Risk assessment of firewall rules in data centers

Abstract

The present disclosure provides methods and apparatuses for risk assessment of firewall rules in a data center. The data center can have a plurality of devices and be configured with a plurality of firewall rules. Firewall rule configuration information of the plurality of devices can be obtained. A plurality of device groups formed by the plurality of devices can be identified. A count distribution of the plurality of firewall rules over the plurality of device groups can be determined. The plurality of firewall rules can be clustered into a plurality of firewall rule groups based on the count distribution, firewall rules in each firewall rule group having a same risk attribute.

Description

Background Technology

[0001] Firewall rules are widely deployed in data centers for purposes such as ensuring network and data access security and defending against cyberattacks. In this article, "data center" can broadly refer to a group of devices or a platform composed of multiple devices, operating for various purposes or scenarios. Devices in a data center can include various network or computing devices, often referred to as, for example, hosts. Examples include databases, file servers, application servers, cloud processing units, gateways, etc. Summary of the Invention

[0002] This invention is provided to introduce a set of concepts, which will be further described in the following detailed description. This invention is not intended to identify key or essential features of the protected subject matter, nor is it intended to limit the scope of the protected subject matter.

[0003] Embodiments of this disclosure provide a method and apparatus for risk assessment of firewall rules in a data center. The data center may have multiple devices and be configured with multiple firewall rules. Firewall rule configuration information for the multiple devices can be obtained. Multiple device groups formed by the multiple devices can be identified. The count distribution of the multiple firewall rules across the multiple device groups can be determined. Based on the count distribution, the multiple firewall rules can be clustered into multiple firewall rule groups, where firewall rules in each firewall rule group have the same risk attributes.

[0004] It should be noted that one or more of the above aspects include the features specifically pointed out in the following detailed description and claims. Certain illustrative features of the one or more aspects are set forth in detail in the following specification and drawings. These features merely indicate various ways in which the principles of each aspect can be implemented, and this disclosure is intended to include all such aspects and their equivalents. Attached Figure Description

[0005] The disclosed aspects will now be described in conjunction with the accompanying drawings, which are provided to illustrate and not limit the disclosed aspects.

[0006] Figure 1 An exemplary process for performing risk assessments of firewall rules in a data center, according to an embodiment, is shown.

[0007] Figure 2 An exemplary process for clustering firewall rules into firewall rule groups according to an embodiment is shown.

[0008] Figure 3 An example of obtaining a firewall rule group according to an embodiment is shown.

[0009] Figure 4 An exemplary process for automatically labeling firewall rules in a firewall rule group, according to an embodiment, is shown.

[0010] Figure 5 An exemplary process for a historical risk attribute tagging inheritance mechanism according to an embodiment is shown.

[0011] Figure 6 A flowchart illustrating an exemplary method for risk assessment of firewall rules in a data center, according to an embodiment, is shown.

[0012] Figure 7 An exemplary apparatus for risk assessment of firewall rules in a data center, according to an embodiment, is shown.

[0013] Figure 8 An exemplary apparatus for risk assessment of firewall rules in a data center, according to an embodiment, is shown. Detailed Implementation

[0014] This disclosure will now be discussed with reference to several exemplary embodiments. It should be understood that this discussion of embodiments is merely intended to enable those skilled in the art to better understand and thus implement the embodiments of this disclosure, and is not intended to imply any limitation on the scope of this disclosure.

[0015] Typically, a large number of firewall rules are deployed in data centers. Besides normal or properly configured firewall rules, some deployed firewall rules may also be risky. In this article, risky firewall rules broadly refer to those that may hinder the normal operation of the data center, provide very limited or no protection, or pose a threat to network connectivity or data within the data center. For example, risky firewall rules may include invalid or misconfigured firewall rules, firewall rules for occasional or local applications deployed on a limited number of devices, and malicious firewall rules deployed by unauthorized entities in the data center. Therefore, it is necessary to identify risky firewall rules from all firewall rules configured in the data center. Existing methods for identifying risky firewall rules rely on manual inspection of firewall rules, such as manually checking each deployed firewall rule for risk. However, because data centers may be configured with a very large number of firewall rules, the above-mentioned manual method of identifying risky firewall rules is inefficient and makes it difficult to inspect all firewall rules configured in the data center in a timely manner. In addition, some devices or services may require frequent addition, deletion, or updating of relevant firewall rules, which will further increase the difficulty of checking firewall rules manually through the aforementioned methods of identifying risky firewall rules.

[0016] The embodiments of this disclosure propose a scheme to facilitate risk assessment of firewall rules in data centers. In this document, risk assessment of firewall rules can refer to determining the risk attributes of firewall rules, such as determining whether a firewall rule is risky or risk-free, or determining the risk level of a firewall rule.

[0017] This disclosure proposes a method to cluster firewall rules into firewall rule groups based on the count distribution of firewall rules across device groups in a data center. It assumes that most firewall rules in the data center are reasonably configured, and that a group of firewall rules should serve the same purpose. For example, firewall rules such as "Remote Desktop - Shadow (TCP-In)," "Remote Desktop - User Mode (TCP-In)," and "Remote Desktop - User Mode (UDP-In)" serve the same purpose, "Remote Desktop." Firewall rules serving the same purpose will have an equivalent count distribution within the data center. Therefore, each firewall rule group obtained using the count distribution will include multiple firewall rules serving the same purpose and having the same risk attribute. In other words, if a firewall rule has a certain risk attribute, other firewall rules with an equivalent count distribution, such as other firewall rules in the same firewall rule group, will also have that risk attribute. Therefore, using the firewall rule groups obtained through the embodiments of this disclosure, risk assessment can be performed effectively; for example, the same risk attribute tag can be attached to all firewall rules in a firewall rule group. In one aspect, if manual annotation is used, it is only necessary to manually determine the risk attribute markers for one or more firewall rules in a firewall rule group, and the determined markers can be attached to all firewall rules in that firewall rule group without checking all firewall rules in the group. In another aspect, embodiments of this disclosure can automatically attach risk attribute markers to firewall rules in a firewall rule group, for example, by utilizing historical risk attribute markers.

[0018] By clustering firewall rules into firewall rule groups, embodiments of this disclosure can facilitate efficient, accurate, and automated risk assessments of firewall rules. All firewall rules in a data center can be assessed efficiently and time-savingly. Furthermore, the high efficiency of the risk assessment according to the embodiments makes centralized control of firewall rules in the data center easier to achieve. Risky firewall rules can be identified promptly. The process proposed in the embodiments of this disclosure can be executed automatically in a periodic manner or in response to any type of triggering event, thereby enabling timely and continuous monitoring of firewall rules in the data center.

[0019] Figure 1An exemplary process 100 for performing a risk assessment of firewall rules in a data center, according to an embodiment, is illustrated. Assuming that data center 102 is configured with multiple firewall rules, the risk attributes of these firewall rules will be assessed. Data center 102 may include multiple devices, such as network or computing devices.

[0020] Firewall rule configuration information 112 for devices in data center 102 can be obtained. Firewall rule configuration information 112 may include the firewall rules configured at each device. For example, assuming 25 firewall rules are configured at a database, the firewall rule configuration information for that database may include or indicate the names of these 25 firewall rules.

[0021] Multiple device groups 114 formed by devices in data center 102 can be identified. Typically, devices in a data center can be divided into multiple device groups based on function or purpose, and devices in each device group can have the same function or purpose. For example, if there are 10 devices in a data center used to provide a document evaluation service, these 10 devices can be grouped into one device group. Since devices in a device group have the same function or purpose, these devices can also have the same or similar requirements for firewall rules. Accordingly, it is likely that firewall rules serving the same purpose are also configured on devices in the same device group. It should be understood that the identification of device groups can refer to determining device groups from all devices in data center 102 based on various predetermined functions or purposes, or receiving instructions on device groups that have been previously identified by any means.

[0022] At point 120, the count distribution of multiple firewall rules configured in data center 102 across multiple device groups 114 can be determined. The count distribution for each firewall rule can include the number of devices in each of the multiple device groups that have that firewall rule configured. Assume that for firewall rule R... i The firewall rule was configured on 10 out of 25 devices in device group 1, on 8 out of 12 devices in device group 2, on 15 out of 30 devices in device group 3, and so on. Then, firewall rule R... i The count distribution can indicate that the firewall rule is configured on 10 devices in device group 1, on 8 devices in device group 2, on 15 devices in device group 3, and so on. The firewall rule configuration information 112 and the identified device group 114 can be used together to determine the count distribution for each firewall rule.

[0023] In one implementation, firewall rules in data center 102 can be represented as a list of tuples, each corresponding to a firewall rule. An exemplary format for a tuple could be [RuleName, Location, Count], where the RuleName field is the name of the firewall rule represented by the tuple, and the Location and Count fields are used to represent information about the count distribution of the firewall rule. For example, the Location field could be a vector listing all device groups 114 in the data center, and the Count field could be a vector listing the number of devices configured with the firewall rule in each of the multiple device groups 114. It should be understood that the above representation of firewall rules is exemplary, and firewall rules are not limited to being represented in this way.

[0024] At position 130, multiple firewall rules in data center 102 can be clustered into multiple firewall rule groups 140 based on the count distribution determined at position 120. In one implementation, the clustering operation at position 130 can be designed to cluster firewall rules with equivalent count distributions into the same firewall rule group. In this paper, equivalent count distributions can refer to the same or similar count distributions. Firewall rules in each firewall rule group 140 will have the same risk attributes. In one implementation, an unsupervised learning algorithm can be used to perform the clustering operation at position 130, which will be discussed later. Figure 2 and Figure 3 Let's discuss this in detail.

[0025] The firewall rule groups obtained through process 100 will significantly improve the efficiency of firewall rule risk assessment. For example, since the firewall rules in each firewall rule group have the same risk attributes, the risk attribute tags of these firewall rules can be unified to the same risk attribute tag. Accordingly, it is not necessary to examine all firewall rules in a firewall rule group.

[0026] Optionally, additional operations can be performed, at least based on firewall rule group 140, to attach risk attribute tags to firewall rules.

[0027] In one implementation, manual annotation can be performed at point 150. For each firewall rule group in firewall rule group 140, a risk attribute marker for one firewall rule in that firewall rule group can be manually determined, and the determined marker can be further appended to all firewall rules in that firewall rule group. Alternatively, several risk attribute markers for several firewall rules in that firewall rule group can be manually determined first, and then a representative or combined risk attribute marker can be selected from the several risk attribute markers and appended to all firewall rules in that firewall rule group.

[0028] In another implementation, automatic labeling can be performed at point 160. Assuming that at least some or all of the firewall rules in the data center have already been appended with risk attribute tags before process 100 is executed, these existing risk attribute tags can be used as historical risk attribute tags and applied at point 160 to automatically determine risk attribute tags and append them to the firewall rules in firewall rule group 140. This will be discussed later. Figure 4 and Figure 5 The automatic annotation operation at point 160 will be discussed in detail.

[0029] It should be understood that Process 100 can be executed periodically according to a predefined period. The predefined period can be any type of period, such as daily, weekly, etc. Alternatively, Process 100 can be executed in response to any type of triggering event. A triggering event can be any type of predefined event, such as equipment failure, system failure, network attack, new service or equipment deployment, service update, scheduled time, etc. By executing Process 100 periodically or in response to triggering events, firewall rules in the data center can be monitored in a timely and continuous manner, thereby enabling the timely identification of risky firewall rules through risk assessment.

[0030] It should be understood that the risk attributes of firewall rules can be classified in different ways. In one case, the risk attributes of firewall rules can be divided into risky or risk-free. Accordingly, the risk attribute tag attached to the firewall rule can indicate whether the firewall rule is risky or risk-free. In another case, the risk attributes of firewall rules can be classified into various risk levels, such as high risk, low risk, and no risk. Accordingly, the risk attribute tag attached to the firewall rule can indicate a certain risk level. The embodiments of this disclosure are not limited to any particular risk attribute classification method.

[0031] Figure 2 An exemplary process 200 for clustering firewall rules into groups of firewall rules according to an embodiment is shown. Process 200 is Figure 1 An exemplary implementation of the clustering operation at position 130 is provided. An unsupervised learning algorithm for clustering firewall rules is discussed in conjunction with the operations in process 200. This unsupervised learning algorithm aims to cluster firewall rules with equivalent count distributions into the same group of firewall rules.

[0032] Assuming it has already been passed, for example Figure 1 The operation at position 120 yielded the count distribution of firewall rules in the data center, 202.

[0033] At 210, a distribution vector representation can be performed on firewall rules based on the count distribution 202. For example, the count distribution of each firewall rule can be represented as a distribution vector for that firewall rule. The distribution vector can be, for example... The format, in which, R represents the i-th firewall rule. i The distribution vector, n corresponds to the number of equipment groups, and C i,j (j = 1, ..., n) represents the number of devices in the j-th equipment group, R i The count, that is, the number of devices configured with R in the j-th device group. i The number of devices. (In distribution vector) For example, This represents the distribution vector of the third firewall rule R3, indicating that 200 devices in the first device group are configured with R3, 150 devices in the second device group are configured with R3, ..., and 300 devices in the nth device group are configured with R3. Through the operation at 210, the distribution vector 212 of the firewall rules in the data center can be obtained.

[0034] At position 220, similarity calculations can be performed between firewall rules based on distribution vector 212. For example, the similarity between two firewall rules can be calculated using the distribution vectors of every two firewall rules, and the calculated similarity can be used to form a similarity matrix 222. Various methods can be used to calculate the similarity between two firewall rules.

[0035] In one implementation, cosine similarity can be used to calculate the similarity between two firewall rules. For example, suppose... It is the distribution vector of firewall rule R1. Let R1 be the distribution vector of firewall rule R2. Then the similarity between R1 and R2 can be calculated as follows:

[0036]

[0037] Here, cos_sim(·) represents the cosine similarity function.

[0038] In one implementation, the maximum relative distance similarity can be used to calculate the similarity between two firewall rules. For example, suppose... It is the distribution vector of firewall rule R1. Let R1 be the distribution vector of firewall rule R2. Then the similarity between R1 and R2 can be calculated as follows:

[0039]

[0040] In this context, max_sim(·) represents the maximum relative distance similarity function, min(·) is the minimum value extraction function, truncate(·) is the truncation function, and abs(·) represents taking the absolute value.

[0041] Embodiments of this disclosure propose a maximum relative distance similarity method to provide a sharper function shape than cosine similarity. Compared to cosine similarity, maximum relative distance similarity can achieve higher performance in clustering firewall rules because it can focus more on the distributional characteristics of the count distribution indicated in the distribution vector.

[0042] It should be understood that the similarity calculation at 220 can be performed using one or both of cosine similarity and maximum relative distance similarity, or any other method that can calculate the similarity between two firewall rules.

[0043] The similarity matrix 222 can be formed by calculating the similarity between every two firewall rules in all firewall rules. The similarity matrix 222 can be an m×m matrix, where m is the number of firewall rules in the data center. Items in the similarity matrix 222 can be represented as l p,q , which is the calculated similarity between the p-th firewall rule and the q-th firewall rule.

[0044] At position 230, a matrix transformation can be performed on similarity matrix 222. For example, similarity matrix 222 can be transformed into adjacency matrix 232 by applying a similarity threshold. Items in similarity matrix 222 with values ​​equal to or higher than the similarity threshold can be transformed into items with a value of "1" in adjacency matrix 232, while items in similarity matrix 222 with values ​​lower than the similarity threshold can be transformed into items with a value of "0" in adjacency matrix 232. Alternatively, diagonal items in similarity matrix 222 can also be transformed into items with a value of "0" in adjacency matrix 232. The similarity threshold can be determined empirically or experimentally beforehand. A higher similarity threshold will ensure that firewall rules in a group can have high similarity to each other, but may result in fewer firewall rules being included in a group. A lower similarity threshold will result in a group including more firewall rules, but may cluster risky firewall rules and risk-free firewall rules into one group.

[0045] At position 240, adjacency matrix 232 can be used to perform graph construction. For example, a graph representation 242 of adjacency matrix 232 can be constructed at position 240. A value "1" in adjacency matrix 232 indicates that there is an edge between two nodes in graph representation 242, where these two nodes correspond to two firewall rules.

[0046] At position 250, subgraph extraction can be performed on graph representation 242. For example, multiple connected subgraphs 252 can be extracted from graph representation 242. Each connected subgraph can include multiple nodes that are highly similar to each other. Therefore, multiple connected subgraphs 252 can each correspond to multiple firewall rule groups 260. It should be understood that a connected subgraph may contain only one node, indicating that the similarity between the firewall rule corresponding to that node and any other firewall rule is below a similarity threshold, and accordingly, that firewall rule will form its own firewall rule group.

[0047] Through process 200, firewall rules in a data center can be clustered into multiple firewall rule groups based on the count distribution of firewall rules. It should be understood that all operations in process 200 are exemplary, and embodiments of this disclosure can cover any other method or process capable of clustering firewall rules based on count distribution. Furthermore, it should be understood that since a complete graph can indicate that all nodes within it have a higher similarity than other types of connected graphs, and consequently lead to higher clustering accuracy, a similarity threshold can also be predetermined to make multiple connected subgraphs approximate a complete graph. For example, a similarity threshold can be selected such that the extracted connected subgraph 252 is a complete graph and approximates a complete graph as closely as possible.

[0048] Suppose a firewall rule is initially represented as a tuple [RuleName, Location, Count]. When the firewall rule is clustered into a firewall rule group through process 200, the firewall rule can be represented as an updated tuple [RuleName, Location, Count, GroupID], where the GroupID item is the identifier of the firewall rule group into which the firewall rule is clustered.

[0049] Figure 3 An example of obtaining a firewall rule group according to an embodiment is shown. Figure 3 The examples in the text are based on Figure 2 The process was proposed in 200.

[0050] For simplicity, assume that a clustering process is to be performed on all six firewall rules in a data center, namely R1, R2, R3, R4, R5, and R6. The similarity matrix can have an exemplary format 310, where item l p,q This represents the calculated similarity between the p-th firewall rule and the q-th firewall rule. As an example, Figure 3 The similarity matrix 312 is shown, where each item is inserted with a calculated similarity value.

[0051] according to Figure 2Operation 230 in the similarity matrix can transform the similarity matrix 312 into an adjacency matrix 322 by applying an exemplary similarity threshold of "0.8". Items in the similarity matrix 312 with values ​​equal to or higher than the similarity threshold "0.8" are transformed into items with a value of "1" in the adjacency matrix 322, items in the similarity matrix 312 with values ​​lower than the similarity threshold "0.8" are transformed into items with a value of "0" in the adjacency matrix 322, and diagonal items in the similarity matrix 312 are transformed into items with a value of "0" in the adjacency matrix 322.

[0052] according to Figure 2 Operation 240 in the adjacency matrix 322 constructs a graph representation 332, wherein edges between nodes are set based on those items in the adjacency matrix 322 that have a value of "1".

[0053] according to Figure 2 Operation 250 extracts two connected subgraphs 342 and 344 from graph representation 332. Connected subgraph 342 contains three nodes corresponding to firewall rules R1, R2, and R3, respectively, and connected subgraph 344 contains three nodes corresponding to firewall rules R4, R5, and R6, respectively.

[0054] Based on the extracted connected subgraphs 342 and 344, two firewall rule groups are obtained. For example, group 1, which contains firewall rules R1, R2, and R3, can be determined based on connected subgraph 342, and group 2, which contains firewall rules R4, R5, and R6, can be determined based on connected subgraph 344.

[0055] Figure 4 An exemplary process 400 for automatically labeling firewall rules in a firewall rule group, according to an embodiment, is shown. Process 400 is... Figure 1 An exemplary implementation of the operation at point 160. Process 400 automatically labels the firewall rules in each firewall rule group using historical or existing risk attribute tags of the firewall rules. Historical risk attribute tags can be pre-labeled manually or automatically labeled by pre-executing process 400. Figure 4 In this context, firewall rules that have already been marked with historical risk attributes can also be referred to as historical firewall rules. For example, Figure 1 Process 100 can be executed iteratively or repeatedly, so those firewall rules processed in the last iteration of process 100 can be regarded as historical firewall rules.

[0056] Suppose that the firewall rules in target firewall rule group 402 are to be automatically labeled, where target firewall rule group 402 can come from... Figure 1 Firewall rule group 140 or Figure 2Firewall rule group 260 in the target firewall rule group 402. Process 400 is designed to automatically attach the same risk attribute tag to all firewall rules in the target firewall rule group 402.

[0057] At position 410, intermediate risk attribute tags can be assigned to each firewall rule in target firewall rule group 402. Intermediate risk attribute tags can be historical risk attribute tags. In one implementation, the assignment of intermediate risk attribute tags can be performed through a historical risk attribute tag inheritance mechanism. Figure 5 An exemplary process 500 of the historical risk attribute tag inheritance mechanism according to an embodiment is shown.

[0058] For the current firewall rule 502 in target firewall rule group 402, the corresponding historical firewall rule can be identified at 510. In one implementation, a historical firewall rule with the same name as the current firewall rule 502 can be identified at 510.

[0059] At position 520, it is determined whether the current firewall rule 502 and the identified historical firewall rules have the same count distribution. In one implementation, this can be based on... Figure 2 Operation 220 in the middle calculates the similarity between the current firewall rule 502 and the identified historical firewall rules, and compares the calculated similarity with a predetermined inheritance threshold.

[0060] In response to determining at 520 that the current firewall rule 502 and the identified historical firewall rule have an equivalent count distribution, for example, the calculated similarity is equal to or higher than the inheritance threshold, a tag inheritance operation can be performed at 530, for example, assigning the historical risk attribute tag of the identified historical firewall rule to the current firewall rule 502 as an intermediate risk attribute tag of the current firewall rule 502.

[0061] In response to the determination at 520 that the current firewall rule 502 and the identified historical firewall rules do not have an equivalent count distribution, for example, if the calculated similarity is below the inheritance threshold, the current firewall rule 502 can be marked as unknown, where the "unknown" risk attribute label is the intermediate risk attribute label of the current firewall rule 502.

[0062] By executing process 500 on each firewall rule in target firewall rule group 402, all firewall rules in target firewall rule group 402 will be assigned their own intermediate risk attribute tags.

[0063] Return to Figure 4The intermediate risk attribute markers of firewall rules in target firewall rule group 402 can be used to determine whether to attach a uniform, identical risk attribute marker to all firewall rules in target firewall rule group 402. In one implementation, at 420, it is determined whether the percentage of firewall rules in target firewall rule group 402 assigned a certain type of intermediate risk attribute marker is higher than a percentage threshold. Assuming that the intermediate risk attribute marker of that type can be risky or risk-free, and taking a percentage threshold of "65%" as an example, it can be determined at 420 whether the percentage of firewall rules in target firewall rule group 402 assigned a risky marker is higher than 65%, or whether the percentage of firewall rules in target firewall rule group 402 assigned a risk-free marker is higher than 65%.

[0064] In response to the determination at 420 that the percentage of firewall rules in firewall rule group 402 assigned an intermediate risk attribute label of a certain type is higher than a percentage threshold, at 430, the intermediate risk attribute label of that type can be broadcast in target firewall rule group 402, for example, by appending the intermediate risk attribute label of that type to all firewall rules in target firewall rule group 402. For example, assuming that the percentage of firewall rules assigned a risk label in target firewall rule group 402 is higher than 65%, the risk label can be appended to all firewall rules in target firewall rule group 402. Then, process 400 will end at 440.

[0065] In response to the determination at 420 that the ratio of firewall rules in firewall rule group 402 assigned with intermediate risk attribute tags of any type is not higher than the ratio threshold, intermediate risk attribute tags will not be broadcast in target firewall rule group 402, and process 400 will end directly at 440.

[0066] It should be understood that, Figure 4 In this context, the ratio threshold can be used for control: when most or a predetermined portion of the firewall rules in a firewall rule group have the same risk attribute tag, i.e., have the same risk attribute, it can be inferred that all firewall rules in that firewall rule group should have such a risk attribute, and thus can be attached with the same risk attribute tag.

[0067] Assuming the firewall rule in target firewall rule group 402 is initially represented as the tuple [RuleName, Location, Count, GroupID], where the GroupID field corresponds to target firewall rule group 402, then when the firewall rule is appended with a risk attribute label through procedure 400, the firewall rule can be represented as the updated tuple [RuleName, Location, Count, GroupID, Label], where the Label field is the risk attribute label appended through procedure 400. It should be understood that for... Figure 1 The process 100 together Figure 4 In the next iteration of process 400, the current firewall rule will become a historical firewall rule, and the current Label in the tuple will become a historical risk attribute marker.

[0068] Figure 6 A flowchart illustrating an exemplary method 600 for risk assessment of firewall rules in a data center according to an embodiment is shown. The data center may have multiple devices and be configured with multiple firewall rules.

[0069] At address 610, firewall rule configuration information for the aforementioned devices can be obtained.

[0070] At point 620, multiple device groups formed by the multiple devices can be identified.

[0071] At position 630, the count distribution of the multiple firewall rules across the multiple device groups can be determined.

[0072] At position 640, the multiple firewall rules can be clustered into multiple firewall rule groups based on the count distribution, with firewall rules in each firewall rule group having the same risk attributes.

[0073] In one implementation, the firewall rule configuration information may include firewall rules configured at each device.

[0074] In one implementation, the devices in each device group can have the same function or purpose.

[0075] In one implementation, the count distribution for each firewall rule may include the number of devices configured with the firewall rule in each of the plurality of device groups.

[0076] In one implementation, the clustering may include: clustering firewall rules with equivalent count distributions into the same firewall rule group.

[0077] In one implementation, the clustering may include: representing the count distribution of each firewall rule as a distribution vector of the firewall rule; calculating the similarity between two firewall rules using the distribution vectors of every two firewall rules among the plurality of firewall rules to form a similarity matrix; converting the similarity matrix into an adjacency matrix by applying a similarity threshold; constructing a graph representation of the adjacency matrix; and extracting multiple connected subgraphs from the graph representation that correspond to the plurality of firewall rule groups respectively.

[0078] The similarity threshold can be predetermined to make the plurality of connected subgraphs approximate the complete graph.

[0079] The similarity between any two firewall rules can be calculated based on cosine similarity or maximum relative distance similarity.

[0080] In one implementation, method 600 may further include: automatically attaching the same risk attribute tag to all firewall rules in each firewall rule group.

[0081] The risk attribute flag attached to a firewall rule can indicate whether the firewall rule is risky or risk-free.

[0082] The process of attaching the same risk attribute tag may include: assigning an intermediate risk attribute tag to each firewall rule in the firewall rule group through a historical risk attribute tag inheritance mechanism; determining whether the ratio of firewall rules in the firewall rule group that are assigned an intermediate risk attribute tag of one type is higher than a ratio threshold; and in response to determining that the ratio is higher than the ratio threshold, attaching an intermediate risk attribute tag of the type to all firewall rules in the firewall rule group.

[0083] The historical risk attribute tag inheritance mechanism may include: identifying a historical firewall rule with the same name as the current firewall rule; determining whether the current firewall rule and the historical firewall rule have the same count distribution; and in response to determining that the current firewall rule and the historical firewall rule have the same count distribution, assigning the historical risk attribute tag of the historical firewall rule to the current firewall rule as an intermediate risk attribute tag of the current firewall rule.

[0084] It should be understood that method 600 may also include any steps / processes for risk assessment of firewall rules in a data center according to the embodiments of the present disclosure described above.

[0085] Figure 7 An exemplary apparatus 700 for risk assessment of firewall rules in a data center, according to an embodiment, is shown. The data center may have multiple devices and be configured with multiple firewall rules.

[0086] The device 700 may include: a configuration information acquisition module 710, for acquiring firewall rule configuration information of the plurality of devices; a device group identification module 720, for identifying a plurality of device groups formed by the plurality of devices; a count distribution determination module 730, for determining the count distribution of the plurality of firewall rules on the plurality of device groups; and a clustering module 740, for clustering the plurality of firewall rules into a plurality of firewall rule groups based on the count distribution, wherein the firewall rules in each firewall rule group have the same risk attributes.

[0087] In addition, the apparatus 700 may also include any other modules configured for risk assessment of firewall rules in a data center according to the embodiments of the present disclosure described above.

[0088] Figure 8 An exemplary apparatus 800 for risk assessment of firewall rules in a data center, according to an embodiment, is shown. The data center may have multiple devices and be configured with multiple firewall rules.

[0089] The apparatus 800 may include: at least one processor 810; and a memory 820 storing computer-executable instructions. When the computer-executable instructions are executed, the at least one processor 810 may: obtain firewall rule configuration information of the plurality of devices; identify a plurality of device groups formed by the plurality of devices; determine the count distribution of the plurality of firewall rules on the plurality of device groups; and cluster the plurality of firewall rules into a plurality of firewall rule groups based on the count distribution, wherein the firewall rules in each firewall rule group have the same risk attributes.

[0090] In one implementation, the count distribution for each firewall rule may include the number of devices configured with the firewall rule in each of the plurality of device groups.

[0091] In one implementation, the clustering may include: clustering firewall rules with equivalent count distributions into the same firewall rule group.

[0092] In one implementation, the clustering may include: representing the count distribution of each firewall rule as a distribution vector of the firewall rule; calculating the similarity between two firewall rules using the distribution vectors of every two firewall rules among the plurality of firewall rules to form a similarity matrix; converting the similarity matrix into an adjacency matrix by applying a similarity threshold; constructing a graph representation of the adjacency matrix; and extracting multiple connected subgraphs from the graph representation that correspond to the plurality of firewall rule groups respectively.

[0093] In one implementation, the computer-executable instructions stored in the memory can also be executed to cause the at least one processor to automatically attach the same risk attribute tag to all firewall rules in each firewall rule group.

[0094] The process of attaching the same risk attribute tag may include: assigning an intermediate risk attribute tag to each firewall rule in the firewall rule group through a historical risk attribute tag inheritance mechanism; determining whether the ratio of firewall rules in the firewall rule group that are assigned an intermediate risk attribute tag of one type is higher than a ratio threshold; and in response to determining that the ratio is higher than the ratio threshold, attaching an intermediate risk attribute tag of the type to all firewall rules in the firewall rule group.

[0095] The historical risk attribute tag inheritance mechanism may include: identifying a historical firewall rule with the same name as the current firewall rule; determining whether the current firewall rule and the historical firewall rule have the same count distribution; and in response to determining that the current firewall rule and the historical firewall rule have the same count distribution, assigning the historical risk attribute tag of the historical firewall rule to the current firewall rule as an intermediate risk attribute tag of the current firewall rule.

[0096] In addition, at least one processor 810 can perform any other operation of the method for risk assessment of firewall rules in a data center according to the above embodiments of this disclosure.

[0097] Embodiments of this disclosure provide a computer program product for risk assessment of firewall rules in a data center. The data center may have multiple devices and be configured with multiple firewall rules. The computer program product may include a computer program executed by at least one processor for: obtaining firewall rule configuration information for the multiple devices; identifying multiple device groups formed by the multiple devices; determining a count distribution of the multiple firewall rules across the multiple device groups; and clustering the multiple firewall rules into multiple firewall rule groups based on the count distribution, wherein the firewall rules in each firewall rule group have the same risk attributes. Furthermore, the computer program in the computer program product may also be executed by at least one processor to perform any other operations of the method for risk assessment of firewall rules in a data center according to the embodiments of this disclosure described above.

[0098] Embodiments of this disclosure can be implemented on a non-transitory computer-readable medium. This non-transitory computer-readable medium may include instructions that, when executed, cause one or more processors to perform any operation of the method for risk assessment of firewall rules in a data center according to the embodiments of this disclosure described above.

[0099] It should be understood that all operations in the methods described above are merely exemplary, and this disclosure is not limited to any operation in the methods or the order of such operations, but should cover all other equivalent transformations under the same or similar conception.

[0100] It should also be understood that all modules in the apparatus described above can be implemented in various ways. These modules can be implemented as hardware, software, or a combination thereof. Furthermore, any of these modules can be further functionally divided into sub-modules or combined together.

[0101] Processors have been described in conjunction with various devices and methods. These processors can be implemented using electronic hardware, computer software, or any combination thereof. Whether these processors are implemented as hardware or software will depend on the specific application and the overall design constraints imposed on the system. As an example, the processors, any portions of processors, or any combinations of processors given in this disclosure can be implemented as microprocessors, microcontrollers, digital signal processors (DSPs), field-programmable gate arrays (FPGAs), programmable logic devices (PLDs), state machines, gate logic, discrete hardware circuits, and other suitable processing units configured to perform the various functions described in this disclosure. The functionality of the processors, any portions of processors, or any combinations of processors given in this disclosure can be implemented as software executed by a microprocessor, microcontroller, DSP, or other suitable platform.

[0102] Software should be broadly considered as representing instructions, instruction sets, code, code segments, program code, programs, subroutines, software modules, applications, software applications, software packages, routines, subroutines, objects, running threads, procedures, functions, etc. Software may reside on a computer-readable medium. Computer-readable media may include, for example, memory, which may be, for example, magnetic storage devices (e.g., hard disks, floppy disks, magnetic stripes), optical disks, smart cards, flash memory devices, random access memory (RAM), read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), registers, or removable disks. Although memory is shown as separate from the processor in several aspects set forth in this disclosure, memory may also reside within the processor (e.g., in caches or registers).

[0103] The above description is provided to enable any person skilled in the art to implement the various aspects described herein. Various modifications to these aspects will be apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects. Therefore, the claims are not intended to be limited to the aspects shown herein. All structural and functional equivalents of the elements of the various aspects described in this disclosure that are known or about to be known to those skilled in the art shall be covered by the claims.

Claims

1. A method for risk assessment of firewall rules in a data center, the data center having a plurality of devices and being configured with a plurality of firewall rules, the method comprising: obtaining firewall rule configuration information of the plurality of devices; identifying a plurality of device groups formed by the plurality of devices; determining a count distribution of the plurality of firewall rules over the plurality of device groups; and clustering the plurality of firewall rules into a plurality of firewall rule groups based on the count distribution, firewall rules in each firewall rule group having a same risk property.

2. The method of claim 1, wherein the firewall rule configuration information comprises firewall rules configured at each device.

3. The method of claim 1, wherein devices in each device group have a same function or purpose.

4. The method of claim 1, wherein the count distribution of each firewall rule comprises a number of devices in each of the plurality of device groups that are configured with the firewall rule. the clustering comprises:

5. The method of claim 1, wherein, clustering firewall rules having equivalent count distributions into a same firewall rule group. the clustering comprises:

6. The method of claim 1, wherein, representing the count distribution of each firewall rule as a distribution vector of the firewall rule; computing a similarity of each two of the plurality of firewall rules using their distribution vectors to form a similarity matrix; transforming the similarity matrix into an adjacency matrix by applying a similarity threshold; constructing a graph representation of the adjacency matrix; and extracting a plurality of connected subgraphs from the graph representation respectively corresponding to the plurality of firewall rule groups.

7. The method of claim 6, wherein the similarity threshold is predetermined such that the plurality of connected subgraphs approximate a complete graph.

8. The method of claim 6, wherein the similarity of each two firewall rules is computed based on a cosine similarity or a maximum relative distance similarity.

9. The method of claim 1, further comprising: automatically attaching a same risk property label to all firewall rules in each firewall rule group.

10. The method of claim 9, wherein the risk property label attached to a firewall rule indicates whether the firewall rule is risky or not risky. the attaching a same risk property label comprises:

11. The method of claim 9, wherein, assigning an intermediate risk property label to each firewall rule in the firewall rule group through a historical risk property label inheritance mechanism; determining whether a ratio of firewall rules in the firewall rule group that are assigned an intermediate risk property label of a type is higher than a ratio threshold; and in response to determining that the ratio is higher than the ratio threshold, attaching the intermediate risk property label of the type to all firewall rules in the firewall rule group. the historical risk property label inheritance mechanism comprises:

12. The method of claim 11, wherein, identifying a historical firewall rule having a same name as a current firewall rule; determining whether the current firewall rule and the historical firewall rule have equivalent count distributions; and if the current firewall rule and the historical firewall rule have equivalent count distributions, assigning an intermediate risk property label of a type to the current firewall rule. in response to determining that the current firewall rule and the historical firewall rule have an identical count distribution, assigning a historical risk attribute label of the historical firewall rule to the current firewall rule as an intermediate risk attribute label of the current firewall rule.

13. An apparatus for risk assessment of firewall rules in a data center, the data center having a plurality of devices and being configured with a plurality of firewall rules, the apparatus comprising: at least one processor, and a memory storing computer-executable instructions that, when executed, cause the at least one processor to: obtain firewall rule configuration information of the plurality of devices, identify a plurality of device groups formed by the plurality of devices, determine count distributions of the plurality of firewall rules over the plurality of device groups, and cluster the plurality of firewall rules into a plurality of firewall rule groups based on the count distributions, firewall rules in each of the firewall rule groups having a same risk attribute.

14. The apparatus of claim 13, wherein, the count distribution of each firewall rule comprises a number of devices in each of the plurality of device groups that are configured with the firewall rule.

15. The apparatus of claim 13, wherein, the clustering comprises: clustering firewall rules having an identical count distribution into a same firewall rule group.

16. The apparatus of claim 13, wherein, the clustering comprises: representing the count distribution of each firewall rule as a distribution vector of the firewall rule; computing a similarity of each two of the plurality of firewall rules using the distribution vectors of the two firewall rules to form a similarity matrix; transforming the similarity matrix into an adjacency matrix by applying a similarity threshold; constructing a graph representation of the adjacency matrix; and extracting a plurality of connected subgraphs from the graph representation respectively corresponding to the plurality of firewall rule groups.

17. The apparatus of claim 13, wherein, the computer-executable instructions stored in the memory are further executed to cause the at least one processor to: automatically append a same risk attribute label to all firewall rules in each of the firewall rule groups.

18. The apparatus of claim 17, wherein, the appending a same risk attribute label comprises: assigning an intermediate risk attribute label to each of the firewall rules in the firewall rule group through a historical risk attribute label inheritance mechanism; determining whether a ratio of the firewall rules in the firewall rule group that are assigned an intermediate risk attribute label of a type is higher than a ratio threshold; and in response to determining that the ratio is higher than the ratio threshold, appending the intermediate risk attribute label of the type to all firewall rules in the firewall rule group.

19. The apparatus of claim 18, wherein, the historical risk attribute label inheritance mechanism comprises: identifying a historical firewall rule having a same name as a current firewall rule; determining whether the current firewall rule and the historical firewall rule have an identical count distribution; and in response to determining that the current firewall rule and the historical firewall rule have an identical count distribution, assigning a historical risk attribute label of the historical firewall rule to the current firewall rule as an intermediate risk attribute label of the current firewall rule.

20. A computer program product for risk assessment of firewall rules in a data center, the data center having a plurality of devices and being configured with a plurality of firewall rules, the computer program product comprising a computer program executed by at least one processor for: obtaining firewall rule configuration information of the plurality of devices; identifying a plurality of device groups formed by the plurality of devices; determining a count distribution of the plurality of firewall rules over the plurality of device groups; and clustering the plurality of firewall rules into a plurality of firewall rule groups based on the count distribution, the firewall rules in each firewall rule group having a same risk property.

Images