Host firewall software strategy collection and analysis method

Abstract

The invention relates to the technical field of computers, and discloses a host firewall software strategy collection and analysis method. The method comprises the steps of S1, deploying acquisition agents in a distributed manner, and acquiring policy data of a host firewall; s2, carrying out standardized analysis and storage on the collected data; s3, uploading the standardized strategy data to a central management node through an incremental synchronization mechanism; s4, constructing a rule dependency graph based on the rule data at the central management node; and S5, performing conflict detection and redundancy analysis on the host firewall rule by using the rule dependency graph. Priority conflict, coverage conflict and mutual exclusion conflict detection is performed on the rule set through the rule dependency graph, the priority conflict detection ensures the execution logic consistency of the rule, the coverage conflict detection reduces the redundant execution of the rule, and the mutual exclusion conflict detection avoids the rule combination of logic contradictions. And through systematic conflict detection, the execution accuracy and reliability of the rule set are remarkably improved.

Description

Technical Field

[0001] The invention relates to the field of computer technology, and in particular to a method for collecting and analyzing host firewall software policies. Background Art

[0002] With the rapid development of computer network technology, host firewall software, as an important security protection tool, has been widely used in various computer systems. Host firewall software controls network traffic by setting rules to ensure network security and the integrity of host resources. However, with the complexity of the network environment and the increase in the number of hosts, the collection and analysis of host firewall software policies face the following key issues.

[0003] Due to the differences in the implementation methods and rule formats of different firewall software, it is difficult to efficiently collect and uniformly manage policy data. This dispersion increases the complexity of policy management and makes centralized analysis of policies difficult.

[0004] In a complex network environment, logical conflicts and redundancies are prone to occur between host firewall policy rules. Multiple policies may cover the same condition range but have opposite actions, or the condition range of some rules may be completely included by other rules. These problems will affect the execution effect of the policy and increase the management and computing burden of the firewall.

[0005] Therefore, the present invention provides a method for collecting and analyzing host firewall software policies. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a method for collecting and analyzing host firewall software policies, which solves the problems that different firewall software have different implementation methods and rule formats, logical conflicts and redundancies are prone to occur between policy rules, and multiple policies may cover the same range of conditions but have opposite actions.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: a method for collecting and analyzing host firewall software policies, comprising the following steps;

[0008] S1, distributed deployment of collection agents to collect policy data from host firewalls;

[0009] S2. Standardizing and analyzing the collected data and storing them;

[0010] S3, upload the standardized policy data to the central management node through the incremental synchronization mechanism;

[0011] S4. At the central management node, a rule dependency graph is constructed based on the rule data;

[0012] S5. Use the rule dependency graph to perform conflict detection and redundancy analysis on host firewall rules;

[0013] S6. Generate optimization suggestions based on the analysis results, and display conflicting rules, redundant rules and optimization solutions through visualization tools.

[0014] Preferably, the standardized solution in step S2 parses the source address, destination address, protocol, port, action and priority of the host firewall rule to generate a unified data structure.

[0015] Preferably, the step S3 specifically includes:

[0016] S3.1. Preprocessing the data source, including deduplication, formatting and integrity check

[0017] S3.2. Generate a unique hash value for each data source record;

[0018] S3.3. Compare the hash value of the current data source with the stored hash value. When the comparison results are different and the data source passes the integrity check, it is determined to be new or modified policy data.

[0019] S3.4. Upload the newly added or modified policy data to the central management node, and retain the corresponding hash value for subsequent comparison.

[0020] Preferably, the data construction in step S4 specifically includes:

[0021] S4.1. Model the host firewall rules as a graph structure. The rules are represented as nodes of the graph. The attributes of the nodes include source address range, destination address range, protocol type, port range, priority and action.

[0022] S4.2. Define the edge relationships between nodes. The edge types include covering relationship, conflict relationship and inclusion relationship.

[0023] S4.3, determine the edge relationship based on the non-emptiness and regular behavior of the intersection;

[0024] S4.4. Generate a rule dependency graph based on the above rules and relationships for subsequent analysis.

[0025] Preferably, the edge relationship includes:

[0026] When the intersection is non-empty and the behavior is consistent, it is marked as a containment relationship;

[0027] When the intersection is non-empty and the behaviors are opposite, it is marked as a conflicting relationship;

[0028] When the conditions of one rule completely include another rule, it is marked as an overlapping relationship.

[0029] Preferably, the conflict detection in step S5 includes

[0030] Priority conflict detection: detects rules with overlapping matching conditions but opposite behaviors;

[0031] Overlay conflict detection: detect whether the high-priority rule completely covers the low-priority rule;

[0032] Mutually exclusive conflict detection: detects rules that cannot be satisfied simultaneously logically.

[0033] Preferably, the priority conflict detection specifically includes:

[0034] Traverse all nodes in the rule dependency graph, and the conditional scope of each node is expressed as:

[0035] C={SourceIP,DestinationIP,Protocol,Port}

[0036] For each pair of rule nodes R1 and R2, the conditional range intersection is calculated. The intersection formula is:

[0037] C intersection =C1∩C2

[0038] If the intersection Then the conditional scopes of the two rules overlap;

[0039] Determine whether the behaviors conflict. If the following conditions are met, mark them as priority conflicts:

[0040]

[0041] Action1≠Action2, where Action i The action that expresses the rule;

[0042] For rule pairs with conflicting priorities, they are sorted according to their priority attributes. The rules with higher priorities are executed first, and the rules with lower priorities may become invalid.

[0043] Output all rule pairs marked as priority conflicts and their conflict details for subsequent optimization analysis.

[0044] Preferably, the coverage conflict detection sorts the nodes in the rule dependency graph by priority, uses depth-first search to traverse the coverage relationship between rule nodes, and if the condition range of the high-priority rule completely contains the low-priority rule and the behavior is consistent or conflicting, it is marked as a coverage conflict.

[0045] Preferably, the redundancy analysis in step S5 specifically includes:

[0046] Explicit redundancy detection: compare all attributes of the rules. If the attributes of two rules are exactly the same, they are marked as explicitly redundant:

[0047] R1=R2

[0048] Where R i =(SourceIP,DestinationIP,Protocol,Port,Action)

[0049] Implicit redundancy detection: Analyze the inclusion relationship of rule condition scopes. If the condition scope C1 of one rule is completely included by the condition scope C2 of another rule and the behaviors are consistent, it is marked as implicit redundancy:

[0050] And Action1=Action2

[0051] Output conflict detection and redundancy analysis results for subsequent optimization suggestion generation.

[0052] Preferably, the optimization suggestion in step S6 includes:

[0053] For rules with conflicting priorities, adjust the condition scope of the rule with lower priority;

[0054] For rule pairs with coverage conflicts, delete the low-priority rule and adjust the condition scope of the low-priority rule to exclude the covered part;

[0055] For explicitly redundant rules, delete identical rules and keep only one rule;

[0056] For implicitly redundant rules, merge the completely included rules and use the larger scope of the included rules as the scope of the merged rule conditions.

[0057] The present invention provides a method for collecting and analyzing host firewall software policies. It has the following beneficial effects:

[0058] 1. The present invention detects priority conflicts, coverage conflicts and mutual exclusion conflicts in rule sets through rule dependency graphs. Priority conflict detection ensures the logical consistency of rule execution, coverage conflict detection reduces redundant rule execution, and mutual exclusion conflict detection avoids logically contradictory rule combinations. Through systematic conflict detection, the execution accuracy and reliability of the rule set are significantly improved.

[0059] 2. The present invention realizes the real-time collection of firewall policy data in a multi-host environment through distributed deployment of collection agents. The collection agents are compatible with multiple platforms and support multi-threaded concurrent operations, which greatly improves the efficiency of rule collection. At the same time, the data is uniformly stored in the central management node, providing efficient centralized management for the rule set in a complex network environment.

[0060] 3. The present invention adopts an incremental synchronization mechanism to upload only newly added or modified policy data to the central management node. By generating a unique hash value for the rule, any field changes in the rule are accurately identified to avoid repeated transmission. This approach significantly reduces the redundancy of data transmission, improves bandwidth utilization and overall system performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the specification of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] Please refer to the attached Figure 1 , an embodiment of the present invention provides a method for collecting and analyzing host firewall software policies, comprising the following steps;

[0064] S1, distributed deployment of collection agents to collect policy data from host firewalls;

[0065] S2. Standardizing and analyzing the collected data and storing them;

[0066] S3, upload the standardized policy data to the central management node through the incremental synchronization mechanism;

[0067] S4. At the central management node, a rule dependency graph is constructed based on the rule data;

[0068] S5. Use the rule dependency graph to perform conflict detection and redundancy analysis on host firewall rules;

[0069] S6. Generate optimization suggestions based on the analysis results and display conflicting rules, redundant rules and optimization solutions through visualization tools;

[0070] Specifically, in step S1, the collection agent is installed on each host in the form of lightweight software and runs as an independent process. The agent extracts policy information through the interface or configuration file of the local firewall and uploads the collected data to the regional aggregation node. The agent adopts a multi-threaded structure to achieve task separation between collection, firewall interface access and data processing, which improves the concurrent efficiency of collection and extracts rule data from the firewall of the local host. The extraction method varies depending on the operating system and firewall type;

[0071] In step S2, it is a key step to ensure data consistency and subsequent analysis accuracy. Through the unified formatting of multi-source data, the impact of differences in the expression of firewall rules on different platforms is eliminated, providing structured high-quality input data for subsequent incremental synchronization, rule dependency graph construction and conflict analysis. The collected raw data may have different fields and expressions due to platform differences. By parsing the rule data, extracting key fields, target address, protocol type, port number or port range, rule action, priority, after data parsing is completed, the rules are converted into a unified standardized format, the parsed and standardized rule data is temporarily stored locally, and supports fast reading and subsequent operations.

[0072] In the S3 step, the standardized rule data is deduplicated to ensure that the same rule is not uploaded to the central management node repeatedly. The deduplication logic is based on a complete match of the rule fields, including source address, destination address, protocol, port range, action, and priority.

[0073] The hash value generation is unique and stable, ensuring that any field changes in the rule will result in a change in the hash value. The hash value of each rule is stored in the local cache and bound to the rule data for subsequent comparison and incremental synchronization.

[0074] In step S4, the rule dependency graph is constructed based on the rule data in the central management node, which is an important basis for realizing rule conflict detection, redundancy analysis, and optimization suggestion generation. The rule dependency graph can intuitively express the relationship between rules, including logical relationships such as coverage, conflict, and inclusion, and provides a graph-structured expression method for subsequent analysis.

[0075] In step S5, using the rule dependency graph to perform conflict detection and redundancy analysis on host firewall rules is a key step to achieve rule optimization and firewall performance improvement. Through the node and edge structure of the rule dependency graph, the logical relationship between rules can be effectively identified, especially priority conflicts, coverage conflicts, and mutual exclusion conflicts, and explicit and implicit redundant rules can be detected.

[0076] In step S6, generating optimization suggestions based on the analysis results and displaying conflicting rules, redundant rules and optimization solutions through visualization tools are key steps to achieve host firewall rule set optimization. The generation of optimization suggestions depends on the aforementioned conflict detection and redundancy analysis results. The accuracy and execution efficiency of the rules are ensured by adjusting the priority of the rules, the scope of conditions, deleting redundant rules, etc. The visualization tool further provides users with an intuitive display of the rule optimization process, supporting interactive adjustment and dynamic optimization preview.

[0077] Through the above steps, the present invention constructs a method for collecting and analyzing host firewall software policies. The method realizes efficient management and dynamic optimization of the host firewall rule set through distributed collection, rule dependency graph modeling, conflict detection and redundancy analysis, and optimization suggestion generation based on visualization tools.

[0078] In step S2, the standardized solution is to parse the source address, destination address, protocol, port, action and priority of the host firewall rule to generate a unified data structure;

[0079] Specifically, the collection agent extracts key fields of the rules, including source address, destination address, protocol type, port range, action, and priority. The standardized rules are stored in the local cache in a key-value pair structure.

[0080] The step S3 specifically includes:

[0081] S3.1. Preprocessing the data source, including deduplication, formatting and integrity check

[0082] S3.2. Generate a unique hash value for each data source record;

[0083] S3.3. Compare the hash value of the current data source with the stored hash value. When the comparison results are different and the data source passes the integrity check, it is determined to be new or modified policy data.

[0084] S3.4. Upload the newly added or modified policy data to the central management node, and retain the corresponding hash value for subsequent comparison;

[0085] Specifically, the collected policy data is preprocessed to ensure the uniqueness, format consistency and integrity of the data;

[0086] Deduplication: Remove duplicate policy records to ensure that each policy data is unique;

[0087] Formatting: converting policy data from different sources into a unified standard format for easy subsequent processing;

[0088] Completeness check: Verify the integrity of the policy data, ensuring that all required fields are filled in and conform to the expected format;

[0089] Generate a unique hash value;

[0090] Generate a unique hash value for each rule as the unique identifier of the rule;

[0091] For each key field of a rule, a unique hash value H is generated. The calculation formula is: H = Hash (SourceIP + DestinationIP + Protocol + Port + Action + Priority)

[0092] in

[0093] SourceIP indicates the source address;

[0094] DestinationIP indicates the destination address;

[0095] Protocol indicates the protocol type;

[0096] Port indicates the port number or port range;

[0097] Action represents the rule action;

[0098] Priority indicates the rule priority;

[0099] The combination of the above fields ensures that the hash value of each policy data is unique, which facilitates subsequent comparison and synchronization;

[0100] Compare the hash value of the current policy data with the stored hash value to detect the addition or modification of the policy. If the hash value of the current policy is different from the stored hash value and the policy data passes the integrity check, it is determined to be new or modified policy data. The new or modified policy data is recorded and prepared for synchronization. The detected new or modified policy data is uploaded to the central management node, and the changed policy data is sent to the central management node via a secure transmission protocol (such as HTTPS). The hash value of the corresponding policy data is updated in the local storage for subsequent comparison.

[0101] The data construction in step S4 specifically includes:

[0102] S4.1. Model the host firewall rules as a graph structure. The rules are represented as nodes of the graph. The attributes of the nodes include source address range, destination address range, protocol type, port range, priority and action.

[0103] S4.2. Define the edge relationships between nodes. The edge types include covering relationship, conflict relationship and inclusion relationship.

[0104] S4.3, determine the edge relationship based on the non-emptiness and regular behavior of the intersection;

[0105] S4.4. Generate a rule dependency graph based on the above rules and relationships for subsequent analysis;

[0106] The edge relations include:

[0107] When the intersection is non-empty and the behavior is consistent, it is marked as a containment relationship;

[0108] When the intersection is non-empty and the behaviors are opposite, it is marked as a conflicting relationship;

[0109] When the conditions of one rule completely include another rule, it is marked as an overlapping relationship.

[0110] Specifically,

[0111] A host firewall rule is modeled as a node in the graph.

[0112] Node properties include the following key fields:

[0113] Source address range: specifies the traffic source address of the rule, which can be a single IP or a CIDR address block.

[0114] Destination address range: Specifies the traffic destination address of the rule, which can be a single IP or a CIDR address block.

[0115] Protocol Type: The type of transport protocol to which the rule applies.

[0116] Port Range: The target port number or port range that the rule matches.

[0117] Action: The rule controls the behavior of matching traffic.

[0118] Priority: An identifier of the order in which rules are executed. The smaller the value, the higher the priority.

[0119] The edge relationship between nodes is used to describe the logical association between rules;

[0120] Overriding relationships

[0121] If the condition scope of one rule completely includes another rule, the two rules form an overlapping relationship.

[0122] The judgment formula is:

[0123]

[0124] Among them, C low Indicates the condition scope of the low priority rule, C high Indicates the scope of the condition of the high priority rule.

[0125] Conflict Relationship

[0126] If the condition ranges of two rules overlap but their actions are opposite, they are in conflict.

[0127] The judgment formula is:

[0128] And Action1≠Action2

[0129] Among them, C intersection =C1∩C2.

[0130] Containment relationship

[0131] If the conditional scopes of two rules partially overlap and their behaviors are consistent, they form an inclusion relationship.

[0132] The judgment formula is:

[0133] And Action1=Action2

[0134] Graph generation;

[0135] Traverse all rule nodes, calculate the relationship between each pair of nodes and generate edges; use a graph database or graph processing tool to combine nodes and edges into a complete rule dependency graph. The graph structure is stored in the distributed database of the central management node to support efficient query and analysis.

[0136] The conflict detection in step S5 includes

[0137] Priority conflict detection: detects rules with overlapping matching conditions but opposite behaviors;

[0138] Overlay conflict detection: detect whether the high-priority rule completely covers the low-priority rule;

[0139] Mutually exclusive conflict detection: detects rules that cannot be satisfied simultaneously logically;

[0140] Specifically, conflict detection analyzes the logical relationships between rules to identify conflict types that may affect the order of rule execution or the consistency of behavior. The goal of conflict detection is to systematically detect priority conflicts, coverage conflicts, and mutual exclusion conflicts through the structure of the rule dependency graph, providing a basis for rule optimization;

[0141] Priority conflict detection aims to identify conflicting rule pairs with overlapping rule condition scopes and opposite behaviors, and prioritize the conflicting rules;

[0142] Traverse the condition range C of all nodes in the graph, where the node attributes include source address range, destination address range, protocol type, and port range;

[0143] Calculate the intersection of condition ranges;

[0144] For each pair of rule nodes R1 and R2, the condition ranges C1 and C2 are calculated:

[0145] C intersection =C1∩C2

[0146] like Then the conditional scopes of the two rules overlap;

[0147] Determine whether the behavior is conflicting;

[0148] For rule pairs with a non-empty corpus, check whether the actions are opposite:

[0149] Action1≠Action2

[0150] If the behaviors are opposite, it is marked as a priority conflict;

[0151] Prioritization;

[0152] Sort conflicting rule pairs according to the rule priority attribute:

[0153] Rules with higher priority will be executed first;

[0154] Rules with lower priority may fail;

[0155] Output conflict details;

[0156] Output all rule pairs with conflicting priorities and their conflict details, including overlapping condition ranges and conflict types;

[0157] The goal of coverage conflict detection is to identify situations where high-priority rules completely cover low-priority rules in the rule dependency graph. By traversing the rule dependency graph through depth-first search (DFS), coverage conflicts can be efficiently discovered and coverage relationships can be marked.

[0158] Prioritize rule nodes

[0159] Arrange the nodes in the rule dependency graph in descending order by the priority attribute to ensure that high-priority rules are processed before low-priority rules.

[0160] Depth-first search traversal

[0161] Use DFS to traverse the nodes and edges in the rule dependency graph and process the rule relationships according to priority.

[0162] Detecting Coverage Relationships

[0163] For each pair of regular nodes R1 and R2:

[0164] If the following conditions are met, it is marked as an overlay conflict:

[0165]

[0166] Among them C low Indicates the condition scope of the low priority rule, C high Indicates the scope of the condition of the high priority rule.

[0167] The actions of two rules can be consistent or conflicting.

[0168] Output coverage conflict details

[0169] For each coverage conflict, the following information is recorded:

[0170] The scope of conditions for high priority rules;

[0171] The scope of the conditions of the covered rule;

[0172] The action relationship between two rules;

[0173] Through the above method, the present invention realizes efficient conflict detection of host firewall policies, laying a solid foundation for subsequent rule optimization; the redundancy analysis in step S5 specifically includes:

[0174] Explicit redundancy detection: compare all attributes of the rules. If the attributes of two rules are exactly the same, they are marked as explicitly redundant:

[0175] R1=R2

[0176] Where R i =(SourceIP,DestinationIP,Protocol,Port,Action)

[0177] Implicit redundancy detection: Analyze the inclusion relationship of rule condition scopes. If the condition scope C1 of one rule is completely included by the condition scope C2 of another rule and the behaviors are consistent, it is marked as implicit redundancy:

[0178] And Action1=Action2

[0179] Output conflict detection and redundancy analysis results for subsequent optimization suggestion generation;

[0180] Specifically, redundancy analysis includes the detection of explicit redundancy and implicit redundancy. By analyzing the relationship between the field attributes and condition range of the rules, redundant entries in the rule set are identified, and the structure and execution efficiency of the rule set are optimized. Explicit redundancy detection is based on the exact sameness of the rule fields, while implicit redundancy detection is determined by the inclusion relationship of the rule condition range;

[0181] Explicit Redundancy Detection Process

[0182] Field extraction: Extract key fields of the rules, including:

[0183] Source address;

[0184] Destination address;

[0185] Protocol type;

[0186] Port number or port range;

[0187] Regular actions;

[0188] Field comparison: compare all rules in the rule set one by one;

[0189] R1=R2

[0190] Where R i =(SourceIP,DestinationIP,Protocol,Port,Action);

[0191] Result Output

[0192] Output all explicit redundant rule pairs, record their rule IDs and corresponding field information;

[0193] Only one rule is retained among the redundant rules, and other duplicate rules are deleted;

[0194] Implicit redundancy detection;

[0195] Testing process;

[0196] Condition scope definition: The condition scope of a rule is represented as a set of attributes C:

[0197] C={SourceIP,DestinationIP,Protocol,Port}

[0198] Inclusion relationship determination: For each pair of rule nodes R1 and R2 in the rule set, determine the following conditions:

[0199] The scope of the condition completely includes:

[0200]

[0201] Where C1 and C2 are the conditional scopes of rules R1 and R2 respectively.

[0202] Consistent actions:

[0203] Action1=Action2

[0204] If the above conditions are met, it is marked as implicitly redundant;

[0205] Result Output

[0206] Output implicit redundant rules and their inclusion relationships, and record the rule ID and specific condition range.

[0207] Merge implicitly redundant rules, keep rules with a larger scope, and delete rules that are fully included;

[0208] The optimization suggestions in step S6 include:

[0209] For rules with conflicting priorities, adjust the condition scope of the rule with lower priority;

[0210] For rule pairs with coverage conflicts, delete the low-priority rule and adjust the condition scope of the low-priority rule to exclude the covered part;

[0211] For explicitly redundant rules, delete identical rules and keep only one rule;

[0212] For implicit redundant rules, merge the fully included rules and use the larger scope of the included rules as the scope of the merged rule conditions;

[0213] Specifically, priority conflicts refer to rules with overlapping condition scopes but opposite behaviors, which may cause rules with lower priorities to be ignored or cause logical conflicts;

[0214] Optimization methods;

[0215] Adjust the condition scope of the lower priority rules to exclude the conflicting parts, modify the priority attributes of the rules, and prioritize the most important rules in case of conflicts. Users can choose to keep important rules or modify unnecessary rules according to the specific circumstances of the rules. The system analyzes the conflicting rule pairs, identifies the overlapping parts of the condition scope and the details of their behavior conflicts, and provides suggestions, including the possibility of adjusting the condition scope of the low priority rules, modifying the priority or merging the rules. The rule set after the conflict is resolved will indicate the differences before and after the optimization, which is convenient for users to review and apply;

[0216] Coverage conflict means that the condition scope of the high-priority rule completely covers the low-priority rule, causing the low-priority rule to be redundant or partially invalid;

[0217] Optimization methods;

[0218] Delete the completely covered low-priority rules to reduce redundancy. If the condition range of the low-priority rule includes the uncovered part, adjust its range to retain the uncovered part.

[0219] The system detects the coverage rule pairs, calculates the coverage range and marks the redundant parts. For partial coverage, it provides suggestions for adjusting the condition range and marks the adjusted rule range. It deletes the rule set after completely covering the rules. For partially covered rules, it outputs the revised version after adjusting the range.

[0220] Explicit redundancy means that there are multiple rules with exactly the same fields in the rule set, which leads to repeated execution of rules and increases storage and management costs;

[0221] Optimization methods;

[0222] Delete duplicate rules and keep only one rule. The system compares the rule fields one by one, identifies and displays redundant rules, and marks the duplicate rules for deletion to ensure that only one rule is retained. The results of the redundant rule cleanup display the deleted rule ID and detailed information of the retained rules.

[0223] Implicit redundancy means that the condition scope of a rule is completely included by another rule and the behavior is consistent, resulting in redundant execution logic;

[0224] Optimization methods;

[0225] Merge the fully included rules to make the rules more concise, and use the larger scope of the included rules as the merged condition scope;

[0226] The system analyzes implicit redundant rule pairs, determines the scope inclusion relationship and marks redundancy, provides merging suggestions, retains rules with larger condition ranges, and deletes or adjusts rules with smaller condition ranges; displays rule changes before and after implicit redundant merging; and provides a simplified version of the optimized rule set.

[0227] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for collecting and analyzing host firewall software policies, characterized in that: The steps include: S1, distributed deployment of collection agents to collect policy data from host firewalls; S2. Standardizing and analyzing the collected data and storing them; S3, upload the standardized policy data to the central management node through the incremental synchronization mechanism; S4. At the central management node, a rule dependency graph is constructed based on the rule data; S5. Use the rule dependency graph to perform conflict detection and redundancy analysis on host firewall rules; S6. Generate optimization suggestions based on the analysis results, and display conflicting rules, redundant rules and optimization solutions through visualization tools.

2. A method for collecting and analyzing host firewall software policies according to claim 1, characterized in that: In the step S2, the standardized solution is performed to parse the source address, destination address, protocol, port, action and priority of the host firewall rule to generate a unified data structure.

3. A method for collecting and analyzing host firewall software policies according to claim 1, characterized in that: The step S3 specifically includes: S3.

1. Preprocessing the data source, including deduplication, formatting and integrity check S3.

2. Generate a unique hash value for each data source record; S3.

3. Compare the hash value of the current data source with the stored hash value. When the comparison results are different and the data source passes the integrity check, it is determined to be new or modified policy data. S3.

4. Upload the newly added or modified policy data to the central management node, and retain the corresponding hash value for subsequent comparison.

4. A method for collecting and analyzing host firewall software policies according to claim 1, characterized in that: The data construction in step S4 specifically includes: S4.

1. Model the host firewall rules as a graph structure. The rules are represented as nodes of the graph. The attributes of the nodes include source address range, destination address range, protocol type, port range, priority and action. S4.

2. Define the edge relationships between nodes. The edge types include covering relationship, conflict relationship and inclusion relationship. S4.3, determine the edge relationship based on the non-emptiness and regular behavior of the intersection; S4.

4. Generate a rule dependency graph based on the above rules and relationships for subsequent analysis.

5. A method for collecting and analyzing host firewall software policies according to claim 4, characterized in that: The edge relations include: When the intersection is non-empty and the behavior is consistent, it is marked as a containment relationship; When the intersection is non-empty and the behaviors are opposite, it is marked as a conflicting relationship; When the conditions of one rule completely include another rule, it is marked as an overlapping relationship.

6. A method for collecting and analyzing host firewall software policies according to claim 1, characterized in that: The conflict detection in step S5 includes Priority conflict detection: detects rules with overlapping matching conditions but opposite behaviors; Overlay conflict detection: detect whether the high-priority rule completely covers the low-priority rule; Mutually exclusive conflict detection: detects rules that cannot be satisfied simultaneously logically.

7. A method for collecting and analyzing host firewall software policies according to claim 6, characterized in that: The priority conflict detection specifically includes: Traverse all nodes in the rule dependency graph, and the conditional scope of each node is expressed as: C={SourceIP,DestinationIP,Protocol,Port} For each pair of rule nodes R1 and R2, the conditional range intersection is calculated. The intersection formula is: C intersection =C1∩C2 If the intersection Then the conditional scopes of the two rules overlap; Determine whether the behaviors conflict. If the following conditions are met, mark them as priority conflicts: Action1≠Action2, where Action i The action that expresses the rule; For rule pairs with conflicting priorities, they are sorted according to their priority attributes. The rules with higher priorities are executed first, and the rules with lower priorities may become invalid. Output all rule pairs marked as priority conflicts and their conflict details for subsequent optimization analysis.

8. A method for collecting and analyzing host firewall software policies according to claim 6, characterized in that: The coverage conflict detection sorts the nodes in the rule dependency graph by priority, and uses depth-first search to traverse the coverage relationship between rule nodes. If the condition range of the high-priority rule completely contains the low-priority rule and the behavior is consistent or conflicting, it is marked as a coverage conflict.

9. A method for collecting and analyzing host firewall software policies according to claim 1, characterized in that: The redundancy analysis in step S5 specifically includes: Explicit redundancy detection: compare all attributes of the rules. If the attributes of two rules are exactly the same, they are marked as explicitly redundant: R1=R2 Where R i =(SourceIP,DestinationIP,Protocol,Port,Action) Implicit redundancy detection: Analyze the inclusion relationship of rule condition scopes. If the condition scope C1 of one rule is completely included by the condition scope C2 of another rule and the behaviors are consistent, it is marked as implicit redundancy: And Action1=Action2 Output conflict detection and redundancy analysis results for subsequent optimization suggestion generation.

10. A method for collecting and analyzing host firewall software policies according to claim 1, characterized in that: The optimization suggestions in step S6 include: For rules with conflicting priorities, adjust the condition scope of the rule with lower priority; For rule pairs with coverage conflicts, delete the low-priority rule and adjust the condition scope of the low-priority rule to exclude the covered part; For explicitly redundant rules, delete identical rules and keep only one rule; For implicitly redundant rules, merge the completely included rules and use the larger scope of the included rules as the scope of the merged rule conditions.

Images