policy optimization method when executed by the processor.

[0037] For details, please refer to Figure 2 , Figure 2 This is a flow chart of a first embodiment of a firewall policy optimization method according to an embodiment of the present invention. In this embodiment, the firewall policy optimization method includes the following steps:

[0038] Step S10, collecting traffic data passing through the firewall, analyzing the collected traffic data, and removing the tentative attack traffic from the traffic data to obtain a real traffic set;

[0039] In this embodiment, unlike existing methods that collect traffic logs from the firewall's built-in traffic recording module, traffic data is collected directly from the terminal devices connected to the front-end and back-end of the firewall, thereby obtaining the traffic passing through the firewall. The terminal devices connected to the front-end and back-end of the firewall include switches and routers. When collecting traffic data passing through the firewall, data is collected from the terminal devices connected to the front-end and back-end of the firewall. In this embodiment, the terminal device connected to the front-end of the firewall is denoted as switch or router A (device A), and the terminal device connected to the back-end of the firewall is denoted as switch or router B (device B).

[0040] A simplified diagram of the traffic flow process between device A and device B is shown below: Figure 3 As shown, in Figure 3 In this scenario, traffic is first sent to device A. Part of the traffic on device A is sent through the firewall to device B, while the remaining part is sent elsewhere. Device B receives traffic that comes partly from device A through the firewall and partly from elsewhere. Traffic from devices A and B is collected in real time using mirrored traffic to generate traffic data for analysis. It should be noted that the collected traffic data can be from different terminal devices and can include different types of data streams, such as transmitted data and access requests.

[0041] Because the traffic collected by the switches or routers and other network devices connected to the front and back ends of the firewall includes not only the traffic passing through the firewall, but also the traffic sent to and / or from other places, for example, Figure 3 The traffic sent from device A to other places, and the traffic from other places in device B, need to be removed to eliminate the interference traffic and obtain the real traffic passing through the firewall. Specifically, when different terminal devices are communicating or transmitting data, they generally carry identification information of both parties. This identification information includes source MAC address, destination MAC address, source IP address, destination IP address, source port, destination port, protocol and other information. Among them, source MAC address, source IP address, source port, etc. are the identification information of the sending end, and destination MAC address, destination IP address, destination port, etc. are the identification information of the receiving end. Furthermore, the source IP address, destination IP address, source port, destination port and protocol are the five-tuples that distinguish and define network traffic. The collected traffic data is analyzed and matched through the five-tuple information. If the five-tuple information in device A and device B is consistent, it can be considered to be the same traffic passing through the firewall. Furthermore, there may be multiple flows with the same five-tuple information in the traffic of device A and device B. However, after the same flow is sent from device A, the time it takes for device B to receive it through the firewall is relatively short. Therefore, the flows can be distinguished based on the difference in time between when the multiple flows are sent from device A and when they are received by device B. The flows with the smaller difference in time are the same. It is understandable that when collecting traffic data from device A and device B, the collected traffic data can include the time points when each flow is sent from device A and the time points when it is received by device B. Therefore, by matching and analyzing the five-tuple information and the time points of traffic collection, it is possible to analyze which of the flows collected from device A and device B are flows sent from device A to device B through the firewall and which are flows from other places. This allows the interference traffic to be eliminated and the traffic that has passed the firewall to be obtained.

[0042] Furthermore, the traffic passing through the firewall is not necessarily all real business traffic, but may also include tentative attack traffic. It is understandable that tentative attack traffic generally has relatively obvious characteristics, such as traffic duration is significantly shorter than normal business traffic. Therefore, the traffic passing through the firewall can be further screened and filtered by distinguishing characteristics such as traffic duration to identify tentative attack traffic, and the identified tentative attack traffic can be removed from the collected traffic data to obtain a real traffic set that only contains real business traffic, which includes multiple real business flows passing through the firewall.

[0043] Step S20, obtaining a policy configuration file in the firewall, and parsing the policy configuration file to obtain an initial policy set of the firewall;

[0044] Obtain the firewall's policy configuration file, which contains the configuration information and policy information of each firewall policy. The policy information includes policy entries that can be defined by each policy, such as five-tuple information of source address, source port, destination address, destination port and protocol; the configuration information includes multiple rule sets such as source address set, source port set, destination address set and destination port set configured in the policy entry of each policy. The rule set is a collection of feature information configured in the policy entry of each policy. For example, the source address set is a collection of source addresses defined in the firewall policy.

[0045] The obtained configuration file is parsed to obtain the initial policy set of the firewall. The initial policy set includes multiple initial policies of the firewall. The parsing of the configuration file is mainly to parse each rule set in the firewall configuration information into a single rule object. Taking the source address set as an example, the source address set configured in the firewall policy is "DM_INLINE_NETWORK_187", which includes multiple source addresses (192.168.128.75, 192.168.237.166, 192.168.237.188, 192.168.237.37). The source address set is parsed to obtain multiple single source addresses such as "192.168.128.75", "192.168.237.166", "192.168.237.188", and "192.168.237.37". After parsing each rule set in the configuration information, a single rule object is obtained, and then the initial policy of the firewall and the initial policy set composed of each initial policy are obtained.

[0046] Step S30: performing a matching analysis on the real traffic set and the initial policy set, generating a traffic hit policy, and optimizing the initial policy in the initial policy set according to the traffic hit policy.

[0047] After obtaining the firewall's initial policy set, the initial policy set is matched against the real traffic set to generate a traffic hit policy. Specifically, when matching the initial policy set against the real traffic set, each flow in the real traffic set is matched against each initial policy in the initial policy set, determining the initial policy that each real traffic flow hits, and generating a corresponding traffic hit policy. The generated traffic hit policy has a one-to-one correspondence with the real traffic in the real traffic set, and the generated traffic hit policy contains both the initial policy information and the real traffic information.

[0048] Furthermore, the configuration information of an initial policy may contain multiple source addresses, source ports, destination addresses, destination ports, etc., but the source address, source port, destination address and destination port, etc. in a flow are generally one. Therefore, the generated traffic hit policy also includes information such as the source address, source port, destination address and destination port of the initial policy hit by real traffic.

[0049] Based on the generated traffic hit strategy, an optimization rule is generated to optimize each initial strategy in the initial strategy set, and optimization is performed according to the rule. The optimization rule includes deleting or invalidating invalid strategies that are not hit, merging duplicate or conflicting redundant strategies, and regrouping and integrating each initial strategy to form a new strategy. It can be understood that in this embodiment, the traffic data collected in real time can be analyzed immediately, and the traffic data collected within a preset time period can also be analyzed, so as to match and analyze the collected real traffic with the initial strategy in the firewall, generate a traffic hit strategy based on the matching results, and then optimize the initial strategy of the firewall based on the generated traffic hit strategy, so as to achieve continuous optimization or periodic continuous optimization of the initial strategy of the firewall.

[0050] In this embodiment, traffic data passing through the firewall is collected from terminal devices connected before and after the firewall; the collected traffic data is analyzed, and tentative attack traffic is removed from the traffic data to obtain a real traffic set; a policy configuration file in the firewall is obtained and parsed to obtain an initial policy set for the firewall; a matching analysis is performed between the real traffic set and the initial policy set to generate a traffic hit policy, and the initial policy in the initial policy set is optimized based on the traffic hit policy. By removing the tentative attack traffic, using the real business traffic to generate a traffic hit policy for the firewall's initial policy, and optimizing the initial policy based on the generated traffic hit policy, the interference of tentative attack traffic on policy optimization is reduced. Compared with the existing static auditing and optimization solutions, on the one hand, the traffic data passing through the firewall is collected from the terminal devices connected before and after the firewall, which reduces the storage space occupied by the firewall itself for traffic recording and ensures the performance of the firewall itself. On the other hand, the offensive probing traffic can be distinguished from the collected traffic data and eliminated, and only the real business traffic is used to audit and optimize the firewall policy, thereby reducing the interference of probing attack traffic on policy auditing and optimization, improving the accuracy of policy auditing and optimization, and realizing dynamic auditing and continuous optimization of firewall policies.

[0051] Furthermore, based on the above Figure 3The first embodiment shown in the figure proposes a second embodiment of the firewall policy optimization method of the present invention. This embodiment is a refinement of the above-mentioned step S10. Based on the above-mentioned embodiment, in this embodiment, the collected traffic data includes front-end traffic and back-end traffic collected from terminal devices connected to the front-end and back-end of the firewall, respectively. The front-end traffic is collected from the terminal device connected to the front-end of the firewall (i.e., device A in the above-mentioned embodiment), and the back-end traffic is collected from the terminal device connected to the back-end of the firewall (i.e., device B in the above-mentioned embodiment). The refinement of step S10 in the above-mentioned embodiment includes the following steps:

[0052] Step S1001, extracting characteristic information, flow duration and time point of each flow from the collected flow data;

[0053] This embodiment refines the steps for eliminating exploratory attack traffic. When eliminating exploratory attack traffic passing through the firewall, the characteristic information of each flow is first extracted from the collected traffic data. This characteristic information includes the five-tuple information of the source address, source port, destination address, destination port, and protocol. The time point and flow duration of each flow are also extracted. The time point of the flow includes the time point when the flow is received by the firewall front-end device, the time point when the flow enters and exits the firewall, and the time point when the flow is received by the firewall back-end device. Furthermore, the time point may also include the time point when the flow is generated and the time point when the flow is collected, which are not specifically limited here. It can be seen that the time point of the front-end flow is different from the time point of the back-end flow. The time point of the front-end flow may include the time point when the flow is generated, the time point when the flow is received by the front-end device, the time point when the flow is collected by the front-end device, and the time point when the flow enters the firewall. The time point of the back-end flow may include the time point when the flow exits the firewall, the time point when the flow is received by the back-end device, and the time point when the flow is collected from the back-end device. Traffic duration is the duration of the traffic. As we know, business traffic has to wait for the server to respond to the business request, so the traffic will last for a certain period of time. In addition, the same business may continue to send requests within a certain period of time, resulting in the presence of multiple identical business traffic sent at different time points in the collected traffic data.

[0054] Step S1002: merging the front-end traffic and the back-end traffic with the same characteristic information and a time difference less than a preset time difference threshold to obtain a first traffic set;

[0055] Based on the characteristic information of each flow, the same flow in the front-end and back-end flows that passes through the firewall is determined. Specifically, first, the characteristic information of the flow collected from the front-end and the flow collected from the back-end must be the same, and the difference in time points between the two flows must be less than a preset time difference threshold. This time difference is the difference between the time points of the front-end flow and the time points of the back-end flow. In this embodiment, the flow in the front-end and back-end devices of the firewall is collected in real time. Therefore, the time point of flow collection is substantially the same as the time point of reception by the front-end and back-end devices of the firewall. For ease of explanation, this embodiment uses the difference in the collection time points of the front-end and back-end flows as an example, and uses a time difference threshold of 10ms as an example. In the front-end and back-end flows, flows with the same characteristic information and a collection time difference of less than 10ms are considered to be the same flow that passes through the firewall. The same flow in the front-end and back-end flows is merged into one flow, resulting in a first flow set.

[0056] It can be understood that the use of the time point difference and the time difference threshold to determine whether two flows with the same characteristic information in the front-end and back-end flows are the same flow that passes through the firewall is to distinguish the same business flows generated or collected at different time points. Generally, the difference in the time points of the front-end and back-end flow collection is the length of time it takes for the flow to be sent from the front-end device and then passed through the firewall and received by the back-end device. For the same flow that passes through the firewall, the difference in the time points of collection is not large, and the difference in the time points of each collected flow is not much different. If the difference between the collected time points is large, it is the same business flow collected at different time points, not the same business flow. The time difference threshold can be obtained by mining and analyzing the collected historical flow data. The time difference threshold of the employees in this embodiment is only used to illustrate the embodiment of the present invention and is not used to limit the present invention.

[0057] Step S1003: Fitting the traffic duration distribution of the traffic data using a chi-square test, and determining a traffic duration threshold based on the best fit, wherein the traffic duration threshold is used to distinguish between real traffic and tentative attack traffic;

[0058] Furthermore, after confirming that the same traffic is collected from the front and back ends of the firewall, the chi-square test is used to identify the tentative attack traffic and the real business traffic, and the tentative attack traffic is eliminated to obtain the real traffic set containing only the real business traffic. Figure 4 , Figure 4 This is a schematic diagram of the traffic duration distribution of real traffic and tentative attack traffic in this embodiment. Figure 4 The traffic distribution shown in Figure 4The traffic duration distribution shown shows that the traffic duration distribution of real business traffic differs significantly from that of exploratory traffic. Therefore, a chi-square test is used to calculate the goodness of fit between the distribution of the test sample and the hypothesized distribution. First, a portion of traffic data is selected from the traffic passing through the firewall as the test sample. The distribution of each flow is calculated using the traffic duration as the X-axis and the frequency of traffic as the Y-axis. The distribution is then compared with the hypothesized distribution, and the solution with the best fit is finally used as the traffic duration threshold. The traffic duration threshold is used to distinguish real traffic from exploratory attack traffic. Traffic with a traffic duration exceeding the traffic duration threshold is considered real traffic, while traffic with a duration less than the traffic duration threshold is considered the exploratory attack threshold.

[0059] Step S1004: Select a flow from the first flow set as a target flow. If the flow duration of the target flow is greater than the flow duration threshold, save the target flow as a real flow, and return to and execute the step of selecting a flow from the first flow set as the target flow until the target flow is the last flow in the first flow set.

[0060] Step S1005: If the traffic duration of the target traffic is less than or equal to the traffic duration threshold, the target traffic is eliminated as a tentative attack traffic, and the process returns to and executes the step of selecting a traffic from the first traffic set as the target traffic until the target traffic is the last traffic in the traffic set.

[0061] Furthermore, when eliminating exploratory attack traffic, a flow is first selected from the first flow set as the target flow. A determination is made as to whether the flow duration of the target flow exceeds a flow duration threshold. If so, the target flow is saved as real traffic. The process then returns to the step of selecting a flow from the first flow set as the target flow, and this process continues until the selected target flow is the last flow in the first flow set. If the flow duration of the target flow is less than or equal to the flow duration threshold, the target flow is eliminated as exploratory attack traffic. The process then returns to the step of selecting a flow from the first flow set as the target flow, and a new flow is selected from the first flow set as the target flow, until the selected target flow is the last flow in the first flow set. This cycle continues, inspecting each flow in the first flow set that passes through the firewall. If exploratory attack traffic is detected, it is eliminated, and normal real business traffic is saved, ultimately resulting in a real traffic set containing only real business traffic. Generating a traffic hit policy based on real traffic can eliminate interference from exploratory traffic, thereby improving the accuracy of optimizing the initial firewall policy.

[0062] In this embodiment, traffic analysis is performed on the collected traffic data, and the chi-square test is used to determine the traffic duration threshold. Based on the traffic duration threshold, the tentative attack traffic is eliminated to obtain a real traffic set that only contains real traffic. The traffic hit strategy generated based on the real traffic set can eliminate the interference of tentative traffic, thereby improving the audit and optimization accuracy of the firewall initial strategy.

[0063] Furthermore, when extracting the characteristic information of traffic packets, in addition to extracting the traditional five-tuple characteristic information, traffic packet characteristics such as traffic duration and time point are also extracted to ensure that the traffic used to generate the traffic hit strategy is the traffic passing through the firewall, and the chi-square statistics and the distribution characteristics of the actual business traffic are used to perform a fit test to find the solution with the best fit, thereby eliminating tentative attack traffic from the traffic, ensuring that all traffic is real business traffic, and greatly reducing the amount of traffic data that needs to be analyzed.

[0064] Reference Figure 5 , Figure 5 This is a flowchart of another exemplary embodiment of the firewall policy optimization method of the present invention. Based on the first and / or second embodiments above, a third embodiment of the firewall policy optimization method of the present invention is proposed. This embodiment is a refinement of step S20 in the above embodiments, including:

[0065] Step S2001, extracting firewall configuration information and policy information of each initial policy of the firewall from the policy configuration file, wherein the configuration information includes a rule set defined in the firewall;

[0066] This embodiment is a refinement of the steps of parsing the obtained firewall policy configuration file to obtain the initial policy set of the firewall in the above embodiment. Specifically, the firewall policy configuration file is used to define the initial policy of the firewall. The policy items that need to be defined in the initial policy are policy information, and the information configured in each policy item is configuration information. The policy items that need to be configured for each initial policy include source address, destination address, source port, destination port, protocol, execution action (allow / deny), and activation status of the policy. When parsing the policy configuration file, the configuration information and policy information of the firewall initial policy are first extracted from the policy configuration file. The firewall policy information includes policy items such as addresses and ports that need to be defined for each policy. The configuration information of the firewall policy includes the rule set defined in each policy item. The rule set includes an address set, a port set, and a protocol set. Among them, the address set includes a source address set and a destination address set, and the port set includes a source port set and a destination port set. Taking the source address set as an example, the source address set defined in the firewall can include a source address group consisting of multiple source addresses, or a single source address object. Each source address group or source address object corresponds to an initial policy. In each policy of the firewall, the configuration of the source address and destination address can be an address group containing multiple addresses or a single address object. The configuration of the source port and destination port can be a group port group containing multiple ports or a single port object.

[0067] Step S2002: parsing the rule set in the configuration information to obtain detailed firewall configuration rules;

[0068] After extracting the configuration information and policy information from the configuration file, the rule set in the configuration information is parsed to obtain the corresponding rule details. Referring to Table 1 below, Table 1 is an example of the parsing results of the source address set, destination address set, and destination port set in the rule set in this embodiment. In this embodiment, the parsing of the firewall configuration file is different from the existing technology. It no longer splits the original firewall initial policy into a single source and destination address (source address and destination address) and source and destination port (source port and destination port) and then generates multiple rules by free arrangement and combination. Instead, the rule set in the initial policy is parsed into a single object to obtain the corresponding rule details, ensuring the integrity of the original policy rules, effectively reducing the amount of data after parsing and improving the performance of policy parsing. When the firewall policy changes, the changed policy rules can be parsed in a very short time, thereby ensuring the correctness and timeliness of the matching analysis of the policy and traffic.

[0069]

[0070] Table 1

[0071] Step S2003: determining the activation status of each initial policy of the firewall according to the policy information, wherein the activation status includes activated and inactivated;

[0072] Step S2004: According to the rule details, the target rules of each initial policy whose activation state is activated are determined to obtain the initial policy set of the firewall.

[0073] After parsing the rule set, the activation status of each initial policy is determined based on its policy information. The activation status includes activated and inactivated. The initial policy with activated activation status is selected. Based on the policy information of each activated initial policy, the target rules defined in each initial policy are determined from the parsed rule details to obtain the initial policy set. There can be multiple target rules. The initial policies in the initial policy set are activated policies. Inactivated policies are not effective in the firewall and therefore will not be hit by traffic. Therefore, when generating traffic hit policies, inactivated initial policies can be ignored, thereby reducing the number of traffic matches and the amount of computation.

[0074] Further, referring to Table 2, Table 2 is an example of an initial policy set after parsing, and the initial policy set includes parsed data of multiple initial policies. When parsing the configuration file, first select a policy from each initial policy to determine whether the activation status of the policy is activated. If not, select the next initial policy. If so, determine the target rule defined in the policy information of the initial policy based on the parsed rule details, and then obtain the parsed initial policy. In this embodiment, the network segment / subnet in the source and destination addresses, and the port range of the source and destination ports are refined into separate addresses and ports to facilitate the subsequent matching analysis and calculation of policies and traffic. When performing matching analysis of firewall policies and traffic, the parsed data of the parsed initial policy is stored in the static cache in the format of Table 2, which can improve computing efficiency and reduce the amount of storage space occupied.

[0075] As can be seen from Table 2, this embodiment parses each rule set in the initial policy into a single rule object. A randomly selected piece of data from the parsed data of each rule set of the initial policy is combined to obtain a policy rule for the initial policy. Traditional firewall policy parsing methods involve splitting the rule objects in each rule set of the initial policy and then permuting and combining them according to all possible combinations to generate multiple policy rules. Alternatively, partial rule sets within each rule set are split to obtain sub-policies of the initial policy. Taking the source address set (source address 1, source address 2) and the destination address set (destination address 1, destination address 2) as examples, in this embodiment, the source address set and the destination address set are parsed separately to obtain single rule objects "source address 1," "source address 2," "destination address 1," and "destination address 2." During matching analysis, the source address of the actual traffic is matched with "source address 1" and "source address 2," respectively, and the destination address of the actual traffic is matched with "destination address 1" and "destination address 2," respectively. The traditional method of parsing the initial policy is to split the rule set to obtain the policy rules of the initial policy, such as "source address 1, destination address 1", "source address 2, destination address 1", "source address 1, destination address 2" and "source address 2, destination address 2", or to split part of the rule set in the rule set to obtain the sub-policies of the initial policy, such as "source address 1, (destination address 1, destination address 2)" and "source address 2, (destination address 1, destination address 2)". In the above two traditional policy parsing methods, it is necessary to extract the characteristic information of the traffic and then match it one by one with each policy rule in each initial policy according to the combination of "source address, destination address", and the matching efficiency is low. Moreover, if the combination of each rule object is incomplete, it may affect the integrity of the rules of the initial policy. Compared with the traditional policy parsing method, the policy parsing method in this embodiment simplifies the parsing process, and can ensure the integrity of the rules of the initial policy, reduce the amount of calculation and improve the matching efficiency.

[0076]

[0077] Table 2

[0078] In this embodiment, the configuration information in the configuration file of the firewall is parsed to obtain the rule details of the initial policy, and the individual target rules of the initial policy are determined based on the parsed rule details. The initial policy is no longer split. Compared with the existing technology, the data set in the initial policy is split and combined into new policy rules, or the initial policy is split into multiple sub-policies. This embodiment not only ensures the integrity of the initial policy rules, but also reduces the amount of data after parsing. Specifically, traditional firewall policy optimization methods all require the original policy to be parsed into multiple sub-policies (or rules). When the policy rule set is large, the decomposition of the original policy is not only time-consuming and occupies a large amount of storage space, but also reduces the matching efficiency with the traffic data. For example, the source IP address and destination IP address in the original policy are 10 each. 4 When the sub-strategies are expanded, they will reach 10 4 ×10 4 =10 8 In view of this situation, this embodiment no longer splits the original policy, but ensures the initial state of the original policy, and only decomposes the rule sets such as source IP address set, destination IP address set and port set into a single target rule data, reducing the calculation amount of policy parsing and the time of traffic matching, and improving matching efficiency.

[0079] In addition, if Figure 6 As shown, Figure 6 This is a flow chart of another exemplary embodiment of the firewall policy optimization method of the present invention. Based on the first to third embodiments above, a fourth embodiment of the firewall policy optimization method of the present invention is proposed. This embodiment refines the step of generating a traffic hit policy in step S30 of the above embodiment, including:

[0080] Step S3001: Generate a hash map of each initial policy according to the initial policy set, and send the hash map to a preset bidirectional linked list;

[0081] Based on the above embodiment, in this embodiment, the traffic in the real traffic set is matched with each initial policy in the initial policy set, and a traffic hit policy is generated based on the matching results. First, a hash map (hashmap) of each initial policy in the set is generated based on the initial policy set, and the generated hashmap is sequentially sent to a bidirectional linked list (linkedlist). Among them, an example of the linkedlist table data format can be shown in the following List 3:

[0082] The first firewall policy Second firewall policy …… Firewall Policy No. N

[0083] Table 3

[0084] Furthermore, in linkedlist, the hash map format of each initial policy can be as shown in Table 4 below:

[0085]

[0086] Table 4

[0087] Since the data volume of source address, destination address and destination port is large in real business scenarios, it is slow to match the data using a common data matching method. Therefore, in the present embodiment, this part of data is also processed accordingly. Taking IP address as an example, first, the hash value (hashcode) of each IP address is calculated and stored in a hash set (hashSet) to improve the retrieval speed. For example, "192.168.128.75, 192.168.237.166, 192.168.237.188" is split into "192.168.128.75", "192.168.237.166", and "192.168.237.188". The hashcode of each IP address is calculated and stored in the hashSet. Similarly, ports "8080, 8443" also adopt the same method. In addition, in order to ensure the reading speed of all policies, in the present embodiment, linkedList is set as a static variable and stored in the static cache.

[0088] Step S3002: Select a real flow from the real flow set as the target real flow, loop through the hash mapping tables of each policy from the bidirectional linked list, and match them with the characteristic information of the target real flow, wherein the characteristic information of the target real flow includes the source address, source port, destination address, destination port, and protocol;

[0089] Step S3003: If the match is successful, a traffic hit strategy for the target real traffic is generated, and the step of selecting a real traffic from the real traffic set as the target real traffic is returned and executed until the target real traffic is the last real traffic in the real traffic set, wherein the traffic hit strategy includes the characteristic information of the target real traffic.

[0090] Further, refer to Figure 7When performing matching analysis on the real traffic set and the initial policy set and then generating a traffic hit policy, first, a hash mapping table of each policy in the initial policy set is generated and sent to a preset bidirectional linked list, and a real traffic is selected from the real traffic set as the target real traffic; then, the hash mapping table of each initial policy is cyclically taken out from the bidirectional linked list, and according to the characteristic information such as the source address, destination address, source port, and destination port of the selected target real traffic, each hash mapping table is searched by hash value to see whether there is data matching the characteristic information of the target real traffic; if so, the target real traffic matches the initial policy set and a traffic hit policy is generated; if not, the target real traffic does not match each initial policy in the initial policy set and does not hit the initial policy; finally, it is determined whether the target real traffic is the last real traffic in the real traffic set. If so, the matching analysis of the real traffic set and the initial policy set is completed. If not, the next real traffic is reselected from the real traffic set as the target real traffic and the above matching steps are repeated until the selected target real traffic is the last real traffic in the real traffic set. Among them, the generated traffic hit strategy includes characteristic information such as the source address, destination address, source port and destination port of the real traffic, as well as the initial policy in the initial policy set that is hit by the target real traffic. The generated traffic hit strategy corresponds one-to-one to each real traffic in the real traffic set.

[0091] In this embodiment, the policies in the initial policy set are converted into hash maps and stored in a pre-set doubly linked list. When performing matching analysis with traffic data, each hash map is cyclically retrieved from the doubly linked list and matched against the selected target real traffic. This improves the efficiency of matching traffic data with the firewall's initial policies. Furthermore, when matching against the selected target real traffic, the hash value is used to retrieve the parsed data in the hash map for each initial policy, speeding up the retrieval of the parsed data and further enhancing matching efficiency.

[0092] Furthermore, based on the above embodiments, a fifth embodiment of the firewall policy optimization method of the present invention is proposed. This embodiment refines the optimization of the firewall policy according to the generated traffic hit policy in step S30 of the above embodiment, and mainly includes:

[0093] Step A1, determining, according to the traffic hit strategy, invalid strategies in the initial strategy set that are not hit by the real traffic in the real traffic set, and valid strategies that are hit by the real traffic in the real traffic set, wherein the valid strategies include a rule list, and the rule list includes a source address list, a source port list, a destination address list, a destination port list, and a protocol list;

[0094] Step A2: determining, based on the characteristic information in the traffic hit strategy, a rule sublist in the rule list of each effective strategy that is not hit by the real traffic in the real traffic set;

[0095] Step A3: generating optimization rules for the initial policy set according to the invalid policies and the rule sublist, and optimizing the initial policies in the initial policy set according to the optimization rules.

[0096] The generated traffic hit policy is compared with each policy in the initial policy set after the firewall is parsed, and the invalid policies in the initial policy set that are not hit by real traffic and the valid policies that are hit by real traffic are determined, wherein the valid policy contains a rule list of the policy, and the rule list is a detailed list of rules obtained by parsing the configuration information in the initial policy, mainly including a source address list, a source port list, a destination address list, a destination port list and a protocol list, etc. According to the characteristic information of each real traffic in the traffic hit policy, and the address and port in the parsed data of the initial policy hit by the characteristic information, the rule sublist in the rule list of each initial policy that is not hit by real traffic is determined, and the data in the rule sublist can be one or more. Based on the invalid policies in the initial policy set of the firewall that are not hit by real traffic and the rule sublist in the valid policy that is not hit, the optimization rules of the initial policy set are generated, and the initial policies in the initial policy set are optimized according to the generated optimization rules.

[0097] Furthermore, the optimization of each initial strategy in the initial strategy set includes but is not limited to deleting or invalidating invalid strategies and invalid data in the rule sublist that is not hit in the valid strategy, de-duplication and merging of duplicate redundant strategies or conflicting strategies, etc.

[0098] Furthermore, after determining invalid policies and valid policies, the step of optimizing the firewall policy also includes:

[0099] Step B1: counting the frequency of the effective strategy being hit by the real traffic in the real traffic set according to the traffic hit strategy, and obtaining a first hit number of each effective strategy;

[0100] Step B2: sorting the effective strategies in the initial strategy set according to the first hit quantity, and adjusting the priority of the effective strategies.

[0101] After determining the effective and invalid strategies, the frequency of each effective strategy being hit by real traffic is counted to obtain the number of hits of each initial strategy by real traffic. Based on the characteristic information such as source address, destination address, source port and destination port in each traffic hit strategy, the source is traced back to the initial strategy to which each effective strategy that is hit belongs, and then the number of hits of each initial strategy is obtained. Based on the number of hits of the initial strategy, the initial strategies are sorted and the priority of each initial strategy is adjusted.

[0102] Furthermore, after the step of optimizing the initial firewall policy, the following steps are further included:

[0103] Step C1, performing cluster analysis on the optimized rule list of the initial strategy to generate hit strategy rules;

[0104] Step C2, calculating a second hit number of the hit strategy rule according to the traffic hit strategy;

[0105] Step C3: sorting the hit policy rules according to the second hit quantity to generate a firewall policy template.

[0106] After optimizing each initial policy in the initial policy set, cluster analysis is performed on each optimized initial policy based on the generated traffic hit policy using machine learning and other methods to generate hit policy rules. The cluster analysis of the optimized initial policy mainly involves clustering the feature details in the rule list of the optimized initial policy, thereby aggregating rules with the same features to generate hit rules, and regrouping and aggregating the hit rules to generate optimized hit policy rules. The number of hits of the generated hit policy rules is then calculated based on the traffic hit policy, and the hit policy rules are sorted based on the hit number to generate a firewall policy template. Furthermore, when calculating the number of hits of the hit policy rules based on the traffic hit policy, the number of hits of each hit rule is specifically added together as the number of hits of the newly generated hit policy rule and sorted, thereby achieving the purpose of generating a firewall policy template based on actual business traffic.

[0107] Furthermore, there are multiple ways to perform cluster analysis on the rule list of the initial policy, including performing cluster analysis based on multiple rule lists such as source address, destination address, source port, and destination port, performing cluster analysis based on two or more of the source address, destination address, source port, and destination port simultaneously, or performing cluster analysis on the characteristic information in all rule lists. In this embodiment, a preferred cluster analysis method is: first, after performing cluster analysis based on multiple rule lists such as source address, destination address, source port, and destination port, the rule list with fewer intermediate hits is selected as the baseline. For example, after cluster analysis, if the number of intermediate hit rules obtained based on the destination address is found to be smaller, the intermediate hit rules generated by cluster analysis on the destination address are used as the basis. On this basis, other rule details such as source address, source port, and destination port are taken into consideration to perform a unified cluster analysis to generate hit policy rules. Then, the hit count of each hit policy rule generated is calculated according to the traffic hit policy, and the hit policy rules are sorted according to the hit count to generate a policy template. The generated policy template can effectively reduce the number of generated policies.

[0108] It should be noted that the above-described cluster analysis method is a preferred method in this embodiment and is used to illustrate and explain this embodiment, but does not limit the present invention. In actual use, various rules can be analyzed according to different logic or sequences. The generated firewall policy template is primarily used for firewall operation and maintenance. As is known, after multiple policy updates, firewalls can become bloated and may also generate many useless or security-prone policies. Due to this historical backlog, it is difficult for different operation and maintenance personnel to clearly understand the services corresponding to each policy. Therefore, the original policies cannot be modified arbitrarily. During policy maintenance, re-establishing policies based on policy templates is more efficient and convenient than continuing to maintain the original policies in operation. In this embodiment, the policy template generated based on the initial policies hit by actual service traffic can reflect the actual policies that the firewall needs to establish, providing a reference for operation and maintenance personnel to re-establish firewall policies. Furthermore, the firewall policies re-established based on the policy templates have less policy data, making them easier for operation and maintenance personnel to maintain, thus facilitating firewall policy operation and maintenance.

[0109] In this embodiment, firewall policies are optimized based on the generated traffic hit policies. This not only audits the policies that were not hit in the initial policy, as with traditional firewall optimization methods, but also further identifies information such as source addresses, destination addresses, source ports, and destination ports that were hit in the initial policy but not in the policy, thereby refining the granularity of firewall policy optimization. Furthermore, duplicate ports can be effectively merged and unused ports can be deleted, thereby reducing the open range of destination ports and improving the firewall's defensive performance.

[0110] Furthermore, in this embodiment, by performing cluster analysis on the rule set of the optimized initial policy, the traffic hit policies are aggregated into the form of source address sets, destination address sets, source port sets and destination port sets to generate new hit policy rules. During the operation and maintenance process, this can provide a reference for operation and maintenance personnel to re-formulate firewall policies, reduce the number of firewall policies, and effectively reduce the number of policies during firewall policy audits, thereby further improving audit efficiency.

[0111] Based on the above embodiments, the overall process of the firewall policy optimization method of the present invention is described in detail below:

[0112] First, traffic data is collected from terminal devices (including switches and routers) connected to the front and back ends of the firewall. This data includes both front-end and back-end traffic. The collected traffic data is then analyzed. The specific analysis process involves identifying traffic that passes through the firewall from both front-end and back-end traffic using the time points and traffic characteristics of each flow, eliminating traffic from other locations that does not pass through the firewall. Based on the duration of each flow, a chi-square test is used to calculate the goodness of fit between the distribution of the test sample and the hypothesized distribution. A portion of the traffic data passing through the firewall is used as the test sample. Using the duration as the X-axis and the frequency of occurrence as the Y-axis, the distribution of each flow is calculated and compared with the hypothesized distribution. The optimal solution is ultimately found and used as the flow duration threshold. Based on this flow duration threshold, tentative flows with durations less than the threshold are eliminated, retaining only the actual service flows, resulting in the true traffic set.

[0113] The original policy configuration file from the firewall is obtained and parsed to obtain the firewall's initial policy set. The specific process of parsing the policy configuration file is as follows: The original policy configuration file is collected from the firewall. The defined IP address set, object, and individual IP information, as well as the defined port set, object, and individual port information, are separated from the configuration file. The IP address set and object are parsed into individual IP addresses, and the port set and object are parsed into individual ports. The corresponding rule details are obtained to provide data support for firewall policy parsing. Policy information is extracted from the firewall's policy configuration file. This policy information includes the specific firewall policy definition statements, including the source address, source port, destination address, destination port, protocol, execution action (allow / deny), and policy activation status defined in the policy. The statement format is, for example, [access-list acl-inside / acl-outside extended permit / deny destination port source IP destination IP inactive], where "inactive" indicates whether the policy is activated. If this field is missing, it indicates it is activated; if it is present, it indicates it is inactive. A firewall policy statement is retrieved to determine whether the corresponding initial policy is active. If not, the next policy is retrieved for analysis. If it is, the source address, destination address, and destination port used in the policy statement are matched with the parsed rule details to determine the target rule defined in the policy and save it. A query is then made to determine whether there are any unparsed firewall policy statements. If so, parsing continues. If not, the parsing of each initial policy is completed, and the initial policy set is obtained based on the data saved during the parsing process.

[0114] It should be noted that the flow data collection and flow analysis process is independent of the firewall policy configuration file acquisition and parsing process. The execution steps of the two can be adjusted arbitrarily, and can be executed sequentially or simultaneously, and are not specifically limited here.

[0115] Secondly, after obtaining the real traffic set and the initial policy set, each traffic in the real traffic set is matched and analyzed with each policy in the initial policy set to generate a traffic hit policy. The matching analysis process is as follows: each initial policy is converted into a hash mapping table and saved in a two-way linked list in sequence, and in the hash mapping table of each initial policy, the target rule hash value defined in the initial policy is saved in the hash set to improve the retrieval speed of the target rule. A real traffic is selected from the real traffic set, and the hash mapping table of each initial policy is cyclically taken out from the two-way linked list to match the selected real traffic. If it matches, the corresponding traffic hit policy is generated. If it does not match, the traffic is discarded. The generated traffic hit policy contains characteristic information such as the source address, destination address, source port and destination port of the real traffic. The characteristic information is the hit rule of the initial policy that the real traffic hits in the initial policy set. The format of the hit rule can be as shown in Table 5 below:

[0116]

[0117] Table 5

[0118] The initial policy ID is the index address of the hash mapping table of the initial policy hit by the traffic in the bidirectional linked list.

[0119] Finally, the firewall policy is optimized based on the generated traffic hit policy. The optimization process includes: counting all generated traffic hit policies, comparing the traffic hit policies with the parsed firewall initial policies, determining the firewall initial policies to which all traffic hit policies belong, and the number of hits for each hit initial policy. At the same time, the firewall initial policies that were not hit are determined, and information such as the source address, source port, destination address, and destination port that were not hit in the hit initial policies are counted. The missed initial policies and the source address, source port, destination address, and destination port that were not hit in the hit initial policies are deleted or invalidated. The initial policies are sorted according to the number of hits for each initial policy, and the priority of the firewall policies is adjusted. Based on the number of hits in the initial firewall policy, machine learning methods are used to perform cluster analysis on the source address, destination address, source port, and destination port. This clusters hit rules with the same characteristics, regroups and regroups the hit rules to generate new hit policy rules. The hit counts of individual hit rules are then added together to convert them into the hit counts of the new hit rules, which are then sorted. This generates firewall policy templates based on actual service traffic. The generated policy templates reflect the actual firewall policy needs, providing a reference for operations and maintenance personnel to re-formulate firewall policies, making firewall operations and maintenance more efficient and convenient.

[0120] It should be noted that the tables and data in the tables used in each embodiment of the firewall policy optimization method of the present invention, as well as the addresses, ports and other information in each embodiment have no practical significance. They are only used to provide illustrative explanations of the various embodiments of the present invention and do not constitute a limitation on the present invention.

[0121] In various embodiments of the firewall policy optimization method of the present invention, traffic data is collected from other network devices, such as switches and routers, to address the capacity and performance issues of the firewall's built-in traffic logging module. Furthermore, during traffic analysis, in addition to extracting the classic five-tuple information of the traffic, information such as the time point and duration of the traffic is also extracted. This ensures that the traffic used to generate the traffic hit policy passes through the firewall, identifies exploratory attack traffic, eliminates interference, and improves the accuracy of firewall policy optimization.

[0122] Furthermore, traditional firewall policy optimization methods all require parsing the initial firewall policy into sub-policies or rules. When the policy rule set is large, decomposing the original policy is not only time-consuming and occupies a large amount of computing resources and storage space, but also affects the efficiency of matching with traffic data. To address this situation, the embodiments of the firewall policy optimization method of the present invention do not further decompose the initial firewall policy. Instead, they ensure that each rule in the policy retains its original state. The rule set in the initial policy is simply parsed into individual data, and the hash value of each data is calculated and stored in the hash set of the hash map. This reduces the storage space occupied and the time for traffic matching, simplifies policy parsing, and improves audit efficiency.

[0123] Furthermore, in each embodiment of the firewall policy optimization method of the present invention, when optimizing the firewall policy based on the generated hit policy, not only can the policies that were not hit in the initial policy be audited, but also the source address, destination address, source port, and destination port information that were not hit in the hit policy can be audited. Invalid policies and invalid addresses and ports in valid policies can be deleted or invalidated. At the same time, the priority of the policies can be adjusted based on the number of traffic hits for each initial policy, thereby achieving dynamic analysis and continuous optimization of the firewall policy.

[0124] In addition, an embodiment of the present invention further provides a firewall policy optimization device, the device comprising:

[0125] Traffic collection and analysis module 10, for collecting traffic data passing through the firewall, analyzing the collected traffic data, and removing the tentative attack traffic from the traffic data to obtain a real traffic set;

[0126] The policy parsing module 20 is used to obtain the policy configuration file in the firewall and parse the policy configuration file to obtain the initial policy set of the firewall;

[0127] The policy optimization module 30 is configured to perform matching analysis on the real traffic set and the initial policy set, generate a traffic hit policy, and optimize the initial policy in the initial policy set according to the traffic hit policy.

[0128] For the principle and implementation process of implementing firewall policy optimization in this embodiment, please refer to the above embodiments and will not be repeated here.

[0129] In addition, an embodiment of the present invention also proposes a terminal device, which includes a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the computer program is executed by the processor, the firewall policy optimization method described in the above embodiment is implemented.

[0130] Since this firewall policy optimization program adopts all the technical solutions of all the aforementioned embodiments when executed by the processor, it has at least all the beneficial effects brought by all the technical solutions of all the aforementioned embodiments, which will not be described one by one here.

[0131] In addition, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the firewall policy optimization method described in the above embodiment is implemented.

[0132] Since this firewall policy optimization program adopts all the technical solutions of all the aforementioned embodiments when executed by the processor, it has at least all the beneficial effects brought by all the technical solutions of all the aforementioned embodiments, which will not be described one by one here.

[0133] In addition, an embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the firewall policy optimization method described in the above embodiment is implemented.

[0134] Since this firewall policy optimization program adopts all the technical solutions of all the aforementioned embodiments when executed by the processor, it has at least all the beneficial effects brought by all the technical solutions of all the aforementioned embodiments, which will not be described one by one here.

[0135] Compared with the existing technology, the firewall policy optimization method, device, terminal device and storage medium proposed in the embodiments of the present invention audit and optimize the firewall policy through real business traffic, which can eliminate the interference of tentative business traffic, improve the accuracy of the audit and optimization of the firewall policy, and realize dynamic audit and continuous optimization of the firewall policy.

[0136] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0137] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0138] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, controlled terminal, or network device, etc.) to execute the method of each embodiment of the present invention.

[0139] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A firewall policy optimization method, characterized in that: The firewall policy optimization method comprises the following steps: Collecting traffic data passing through the firewall, analyzing the collected traffic data, and removing tentative attack traffic from the traffic data to obtain a real traffic set; Obtaining a policy configuration file in the firewall, and parsing the policy configuration file to obtain an initial policy set of the firewall; Performing a matching analysis on the real traffic set and the initial policy set to generate a traffic hit policy, and optimizing the initial policy in the initial policy set according to the traffic hit policy; The step of performing matching analysis on the real traffic set and the initial policy set to generate a traffic hit policy includes: Generate a hash mapping table of each initial strategy according to the initial strategy set, and send the hash mapping table to a preset bidirectional linked table; Selecting a real flow from the real flow set as the target real flow, circularly retrieving the hash mapping table of each strategy from the bidirectional linked list, and matching it with the characteristic information of the target real flow; If the match is successful, a traffic hit strategy for the target real traffic is generated, and the step of selecting a real traffic from the real traffic set as the target real traffic is returned and executed until the target real traffic is the last real traffic in the real traffic set, wherein the traffic hit strategy includes the characteristic information of the target real traffic.

2. The firewall policy optimization method according to claim 1, characterized in that: The traffic data includes front-end traffic and back-end traffic of the firewall, the front-end traffic comes from a terminal device connected to the front-end of the firewall, and the back-end traffic comes from a terminal device connected to the back-end of the firewall. The steps of analyzing the collected traffic data and removing tentative attack traffic from the traffic data to obtain a real traffic set include: Extract characteristic information, flow duration and time point of each flow from the collected flow data; Merging the traffic with the same characteristic information and a time point difference less than a preset time difference threshold in the front-end traffic and the back-end traffic to obtain a first traffic set; Fitting the traffic duration distribution of the traffic data using a chi-square test, and determining a traffic duration threshold based on the optimal fit, wherein the traffic duration threshold is used to distinguish between real traffic and tentative attack traffic; Selecting a flow from the first flow set as a target flow; if the flow duration of the target flow is greater than a flow duration threshold, saving the target flow as a real flow; returning to and executing the step of selecting a flow from the first flow set as a target flow, until the target flow is the last flow in the first flow set; If the traffic duration of the target traffic is less than or equal to the traffic duration threshold, the target traffic is eliminated as a tentative attack traffic, and the process returns to and executes the step of selecting a traffic from the first traffic set as the target traffic until the target traffic is the last traffic in the traffic set.

3. The firewall policy optimization method according to claim 1, characterized in that: The step of parsing the policy configuration file into an initial policy set of the firewall includes: Extracting configuration information of the firewall and policy information of each initial policy of the firewall from the policy configuration file, wherein the configuration information includes a rule set defined in the firewall; Parsing the rule set in the configuration information to obtain detailed rules for firewall configuration; Determining an activation state of each of the initial policies of the firewall according to the policy information, wherein the activation state includes activated and inactivated; According to the rule details, target rules of each initial policy whose activation state is activated are determined to obtain an initial policy set of the firewall.

4. The firewall policy optimization method according to claim 1, characterized in that: The characteristic information of the target real traffic includes source address, source port, destination address, destination port and protocol.

5. The firewall policy optimization method according to claim 4, characterized in that: The step of optimizing the initial policy in the initial policy set according to the traffic hit policy includes: Determining, according to the traffic hit strategy, an invalid strategy in the initial strategy set that is not hit by the real traffic in the real traffic set, and a valid strategy that is hit by the real traffic in the real traffic set, wherein the valid strategy includes a rule list, and the rule list includes a source address list, a source port list, a destination address list, a destination port list, and a protocol list; Determine, based on the characteristic information in the traffic hit strategy, a rule sublist in the rule list of each effective strategy that is not hit by the real traffic in the real traffic set; An optimization rule for the initial policy set is generated according to the invalid policy and the rule sublist, and the initial policy in the initial policy set is optimized according to the optimization rule.

6. The firewall policy optimization method according to claim 5, characterized in that: After the step of determining, in the policy set, invalid policies that are not hit by the real traffic in the real traffic set and valid policies that are hit by the real traffic in the real traffic set according to the traffic hit policy, the method further includes: Counting the frequency of the effective strategy being hit by the real traffic in the real traffic set according to the traffic hit strategy, to obtain a first hit number for each of the effective strategies; The initial strategies in the initial strategy set are sorted according to the first hit quantity, and the priorities of the initial strategies are adjusted.

7. The firewall policy optimization method according to claim 6, characterized in that: After the step of optimizing the initial policy in the initial policy set according to the traffic hit policy, the method further includes: Performing cluster analysis on the optimized rule list of the initial strategy according to the traffic hit strategy to generate hit strategy rules; Calculating a second hit quantity of the hit strategy rule according to the traffic hit strategy; The hit policy rules are sorted according to the second hit quantity to generate a firewall policy template.

8. A firewall policy optimization device, characterized in that: The firewall policy optimization device includes: A traffic collection and analysis module is used to collect traffic data passing through the firewall, analyze the collected traffic data, and remove tentative attack traffic from the traffic data to obtain a real traffic set; A policy parsing module is used to obtain a policy configuration file in the firewall and parse the policy configuration file to obtain an initial policy set of the firewall; a policy optimization module, configured to perform a matching analysis on the real traffic set and the initial policy set, generate a traffic hit policy, and optimize the initial policy in the initial policy set according to the traffic hit policy; The strategy optimization module is further configured to generate a hash mapping table of each initial strategy according to the initial strategy set, and send the hash mapping table to a preset bidirectional linked list; Selecting a real flow from the real flow set as the target real flow, circularly retrieving the hash mapping table of each strategy from the bidirectional linked list, and matching it with the characteristic information of the target real flow; If the match is successful, a traffic hit strategy for the target real traffic is generated, and the step of selecting a real traffic from the real traffic set as the target real traffic is returned and executed until the target real traffic is the last real traffic in the real traffic set, wherein the traffic hit strategy includes the characteristic information of the target real traffic.

9. A terminal device, characterized in that: The terminal device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the firewall policy optimization method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the firewall policy optimization method according to any one of claims 1 to 7 is implemented.

Images