A loose policy analysis method and device

Abstract

To address the optimization issues of firewall policy complexity and security, the inventors have proposed a loose policy analysis method, including establishing a firewall looseness scoring mechanism and a convergence analysis mechanism. After collecting and parsing firewall policy hit logs, the parsed hit logs are subjected to convergence analysis using the convergence analysis mechanism and the firewall looseness scoring mechanism. Finally, the convergence analysis results are displayed as a two-dimensional graph with the number of modifiable policies as the horizontal axis and the looseness score as the vertical axis. This graph provides users with summary information that can objectively evaluate the necessity of looseness or tightness of firewall security policies, allowing users to intuitively find a balance between policy management costs and security requirements based on actual business conditions.

Description

Technical Field

[0001] The present invention relates to the field of computer software, and in particular to a loose policy method and device in the technical field of firewalls. Background Art

[0002] For historical reasons, enterprises often maintain relatively loose access control policies during firewall policy operation and maintenance, such as (allow, 192.168.0.0 / 16, 172.21.2.10, TCP, any). This policy allows the 192.168.0.0 / 16 network segment to access all TCP ports on the IP address 172.21.2.10. As business grows and time accumulates, tens of thousands of hosts within the 192.168.0.0 / 16 network segment use this policy to access services provided by 172.21.2.10.

[0003] With the increasing demands of industry security regulations and security assessments, the overly permissive access scope of such policies poses a security risk. It is necessary to break down these permissive policies into multiple, more specific ones, narrowing the access scope and improving security without impacting business operations. This presents a convergence issue with permissive firewall policies: Tighter policies offer higher security, but require more firewall policies to be added and managed, resulting in higher management costs. A looser policy offers lower security but lower management costs. Summary of the Invention

[0004] In order to solve the problem of determining the suitability of a loose policy, the present invention proposes the following technical solution: a loose policy analysis method, comprising the following steps:

[0005] Establish a firewall permissiveness scoring mechanism;

[0006] Collect and parse firewall policy hit logs;

[0007] Establishing a convergence analysis mechanism, and performing convergence analysis on the hit log after parsing using the convergence analysis mechanism and the firewall's looseness scoring mechanism;

[0008] The convergence analysis result is displayed in a two-dimensional graph with the number of modifiable strategies as the horizontal axis and the looseness score as the vertical axis;

[0009] The leniency scoring mechanism of the firewall is the sum of part or all of the following: a basic score, an Any score that is positively correlated with the number of Anys, an IP score that is negatively correlated with the prefix value of the IP CIDR, and a port score; the protection strategy includes an action, a source address, a destination address, a protocol, or a port. Furthermore, the leniency strategy analysis method is characterized in that the leniency scoring mechanism of the firewall includes the sum of the following: a basic score of 1, an IP score of 33-prefix, a port score, and an Any score of 33 times the number of Anys.

[0010] Furthermore, in the loose policy analysis method, the "collecting and parsing the firewall policy hit log" specifically includes: collecting the firewall policy hit log through the syslog protocol; performing data processing on the collected firewall policy hit log and extracting unified session information; and storing the parsed data in the data cluster.

[0011] Furthermore, in the relaxed policy analysis method, the "extracting unified session information" specifically includes: merging hit log data with the same source address, destination address, protocol and port into one item, counting it as 1 in the hit number, and obtaining session information.

[0012] Furthermore, in the relaxed policy analysis method, the analysis mechanism specifically includes: receiving service subnet partitioning parameters; performing dynamic programming based on the service subnet partitioning parameters, and the dynamic programming recursive formula used is:

[0013] f[cidr[k]]=max(f[cidr[k] src +f[cidr[k]] dst +f[1])

[0014] f[1]=(permissiveness: 3, policies: all);

[0015] Where k is the number of subnet types received;

[0016] f[1] indicates the activation of all hit logs

[0017] f[cidr[k]] src Refers to the looseness score of aggregating the original address according to a certain subnet;

[0018] f[cidr[k]] dst Refers to the looseness score of the destination address aggregation based on a certain subnet;

[0019] Max means taking the one with the lower easing score under the same number of strategies.

[0020] The inventors also proposed a loose policy analysis device, comprising a mechanism establishment unit, a log processing unit, a convergence analysis unit, and a graphing unit. The mechanism establishment unit is used to establish a looseness scoring mechanism for a firewall. The log processing unit is used to collect and parse firewall policy hit logs. The mechanism establishment unit is also used to establish a convergence analysis mechanism. The convergence analysis unit is used to perform convergence analysis on the parsed hit logs using the convergence analysis mechanism and the looseness scoring mechanism of the firewall. The graphing unit is used to display the convergence analysis results as a two-dimensional graph with the number of modifiable policies as the horizontal axis and the looseness score as the vertical axis.

[0021] Among them, the firewall relaxation scoring mechanism established by the mechanism establishment unit is the partial or complete sum of the following items: the basic score, the Any score positively correlated with the number of Anys, the IP score negatively correlated with the IP CIDR prefix value, and the port score; the protection strategy includes action, source address, destination address, protocol or port.

[0022] Furthermore, in the loose policy analysis device, the looseness scoring mechanism of the firewall includes the sum of the following items: a basic score of 1, an IP score of 33-prefix, a port score, and an Any score of 33 times the number of Any.

[0023] Furthermore, in the loose policy analysis device, the log processing unit "collects and parses the firewall policy hit log" specifically includes: collecting the firewall policy hit log through the syslog protocol; performing data processing on the collected firewall policy hit log and extracting unified session information; and storing the data after parsing in the data cluster.

[0024] Furthermore, in the loose policy analysis device, the "extracting unified session information" specifically includes: merging hit log data with the same source address, destination address, protocol and port into one item, counting it as 1 in the hit number, and obtaining the session information.

[0025] Furthermore, in the loose policy analysis device, the analysis mechanism specifically includes: receiving a service subnet partition parameter; performing dynamic programming based on the service subnet partition parameter, and the dynamic programming recursive formula used is:

[0026] f[cidr[k]]=max(f[cidr[k]] src +f[cidr[k]] dst +f[1])

[0027] f[1]=(permissiveness: 3, policies: αll);

[0028] Where k is the number of subnet types received;

[0029] f[1] indicates the activation of all hit logs

[0030] f[cidr[k]] src Refers to the looseness score of aggregating the original address according to a certain subnet;

[0031] f[cidr[k]] dst Refers to the looseness score of the destination address aggregation based on a certain subnet;

[0032] Max means taking the one with the lower easing score under the same number of strategies.

[0033] Compared with the existing technology, the method proposed in the present invention can objectively evaluate the necessary degree of tightness of firewall security policies and enable users to intuitively find the balance between policy management costs and security requirements based on actual business conditions. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a flow chart of the loose policy analysis method of the present invention;

[0035] Figure 2 This is a structural diagram of the loose policy analysis device described in the present invention.

[0036] Description of reference numerals:

[0037] 1-Mechanism establishment unit;

[0038] 2-Log processing unit;

[0039] 3-Convergence Analysis Unit;

[0040] 4-Graphing Unit DETAILED DESCRIPTION

[0041] In order to explain the technical content, structural features, achieved objectives and effects of the technical solution in detail, the following is a detailed description in conjunction with specific embodiments and accompanying drawings.

[0042] See also Figure 1 , is a flow chart of a loose policy analysis method according to the present invention; the method includes the following steps:

[0043] S1. Establish a firewall looseness scoring mechanism;

[0044] S2. Collect and parse the firewall policy hit logs;

[0045] S3. Establish a convergence analysis mechanism, and perform convergence analysis on the hit log after parsing using the convergence analysis mechanism and the firewall's looseness scoring mechanism;

[0046] S4. Displaying the convergence analysis result in a two-dimensional graph with the number of modifiable strategies as the horizontal axis and the looseness score as the vertical axis;

[0047] The leniency scoring mechanism of the firewall is the sum of part or all of the following: a basic score, an Any score that is positively correlated with the number of Anys, an IP score that is negatively correlated with the prefix value of the IP CIDR, and a port score; the protection strategy includes an action, a source address, a destination address, a protocol, or a port. Furthermore, the leniency strategy analysis method is characterized in that the leniency scoring mechanism of the firewall includes the sum of the following: a basic score of 1, an IP score of 33-prefix, a port score, and an Any score of 33 times the number of Anys.

[0048] The "collecting and parsing firewall policy hit logs" described in step S2 specifically includes: collecting firewall policy hit logs via the syslog protocol; processing the collected firewall policy hit logs to extract unified session information; and storing the parsed data in a data cluster. In other embodiments, "extracting unified session information" specifically includes: merging hit log data with the same source address, destination address, protocol, and port into one item, counting it as 1 in the hit count, and obtaining the session information.

[0049] Furthermore, in some embodiments, the analysis mechanism specifically includes: receiving a service subnet partition parameter; performing dynamic programming based on the service subnet partition parameter, and the dynamic programming recursive formula used is:

[0050] f[cidr[k]]=max(f[cidr[k] src +f[cidr[k]] dst +f[1])

[0051] f[1]=(permissiveness: 3, policies: all):

[0052] Where k is the number of subnet types received;

[0053] f[1] indicates the activation of all hit logs

[0054] f[cidr[k]] src Refers to the looseness score of aggregating the original address according to a certain subnet;

[0055] f[cidr[k]] dst Refers to the looseness score of the destination address aggregation based on a certain subnet;

[0056] Max means taking the one with the lower easing score under the same number of strategies.

[0057] The inventors also proposed a loose policy analysis device, comprising a mechanism establishment unit 1, a log processing unit 2, a convergence analysis unit 3, and a graphing unit 4. The mechanism establishment unit 1 is used to establish a looseness scoring mechanism for the firewall; the log processing unit 2 is used to collect and parse firewall policy hit logs; the mechanism establishment unit 1 is also used to establish a convergence analysis mechanism; the convergence analysis unit 3 is used to perform convergence analysis on the parsed hit logs using the convergence analysis mechanism and the looseness scoring mechanism of the firewall; the graphing unit 4 is used to display the convergence analysis results as a two-dimensional image with the number of modifiable policies as the horizontal axis and the looseness score as the vertical axis.

[0058] Among them, the firewall relaxation scoring mechanism established by the mechanism establishment unit 1 is the partial or complete sum of the following items: the basic score, the Any score positively correlated with the number of Anys, the IP score negatively correlated with the prefix value of the IP CIDR, and the port score; the protection strategy includes action, source address, destination address, protocol or port.

[0059] In a preferred embodiment, the firewall's laxity scoring mechanism includes the sum of the following: a base score of 1, an IP score of 33-prefix, a port score, and an Any score of 33 times the Any number.

[0060] In some embodiments, the log processing unit 2 "collecting and parsing firewall policy hit logs" specifically includes: collecting firewall policy hit logs via the syslog protocol; processing the collected firewall policy hit logs to extract unified session information; and storing the parsed data in a data cluster. Furthermore, "extracting unified session information" specifically includes: merging hit log data with the same source address, destination address, protocol, and port into one item, counting it as 1 in the hit count, to obtain the session information.

[0061] In some implementations, the analysis mechanism specifically includes: receiving a service subnet partition parameter; performing dynamic programming based on the service subnet partition parameter, wherein the dynamic programming recursive formula used is:

[0062] f[cidr[k]]=max(f[cidr[k]] src +f[cidr[k]]dst +f[1])

[0063] f[1]=(permissiveness: 3, policies: αll);

[0064] Where k is the number of subnet types received;

[0065] f[1] indicates the activation of all hit logs

[0066] f[cidr[k]] src Refers to the looseness score of aggregating the original address according to a certain subnet;

[0067] f[cidr[k]] dst Refers to the looseness score of the destination address aggregation based on a certain subnet;

[0068] Max means taking the one with the lower easing score under the same number of strategies.

[0069] Since the loose policy analysis device proposed by the inventor is essentially used to implement the above-mentioned loose policy analysis method, the following uses a specific loose policy analysis device to implement the corresponding loose policy analysis method as an example to illustrate the two:

[0070] Mechanism Establishment Unit 1 established a firewall policy laxity scoring mechanism, with a firewall policy laxity score ranging from 1 to 100. The scoring mechanism is detailed in Table 1:

[0071] Table 1 Firewall policy permissiveness scoring mechanism

[0072]

[0073] For example, Table 2 shows the leniency scores for a range of different strategies:

[0074] Table 2 Examples of leniency scores corresponding to different strategies

[0075]

[0076]

[0077] As shown in Table 2, the larger the access scope allowed by the policy, the higher the permissiveness score, indicating a lower policy security. Conversely, the smaller the access scope allowed by the policy, the lower the permissiveness score, indicating a higher policy security.

[0078] Log processing unit 2 is responsible for collecting, parsing, and storing firewall policy hit logs. The collection is mainly carried out through the syslog protocol, with the firewall configuring the syslog server to the corresponding address and port of the log collector. Logs in different formats from different brands of firewalls are received, and data is processed to extract unified session information Session, which is then stored in the data cluster.

[0079] For example, the original hit log of a Huawei device is:

[0080]

[0081] The Session data formed after parsing is:

[0082]

[0083]

[0084] Relaxed policies are typically configured due to urgent business needs or incomplete standardization. Theoretically, for IPv4 policies, the maximum permissible TCP connection relationship can reach 2^80, and for IPv6 policies, 2^272. Convergence analysis based on policy hit log data requires a certain period of data accumulation to accurately reflect actual business access relationships. This avoids missing data for periodic business access due to insufficient time coverage, which could result in inaccessible business systems after convergence, such as the annual year-end settlement of banking systems. Furthermore, the long-term collection of hit logs also poses challenges in analyzing massive amounts of data.

[0085] Taking a loose policy (permit, any, any, tcp, 80) as an example, to converge the tower, based on the access characteristics of the service, log processing unit 2 collected logs for one day and collected a total of 10 hit records, as shown below:

[0086] Table 3 Hit log example

[0087] Record Source Address Destination Address protocol port 1 10.10.10.5 10.10.11.6 TCP 80 2 10.10.10.5 10.10.11.6 TCP 80 3 10.10.10.5 10.10.11.6 TCP 80 4 10.10.10.5 10.10.11.6 TCP 80 5 10.10.10.5 10.10.11.7 TCP 80 6 10.10.10.5 10.10.11.7 TCP 80 7 10.10.10.5 10.10.12.3 TCP 80 8 10.10.10.5 10.10.12.3 TCP 80 9 10.10.10.5 10.10.12.3 TCP 80 10 10.10.10.5 10.10.12.4 TCP 80

[0088] For hit logs, the data can be statistically merged by TCP session. Data with the same source address, destination address, protocol, and port number can be merged into one item. The hit count is added by 1 to obtain the session data, as shown in Table 4:

[0089] Table 4. Session data

[0090] Session Source Address Destination Address protocol port Number of hits 1 10.10.10.5 10.10.11.6 TCP 80 4 2 10.10.10.5 10.10.11.7 TCP 80 2 3 10.10.10.5 10.10.12.3 TCP 80 3 4 10.10.10.5 10.10.12.4 TCP 80 1

[0091] The convergence analysis mechanism established in Mechanism Establishment Unit 1 optimizes the dynamic programming-based analysis method by introducing service subnetting parameters as factors in the convergence analysis algorithm. This reduces the time complexity from O(n^32) to O(n^k), where k is the number of subnetting types and n is the number of hit logs. For example, if the subnetting types are / 24 and / 26, then k is 2. The dynamic programming recursive formula for the convergence analysis unit is:

[0092] f[cidr[k]]=max(f[cidr[k]] src +f[cidr[k]] dst +f[1])

[0093] f[1]=(permissiveness: 3, policies: all)

[0094] Among them, f[1] represents the session activation policy of all hit logs. The number of activation policies required is the number of sessions, and the maximum permissiveness score is 3.

[0095] For example, for the session data in Table 4, when the user wants to converge the original policy to the / 32 and / 24 policies, the dynamic programming calculation process is as follows:

[0096] f[1], that is, using the strategy of cidr / 32 for convergence, the following convergence results are obtained:

[0097] Table 5: The original strategy converges to the strategy with relaxation of 3

[0098] Strategy action Source Address Destination Address protocol port Laxity score 1 permit 10.10.10.5 / 32 10.10.11.6 / 32 TCP 80 3 2 permit 10.10.10.5 / 32 10.10.11.7 / 32 TCP 80 3 3 permit 10.10.10.5 / 32 10.10.12.3 / 32 TCP 80 3 4 permit 10.10.10.5 / 32 10.10.12.4 / 32 TCP 80 3

[0099] As shown in the table above, when the user selects the converged subnet parameter of / 32, the convergence analysis results in the original policy being split into four detailed policies, each with a looseness score of 3.

[0100] The convergence analysis of the / 24 strategy is as follows: src +f[cidr[k]] dst +f[1]), as shown, it is necessary to take the optimal value of the looseness among the three based on the source address convergence data of / 24, the destination address convergence data of / 24 and the convergence data of / 32.

[0101] f[ / 24] src This indicates that source addresses are aggregated based on the / 32 subnet and divided into / 24 subnets. The results are as follows:

[0102] Table 6. Aggregation results for source addresses using / 24

[0103] Strategy action Source Address Destination Address protocol port Laxity score 1 permit 10.10.10.0 / 24 10.10.11.6 / 32 TCP 80 10 2 permit 10.10.10.0 / 24 10.10.11.7 / 32 TCP 80 10 3 permit 10.10.10.0 / 24 10.10.12.3 / 32 TCP 80 10 4 permit 10.10.10.0 / 24 10.10.12.4 / 32 TCP 80 10

[0104] As can be seen in the table above, the original strategy is split into four detailed strategies, and the looseness score of each strategy is 10.

[0105] And f[ / 24] dst This indicates that the destination address is aggregated based on the / 32 subnet and divided into / 24 subnets. The results are shown in Table 7:

[0106] Table 7: Aggregation results of / 24 for destination address

[0107] Strategy action Source Address Destination Address protocol port Laxity score 1 permit 10.10.10.0 / 24 10.10.11.0 / 24 TCP 80 20 2 permit 10.10.10.0 / 24 10.10.12.0 / 32 TCP 80 20

[0108] As shown in the table above, the result of the / 24 aggregation analysis of the destination address is that the original policy is split into two detailed policies, each with a permissiveness score of 20.

[0109] In the above calculation process, the calculation logic of the max function removes the data in Table 6 (this is because when the number of strategies in Table 5 and Table 6 is the same, Table 5 has a better degree of flexibility, or higher security), and obtains the optimized result.

[0110] Table 8 Convergence analysis results

[0111] Strategy convergence analysis results Number of strategies Laxity score Dataset / 32 4 3 Table 5 / 24 2 20 Table 7

[0112] After the above analysis process of the convergence analysis unit 3, the results of the convergence analysis according to different subnets can be obtained as shown in Table 8; then, in order to more intuitively show the relationship between the number of policies and the leniency score in the convergence analysis results, the drawing unit 4 uses a two-dimensional data graph for presentation, with the number of modifiable policies as the horizontal axis and the leniency score as the vertical axis to display the convergence analysis processing results as a two-dimensional image. For example, if the data in Table 8 is drawn, there are 2 points on the graph, namely the point with a leniency score of 3 on the vertical axis and a number of policies of 4 on the horizontal axis, and the point with a leniency score of 20 on the vertical axis and a number of policies of 2 on the horizontal axis. In this way, users can more intuitively find the balance between policy management costs and security requirements based on actual business conditions.

[0113] As described above, the method proposed in the present invention can objectively evaluate the necessary degree of tightness of firewall security policies and enable users to intuitively find the balance between policy management costs and security requirements based on actual business conditions.

[0114] It should be noted that, in this document, relational terms such as first and second, etc., are used solely to distinguish one entity or operation from another, and do not necessarily require or imply any actual relationship or order between these entities or operations. Furthermore, the terms "include," "comprise," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or terminal device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. Without further limitation, elements defined by the phrase "include..." or "comprising..." do not exclude the presence of additional elements in the process, method, article, or terminal device comprising the elements. Furthermore, in this document, "greater than," "less than," "exceeding," etc., are understood to exclude the number itself; "above," "below," "within," etc., are understood to include the number itself.

[0115] Those skilled in the art will appreciate that the above embodiments may be provided as methods, devices, or computer program products. These embodiments may take the form of fully hardware embodiments, fully software embodiments, or embodiments combining software and hardware. All or part of the steps in the methods involved in the above embodiments may be completed by instructing the relevant hardware through a program, and the program may be stored in a storage medium readable by a computer device for executing all or part of the steps described in the methods of the above embodiments. The computer device includes, but is not limited to, personal computers, servers, general-purpose computers, special-purpose computers, network devices, embedded devices, programmable devices, smart mobile terminals, smart home devices, wearable smart devices, in-vehicle smart devices, etc.; the storage medium includes, but is not limited to, RAM, ROM, magnetic disks, magnetic tapes, optical disks, flash memory, USB flash drives, mobile hard disks, memory cards, memory sticks, network server storage, network cloud storage, etc.

[0116] The above embodiments are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as the combination of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a computer device to generate a machine, so that the instructions executed by the processor of the computer device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0117] These computer program instructions can also be stored in a computer device readable memory that can guide a computer device to work in a specific manner, so that the instructions stored in the computer device readable memory produce a product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0118] These computer program instructions can also be loaded onto a computer device so that a series of operating steps are executed on the computer device to produce a computer-implemented process, whereby the instructions executed on the computer device provide for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0119] Although the above embodiments have been described, those skilled in the art may make additional changes and modifications to these embodiments once they know the basic creative concepts. Therefore, the above descriptions are merely embodiments of the present invention and do not limit the scope of patent protection of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention's description and drawings, or directly or indirectly applied in other related technical fields, are also included in the scope of patent protection of the present invention.

Claims

1. A loose policy analysis method, characterized in that: The steps include: Establish a firewall permissiveness scoring mechanism; Collect and parse firewall policy hit logs; A convergence analysis mechanism is established, and the convergence analysis is performed on the hit log after parsing using the convergence analysis mechanism and the firewall's looseness scoring mechanism. The convergence analysis mechanism specifically includes: receiving service subnet partitioning parameters; performing dynamic programming based on the service subnet partitioning parameters, and the dynamic programming recursive formula used is: ； Where permissiveness refers to the maximum permissiveness score; k is the number of subnet types received; f[1] indicates the activation of all hit logs; f[cidr[k]] src Refers to the looseness score of aggregating the original address according to a certain subnet; f[cidr[k]] dst Refers to the leniency score of the destination addresses aggregated according to a certain subnet; max refers to the lower leniency score under the same number of policies; The convergence analysis result is displayed in a two-dimensional graph with the number of modifiable strategies as the horizontal axis and the looseness score as the vertical axis; The firewall's laxity scoring mechanism is the partial or complete sum of the following: the base score, the Any score positively correlated with the number of Anys, the IP score negatively correlated with the IP CIDR prefix value, and the port score; the protection strategy includes action, source address, destination address, protocol, or port.

2. The loose policy analysis method according to claim 1, characterized in that: The firewall's laxity scoring mechanism includes the sum of the following: a base score of 1, an IP score equal to 33-prefix, a port score, and an Any score equal to 33 times the number of Anys.

3. The loose policy analysis method according to claim 1, characterized in that: The "collecting and parsing the firewall policy hit log" specifically includes: collecting the firewall policy hit log through the syslog protocol; processing the collected firewall policy hit log and extracting unified session information; and storing the parsed data in the data cluster.

4. The loose policy analysis method according to claim 3, characterized in that: The "extracting unified session information" specifically includes: merging hit log data with the same source address, destination address, protocol and port into one item, counting it as 1 in the hit number, and obtaining the session information.

5. A loose policy analysis device, characterized in that: The system comprises a mechanism establishment unit, a log processing unit, a convergence analysis unit and a drawing unit; the mechanism establishment unit is used to establish a firewall looseness scoring mechanism; the log processing unit is used to collect and parse the firewall policy hit log; the mechanism establishment unit is also used to establish a convergence analysis mechanism, and the convergence analysis unit is used to perform convergence analysis on the hit log after parsing using the convergence analysis mechanism and the firewall looseness scoring mechanism; the convergence analysis mechanism specifically comprises: receiving a service subnet partition parameter; performing dynamic programming based on the service subnet partition parameter, and the dynamic programming recursive formula used is: ； Where permissiveness refers to the maximum permissiveness score; k is the number of subnet types received; f[1] indicates the activation of all hit logs; f[cidr[k]] src Refers to the looseness score of aggregating the original address according to a certain subnet; f[cidr[k]] dst Refers to the leniency score of the destination addresses aggregated according to a certain subnet; max refers to the lower leniency score under the same number of policies; The graphing unit is used to display the convergence analysis result as a two-dimensional image with the number of modifiable strategies as the horizontal axis and the looseness score as the vertical axis; Among them, the firewall relaxation scoring mechanism established by the mechanism establishment unit is the partial or complete sum of the following items: the basic score, the Any score positively correlated with the number of Anys, the IP score negatively correlated with the IP CIDR prefix value, and the port score; the protection strategy includes action, source address, destination address, protocol or port.

6. The loose policy analysis device according to claim 5, characterized in that: The firewall's laxity scoring mechanism includes the sum of the following: a base score of 1, an IP score equal to 33-prefix, a port score, and an Any score equal to 33 times the number of Anys.

7. The loose policy analysis device according to claim 5, characterized in that: The log processing unit "collects and parses the firewall policy hit log" specifically includes: collecting the firewall policy hit log through the syslog protocol; processing the collected firewall policy hit log and extracting unified session information; and storing the parsed data in the data cluster.

8. The loose policy analysis device according to claim 7, characterized in that: The "extracting unified session information" specifically includes: merging hit log data with the same source address, destination address, protocol and port into one item, counting it as 1 in the hit number, and obtaining the session information.

Images