Firewall security policy management system
By introducing packet exceptions, traffic direction exceptions and session retry exception modules into the firewall, the session characteristic exception coefficient is calculated, which solves the problem that existing firewall policies cannot deeply analyze session traffic, and effectively identify and block attack behavior.
Patent Information
- Application Number
- CN202411923737.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-25
- Publication Date
- 2025-03-28
AI Technical Summary
The lack of in-depth analysis of session traffic when existing firewall policies control and monitor network traffic, resulting in some forms of attacks being able to bypass the firewall and successfully invade.
A firewall security policy management system is proposed. Through the data packet exception module, traffic direction exception module, session retry exception module and session feature exception module, the data packet exception coefficient, traffic direction exception coefficient and session retry exception coefficient are calculated to obtain the session feature exception coefficient, and the firewall security is managed through the management module.
Through in-depth analysis and timely monitoring of session traffic, it is possible to identify and prevent attacks from bypassing firewalls, ensuring network security.
Smart Images
Figure CN119728264A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of firewall security management, and in particular to a firewall security policy management system. Background Art
[0002] Firewall policy management refers to controlling the ingress and egress of network traffic by configuring security groups and corresponding rules to ensure the security of the server. By creating security groups and setting ingress and egress rules, you can precisely control which traffic is allowed or denied to prevent potential malicious attacks or unnecessary network access. For example, the following firewall policy is configured for a Web application server: First, a security group named WebServerSecurityGroup is created, which is mainly used to protect the Web application server. Then, in this security group, ingress rules are configured to allow external access to HTTP traffic (port 80) and HTTPS traffic (port 443). The priorities of these rules are set to 10 and 20 to ensure that traffic from these commonly used ports can enter the server smoothly. To further protect the server, all external access to the SSH port (port 22) is explicitly denied to prevent remote login attacks. By setting a priority of 30 to control SSH traffic, we can ensure that only administrators from the internal network (such as IP segment 192.168.1.0 / 24) can access it. By applying these rules to the Web application server, the firewall policy can effectively protect the server and ensure that only specific legitimate traffic can access the server, thereby enhancing the security of the server.
[0003] In the above-mentioned firewall policy management process, the session is mainly reflected in the network connection and data exchange process between the client and the server; specifically, the session is reflected in how the firewall policy identifies, tracks and manages the life cycle of each network interaction in the process of controlling and monitoring traffic, including the establishment, maintenance and termination of the session. By managing these sessions, the firewall ensures that only traffic that meets the rules can pass, thereby protecting the server from potential malicious attacks.
[0004] However, in the above process, although the firewall policy can limit which traffic can pass, these rules usually only perform static filtering on the source, destination and protocol of the traffic, and do not perform in-depth analysis on the session traffic. The lack of timely monitoring of the traffic characteristics of each session may result in certain forms of attack still being able to bypass the firewall and successfully invade without violating the firewall rules. Summary of the invention
[0005] The purpose of the present invention is to solve the above-mentioned problems and provide a firewall security policy management system.
[0006] In the implementation of the present invention, a firewall security policy management system is proposed, the system comprising:
[0007] Packet anomaly module: obtains the size of all packets in each traffic session within a preset time period, and calculates the packet anomaly coefficient based on the size of all packets;
[0008] Traffic direction anomaly module: obtains the request traffic and response traffic in each traffic session within a preset time period, and calculates the traffic direction anomaly coefficient based on the request traffic and response traffic;
[0009] Session retry exception module: obtains the total number of connection attempts in each traffic session within a preset time period, and calculates the session retry exception coefficient based on the total number of connection attempts;
[0010] Session feature anomaly module: obtains the session feature anomaly coefficient of the corresponding session according to the data packet anomaly coefficient, traffic direction anomaly coefficient and session retry anomaly coefficient;
[0011] Management module: manages firewall security based on the session feature anomaly coefficient of all traffic sessions within a preset time period.
[0012] Optionally, calculating a packet anomaly coefficient based on all packet sizes includes:
[0013] For each traffic session, the size of each data packet in the session within a preset time period is obtained to obtain a data packet sequence; any data packet in the data packet sequence is marked as S i , S i represents the size of the i-th data packet in the data packet sequence; i = 1, 2, 3, 4, ..., n, n is a positive integer; n represents the total number of data packets in the data packet sequence;
[0014] Calculate the mean μ of the data packet sequence. The calculation formula is:
[0015] Calculate the standard deviation σ of the data packet sequence using the following formula:
[0016] For each S i , calculate its abnormal coefficient C i , the calculation formula is:
[0017] Calculate all C in the packet sequence i The mean of , the data packet anomaly coefficient HJ is obtained, and the calculation formula is:
[0018] Optionally, calculating the traffic direction anomaly coefficient according to the request traffic and the response traffic includes:
[0019] For each traffic session, obtain the request traffic sent by the client and the response traffic sent by the server in the session within a preset time period, and mark the request traffic sent by the client and the response traffic sent by the server as RI and RO respectively;
[0020] Calculate the ratio ED of request traffic to response traffic,
[0021] Calculate the flow direction abnormal value BY, the calculation formula is: In the formula, DC is the tolerance threshold of the preset flow ratio;
[0022] Calculate the flow direction abnormality coefficient KU, the calculation formula is: Where sx is the preset traffic direction outlier threshold.
[0023] Optionally, calculating the session retry anomaly coefficient based on the total number of connection attempts includes:
[0024] For each traffic session, obtain all connection requests in the session within a preset time period, record the timestamps of the requests, calculate the timestamp difference between two consecutive requests, and obtain the request timestamp difference sequence based on the time sequence;
[0025] Compare each request timestamp difference in the request timestamp difference sequence with a preset minimum request timestamp difference threshold; record a request timestamp difference whose request timestamp difference is not greater than the preset minimum request timestamp difference threshold as an abnormal request timestamp difference;
[0026] Get the total number of abnormal request timestamp differences and the total number of request timestamp differences in the request timestamp difference sequence, and calculate the session retry anomaly coefficient Nj. The calculation formula is: Nj=ln(d / c+1+1); where d represents the total number of abnormal request timestamp differences, and c represents the total number of request timestamp differences.
[0027] Optionally, obtaining a session characteristic anomaly coefficient of a corresponding session according to a data packet anomaly coefficient, a traffic direction anomaly coefficient, and a session retry anomaly coefficient includes:
[0028]
[0029] Where BYH is the session feature anomaly coefficient, HJ, KU and Nj are the packet anomaly coefficient, traffic direction anomaly coefficient and session retry anomaly coefficient respectively, f1, f2 and f3 are the preset proportional coefficients of HJ, KU and Nj respectively, and f1, f2 and f3 are all greater than 0.
[0030] Optionally, managing firewall security according to session feature anomaly coefficients in all traffic sessions within a preset time period includes:
[0031] Establish a session feature anomaly coefficient set by using the session feature anomaly coefficients in all traffic sessions within a preset time period, and filter out all the anomaly coefficients in the session feature anomaly coefficient set;
[0032] When the session feature abnormality coefficient is not less than a preset session feature abnormality coefficient reference threshold, marking the session feature abnormality coefficient as an abnormality coefficient;
[0033] When the session feature abnormality coefficient is less than a preset session feature abnormality coefficient reference threshold, the session feature abnormality coefficient is marked as a normal coefficient;
[0034] All abnormal coefficients are used to establish an abnormal set, and the standard deviation in the abnormal set is calculated. The standard deviation is compared with the preset standard deviation value, and the firewall security is managed according to the comparison results.
[0035] Optionally, all abnormal coefficients are used to establish an abnormal set, and the standard deviation in the abnormal set is calculated, and the standard deviation is compared with a preset standard deviation value. The firewall security is managed according to the comparison result, including:
[0036] If the standard deviation of the abnormal coefficient in the abnormal set is not less than the preset abnormal coefficient standard deviation threshold, the firewall will immediately send out an alarm signal and immediately block the traffic from the abnormal session;
[0037] If the standard deviation of the anomaly coefficient in the anomaly set is less than the preset standard deviation threshold of the anomaly coefficient, the firewall works normally and does not issue an alarm signal.
[0038] Beneficial effects of the present invention:
[0039] The present invention proposes a firewall security policy management system, which calculates a data packet anomaly coefficient by obtaining the sizes of all data packets in each traffic session within a preset time period; obtains the request traffic and response traffic in each traffic session to calculate a traffic direction anomaly coefficient; obtains the total number of connection attempts in each traffic session to calculate a session retry anomaly coefficient; obtains a session feature anomaly coefficient of a corresponding session according to the data packet anomaly coefficient, the traffic direction anomaly coefficient and the session retry anomaly coefficient; manages firewall security according to the session feature anomaly coefficients in all traffic sessions within a preset time period; in this way, in-depth analysis of session traffic can be performed; timely monitoring of each session traffic feature ensures that attack forms cannot bypass the firewall and will not successfully invade without violating firewall rules. BRIEF DESCRIPTION OF THE DRAWINGS
[0040] The present invention will be further described below in conjunction with the accompanying drawings.
[0041] Figure 1 A framework diagram of a firewall security policy management system. DETAILED DESCRIPTION
[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0043] Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making any creative work shall fall within the scope of protection of the present invention.
[0044] The embodiment of the present invention provides a firewall security policy management system. Figure 1 , Figure 1 A framework diagram of a firewall security policy management system provided by an embodiment of the present invention. The system includes:
[0045] Packet anomaly module: obtains the size of all packets in each traffic session within a preset time period, and calculates the packet anomaly coefficient based on the size of all packets;
[0046] Traffic direction anomaly module: obtains the request traffic and response traffic in each traffic session within a preset time period, and calculates the traffic direction anomaly coefficient based on the request traffic and response traffic;
[0047] Session retry exception module: obtains the total number of connection attempts in each traffic session within a preset time period, and calculates the session retry exception coefficient based on the total number of connection attempts;
[0048] Session feature anomaly module: obtains the session feature anomaly coefficient of the corresponding session according to the data packet anomaly coefficient, traffic direction anomaly coefficient and session retry anomaly coefficient;
[0049] Management module: manages firewall security based on the session feature anomaly coefficient of all traffic sessions within a preset time period.
[0050] A firewall security policy management system provided based on an embodiment of the present invention can perform in-depth analysis of session traffic through the above method; timely monitoring of the traffic characteristics of each session prevents attacks from bypassing the firewall and successfully invading without violating firewall rules.
[0051] In one embodiment, calculating the data packet anomaly coefficient based on all data packet sizes includes:
[0052] For each traffic session, obtain the size (in bytes) of each data packet in the session within a preset time period to obtain a data packet sequence; mark any data packet in the data packet sequence as S i , S i represents the size of the i-th data packet in the data packet sequence; i = 1, 2, 3, 4, ..., n, n is a positive integer; n represents the total number of data packets in the data packet sequence;
[0053] Calculate the mean μ of the data packet sequence. The calculation formula is:
[0054] Calculate the standard deviation σ of the data packet sequence using the following formula:
[0055] For each S i , calculate its abnormal coefficient C i , the calculation formula is:
[0056] Calculate all C in the packet sequence i The mean of , the data packet anomaly coefficient HJ is obtained, and the calculation formula is:
[0057] It should be noted that the preset time period is set by professionals based on actual circumstances and is not limited or elaborated on in detail.
[0058] It should be noted that the size of each data packet in each traffic session can be obtained through network packet capture tools (such as Wireshark, tcpdump) or traffic monitoring software (such as NetFlow, sFlow). These tools can capture network traffic packets and extract detailed information of each packet, including size, protocol, source IP, destination IP, etc., which can be used for subsequent abnormal analysis and monitoring.
[0059] It should be noted that the larger the packet anomaly coefficient, the more abnormal the traffic characteristics of the corresponding session are, which may lead to some forms of attack still being able to bypass the firewall and successfully invade without violating the firewall rules, because the larger the packet anomaly coefficient, the more the size of the packet deviates significantly from the normal range, which may indicate some abnormal traffic behaviors, such as buffer overflow attacks, DDoS attacks, or malicious data injection attacks. Such attacks usually do not directly violate the port or protocol rules set by the firewall, but their traffic characteristics and behaviors are different from normal traffic and may be ignored by the firewall. For example, some attacks may penetrate slowly and covertly through small, abnormally sized packets, while the firewall judges whether the traffic is legitimate based more on ports and protocols, ignoring the in-depth analysis and behavior patterns of the traffic. Therefore, although these attacks may not trigger the basic rules of the firewall, their abnormal traffic patterns or packet sizes may still be successfully bypassed without being detected by the firewall, thereby achieving potential invasion. This is why by strengthening the dynamic monitoring and analysis of traffic behavior, it is possible to better detect and prevent such potential threats.
[0060] In one implementation, the benefit of analyzing the packet anomaly coefficient for monitoring session traffic characteristics and determining whether certain attack forms can bypass the firewall and successfully invade without violating firewall rules is that it can enhance the intelligent detection capabilities of the firewall and make up for the traditional protection loopholes based on static rules. By dynamically analyzing the behavioral characteristics and abnormal patterns of traffic, even if the attacker uses legitimate ports and protocols for data transmission, abnormal traffic patterns can still be identified in a timely manner. This method can discover potential hidden attacks, such as slow DDoS attacks, abnormal packet injection, protocol abuse, etc., and provide early warnings and take effective countermeasures, thereby improving overall network security and reducing the possibility of slipping through the net.
[0061] In one embodiment, calculating the traffic direction anomaly coefficient according to the request traffic and the response traffic includes:
[0062] For each traffic session, obtain the request traffic (unit: number of bytes or number of packets) sent by the client and the response traffic sent by the server in the session within a preset time period, and mark the request traffic sent by the client and the response traffic sent by the server as RI and RO respectively;
[0063] Calculate the ratio ED of request traffic to response traffic,
[0064] Calculate the flow direction abnormal value BY, the calculation formula is: In the formula, DC is the tolerance threshold of the preset flow ratio, which defines the tolerance of the flow ratio to deviate from the normal range;
[0065] Calculate the flow direction abnormality coefficient KU, the calculation formula is: Where sx is the preset traffic direction abnormal value threshold; if the traffic direction abnormal value BY exceeds the preset traffic direction abnormal value threshold sx, it is considered that the traffic direction of the traffic session is abnormal.
[0066] It should be noted that the data acquisition method involved in calculating the traffic direction anomaly coefficient mainly relies on the monitoring of traffic sessions and data packet analysis. First, the request traffic and response traffic of the traffic session can be recorded through the logs of the network device or firewall, or the inbound and outbound traffic during the session can be monitored in real time through traffic collection tools (such as Wireshark or tcpdump). Specifically, the request traffic sent by the client and the traffic responded by the server can be analyzed by capturing the inbound and outbound data packets of the TCP connection, and the amount of data or the number of data packets in each direction can be calculated. In addition, network monitoring tools can also provide traffic statistics divided by session to help identify asymmetric traffic behavior. Finally, based on these data, the ratio of request traffic to response traffic and the traffic direction anomaly coefficient can be calculated to evaluate whether there is an anomaly in the traffic direction.
[0067] It should be noted that the tolerance threshold of the preset flow ratio and the abnormal value threshold of the preset flow direction are set by professionals according to actual conditions, and are not specifically limited or elaborated;
[0068] It should be noted that the traffic direction anomaly coefficient is used to measure whether the traffic direction is symmetrical. If the traffic requested by the client far exceeds the traffic responded by the server, it can be considered that there is a traffic direction anomaly, which may be a DDoS attack or other abnormal behavior; if the traffic direction anomaly value BY exceeds the preset traffic direction anomaly value threshold sx, it is considered that the traffic direction of the traffic session is abnormal, which means that the greater the degree of abnormality of the traffic characteristics of the corresponding session, the more likely it is that some forms of attack can still bypass the firewall and successfully invade without violating the firewall rules, because the abnormal value of the traffic direction anomaly coefficient indicates that there is an asymmetry in the traffic distribution between requests and responses, usually because a large number of requests are sent to the server, while the server's response traffic is relatively small. This asymmetric traffic pattern may be a manifestation of DDoS attacks, scanning behaviors, or other malicious traffic. Although these flows comply with the basic rules of the firewall (such as HTTP requests, response ports, etc.), their traffic behaviors themselves are very abnormal, so the firewall may not be able to identify the abnormal characteristics of these asymmetric flows. Such attacks can quietly enter the network without violating the firewall regulations, consume server resources, and may even cause denial of service, system crashes, or other security issues.
[0069] In one implementation, the benefit of analyzing the traffic direction anomaly coefficient for monitoring session traffic characteristics to determine whether certain attack forms can bypass the firewall and successfully invade without violating firewall rules is that it can help identify abnormal traffic patterns that appear to comply with firewall rules, especially when the attack behavior does not directly violate port or protocol rules. Traffic direction asymmetry, such as client request traffic significantly higher than server response traffic, may indicate potential malicious activities, such as DDoS attacks or traffic amplification attacks. This analysis can detect attacks that the firewall cannot identify in advance, so that preventive measures can be taken before the attack actually causes system resource consumption or service interruption. Through effective traffic behavior analysis, the network can be more comprehensively protected from various advanced attacks that bypass traditional firewall mechanisms, enhancing overall security protection capabilities.
[0070] In one embodiment, calculating the session retry anomaly coefficient based on the total number of connection attempts includes:
[0071] For each traffic session, obtain all link requests in the session within a preset time period, record the timestamps of the requests, calculate the timestamp difference between two consecutive requests, and obtain the request timestamp difference sequence based on the time sequence;
[0072] Compare each request timestamp difference in the request timestamp difference sequence with a preset minimum request timestamp difference threshold; record a request timestamp difference whose request timestamp difference is not greater than the preset minimum request timestamp difference threshold as an abnormal request timestamp difference;
[0073] Get the total number of abnormal request timestamp differences and the total number of request timestamp differences in the request timestamp difference sequence, and calculate the session retry anomaly coefficient Nj. The calculation formula is: Nj=ln(d / c+1+1); where d represents the total number of abnormal request timestamp differences, and c represents the total number of request timestamp differences.
[0074] It should be noted that the preset minimum request timestamp difference threshold is set by professionals according to actual conditions, and no specific limitation or elaboration is made;
[0075] It should be noted that the data involved in the calculation of the above-mentioned session retry anomaly coefficient is mainly obtained through the request log in the traffic session. Specifically, through the log system of the network device, server or firewall, the timestamp of each connection request is recorded, and the request information of each connection can be obtained in sequence. The timestamp can be extracted from the network layer, application layer or log file, usually including the time stamp when the connection is established. Through these timestamps, the time difference (request interval) between each pair of consecutive requests can be calculated to obtain the request timestamp difference sequence. By analyzing these data, abnormal behaviors with too short request intervals can be identified, and the session retry anomaly coefficient can be further calculated, and it can be judged whether there is a retry anomaly or attack behavior.
[0076] It should be noted that the larger the session retry anomaly coefficient is, the more abnormal the traffic characteristics of the corresponding session are, which may lead to some forms of attack being able to bypass the firewall and successfully invade without violating the firewall rules, because the session retry anomaly coefficient reflects the frequent retry of the connection request in the session. Usually, this behavior does not conform to the normal user access mode, but the attacker is constantly trying to bypass security protection measures (such as password verification, identity verification, etc.). If the session retry anomaly coefficient is too large, it means that the attacker may try to successfully enter the system without alerting the firewall by constantly retrying the connection and repeatedly sending malicious requests. Although this behavior conforms to the normal access rules of the firewall (such as port opening, protocol support, etc.), it may bypass the normal monitoring and restrictions of the firewall through a large number of repeated requests or brute force cracking, thereby achieving illegal invasion or attack. Therefore, the firewall cannot effectively identify and prevent such attacks by relying solely on rule-based traffic filtering, but may provide opportunities for attackers.
[0077] In one implementation, the benefits of analyzing the monitoring of session traffic characteristics by the session retry anomaly coefficient and determining whether certain attack forms can bypass the firewall and successfully invade without violating the firewall rules are: analyzing the monitoring of session traffic characteristics by the session retry anomaly coefficient can help to deeply identify potential attack behaviors, especially those that rely on repeated connection retries, such as brute force cracking and DoS attacks. This method can provide more sophisticated traffic analysis without relying on traditional firewall rules. By capturing the retry behavior in the session, the system can promptly discover and mark abnormal patterns, thereby enhancing the ability to respond to potential attacks. For example, even if the attacker's behavior seems legal in terms of rules and does not trigger the basic security rules of the firewall, the frequent retry requests monitored can still indicate potential risks and prevent the attacker from successfully invading without violating the firewall rules. This monitoring mechanism can supplement the deficiencies of firewall policies and improve overall network security.
[0078] In one embodiment, the session characteristic anomaly coefficient of the corresponding session is obtained according to the data packet anomaly coefficient, the traffic direction anomaly coefficient and the session retry anomaly coefficient, including:
[0079]
[0080] Where BYH is the session feature anomaly coefficient, HJ, KU and Nj are the packet anomaly coefficient, traffic direction anomaly coefficient and session retry anomaly coefficient respectively, f1, f2 and f3 are the preset proportional coefficients of HJ, KU and Nj respectively, and f1, f2 and f3 are all greater than 0.
[0081] It should be noted that f1, f2, and f3 are set by professionals according to actual conditions. Generally, the sum of f1, f2, and f3 is 1, and the specific values are not limited. In addition, before calculating the session feature anomaly coefficient, it is necessary to remove the unit from the data packet anomaly coefficient, the traffic direction anomaly coefficient, and the session retry anomaly coefficient and calculate them.
[0082] In one embodiment, managing firewall security based on session feature anomaly coefficients in all traffic sessions within a preset time period includes:
[0083] Establish a session feature anomaly coefficient set by using the session feature anomaly coefficients in all traffic sessions within a preset time period, and filter out all the anomaly coefficients in the session feature anomaly coefficient set;
[0084] When the session feature abnormality coefficient is not less than a preset session feature abnormality coefficient reference threshold, marking the session feature abnormality coefficient as an abnormality coefficient;
[0085] When the session feature abnormality coefficient is less than a preset session feature abnormality coefficient reference threshold, the session feature abnormality coefficient is marked as a normal coefficient;
[0086] All abnormal coefficients are used to establish an abnormal set, and the standard deviation in the abnormal set is calculated. The standard deviation is compared with the preset standard deviation value, and the firewall security is managed according to the comparison results.
[0087] In one implementation, the above-mentioned preset session feature abnormality coefficient reference threshold is set by professionals according to actual conditions, and the details are not repeated here.
[0088] In one embodiment, all abnormal coefficients are used to establish an abnormal set, and the standard deviation in the abnormal set is calculated, and the standard deviation is compared with a preset standard deviation value. The firewall security is managed according to the comparison result, including:
[0089] If the standard deviation of the abnormal coefficient in the abnormal set is not less than the preset abnormal coefficient standard deviation threshold, the firewall will immediately send out an alarm signal and immediately block the traffic from the abnormal session;
[0090] If the standard deviation of the anomaly coefficient in the anomaly set is less than the preset standard deviation threshold of the anomaly coefficient, the firewall works normally and does not issue an alarm signal.
[0091] It should be noted that the preset abnormal coefficient standard deviation threshold is set by professionals based on actual conditions and will not be described in detail.
[0092] The system first screens out all abnormal coefficients by establishing the abnormal coefficient set of session characteristics in all traffic sessions within a preset time period. When these abnormal coefficients are not less than the preset reference threshold, the system marks them as "abnormal coefficients", indicating that there is a possible network attack or abnormal behavior. Conversely, if the abnormal coefficient of the session characteristics is less than the reference threshold, the traffic session is considered normal and the system marks it as "normal coefficient". Then, the system aggregates all abnormal coefficients into an abnormal set and calculates the standard deviation of the abnormal set. By comparing it with the preset standard deviation threshold, it decides whether to take further security protection measures. If the standard deviation of the abnormal coefficients in the abnormal set is not less than the preset standard deviation threshold, it indicates that the traffic fluctuation is abnormally large, and the firewall will immediately issue an alarm signal and block the traffic from the abnormal session. On the contrary, if the standard deviation is less than the threshold, the firewall maintains normal operation and does not trigger an alarm, ensuring that normal traffic is not affected.
[0093] The benefit of this management method is that it can flexibly respond to fluctuations and anomalies in network traffic. When the network environment changes dramatically, such as when encountering a distributed denial of service (DDoS) attack, the abnormal session characteristics in the traffic will be quickly marked and isolated, thereby effectively protecting the network from attacks. Compared with traditional rule-based firewall policies, this management method based on dynamic anomaly coefficients is more accurate and can identify subtle network anomalies, respond in a timely manner, reduce false alarm rates, and ensure stable system operation. Secondly, this method can adjust the firewall's response strategy according to the actual situation of network traffic, avoid overreaction, and will not affect the normal operation of business when traffic fluctuations are small, thereby improving the efficiency and reliability of the system. In short, by combining anomaly detection and dynamic response mechanisms, firewalls can manage network traffic under a more efficient security framework and ensure the long-term safe operation of information systems.
[0094] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be used to artificially limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.
Claims
1. A firewall security policy management system, characterized in that: The system comprises: Packet anomaly module: obtains the size of all packets in each traffic session within a preset time period, and calculates the packet anomaly coefficient based on the size of all packets; Traffic direction anomaly module: obtains the request traffic and response traffic in each traffic session within a preset time period, and calculates the traffic direction anomaly coefficient based on the request traffic and response traffic; Session retry exception module: obtains the total number of connection attempts in each traffic session within a preset time period, and calculates the session retry exception coefficient based on the total number of connection attempts; Session feature anomaly module: obtains the session feature anomaly coefficient of the corresponding session according to the data packet anomaly coefficient, traffic direction anomaly coefficient and session retry anomaly coefficient; Management module: manages firewall security based on the session feature anomaly coefficient of all traffic sessions within a preset time period.
2. A firewall security policy management system according to claim 1, characterized in that: Calculation of the packet anomaly factor based on all packet sizes includes: For each traffic session, the size of each data packet in the session within a preset time period is obtained to obtain a data packet sequence; any data packet in the data packet sequence is marked as S i , S i represents the size of the i-th data packet in the data packet sequence; i = 1, 2, 3, 4, ..., n, n is a positive integer; n represents the total number of data packets in the data packet sequence; Calculate the mean μ of the data packet sequence. The calculation formula is: Calculate the standard deviation σ of the data packet sequence using the formula: For each S i , calculate its abnormal coefficient C i , the calculation formula is: Calculate all C in the packet sequence i The mean of , the data packet anomaly coefficient HJ is obtained, and the calculation formula is:
3. A firewall security policy management system according to claim 1, characterized in that: Calculating the traffic direction anomaly coefficient based on request traffic and response traffic includes: For each traffic session, obtain the request traffic sent by the client and the response traffic sent by the server in the session within a preset time period, and mark the request traffic sent by the client and the response traffic sent by the server as RI and RO respectively; Calculate the ratio ED of request traffic to response traffic, Calculate the flow direction abnormal value BY, the calculation formula is: In the formula, DC is the tolerance threshold of the preset flow ratio; Calculate the flow direction abnormality coefficient KU, the calculation formula is: Where sx is the preset traffic direction outlier threshold.
4. A firewall security policy management system according to claim 1, characterized in that: Calculating the session retry anomaly factor based on the total number of connection attempts includes: For each traffic session, obtain all connection requests in the session within a preset time period, record the timestamps of the requests, calculate the timestamp difference between two consecutive requests, and obtain the request timestamp difference sequence based on the time sequence; Compare each request timestamp difference in the request timestamp difference sequence with a preset minimum request timestamp difference threshold; record a request timestamp difference whose request timestamp difference is not greater than the preset minimum request timestamp difference threshold as an abnormal request timestamp difference; Get the total number of abnormal request timestamp differences and the total number of request timestamp differences in the request timestamp difference sequence, and calculate the session retry anomaly coefficient Nj. The calculation formula is: Nj=ln(d / c+1+1); where d represents the total number of abnormal request timestamp differences, and c represents the total number of request timestamp differences.
5. A firewall security policy management system according to claim 1, characterized in that: The session characteristic anomaly coefficients of the corresponding session obtained according to the data packet anomaly coefficient, the traffic direction anomaly coefficient, and the session retry anomaly coefficient include: Where BYH is the session feature anomaly coefficient, HJ, KU and Nj are the packet anomaly coefficient, traffic direction anomaly coefficient and session retry anomaly coefficient respectively, f1, f2 and f3 are the preset proportional coefficients of HJ, KU and Nj respectively, and f1, f2 and f3 are all greater than 0.
6. A firewall security policy management system according to claim 1, characterized in that: Firewall security management based on session feature anomaly coefficients in all traffic sessions within a preset time period includes: Establish a session feature anomaly coefficient set by using the session feature anomaly coefficients in all traffic sessions within a preset time period, and filter out all the anomaly coefficients in the session feature anomaly coefficient set; When the session feature abnormality coefficient is not less than a preset session feature abnormality coefficient reference threshold, marking the session feature abnormality coefficient as an abnormality coefficient; When the session feature abnormality coefficient is less than a preset session feature abnormality coefficient reference threshold, the session feature abnormality coefficient is marked as a normal coefficient; All abnormal coefficients are used to establish an abnormal set, and the standard deviation in the abnormal set is calculated. The standard deviation is compared with the preset standard deviation value, and the firewall security is managed according to the comparison results.
7. A firewall security policy management system according to claim 6, characterized in that: All abnormal coefficients are used to establish an abnormal set, and the standard deviation in the abnormal set is calculated. The standard deviation is compared with the preset standard deviation value. The firewall security is managed according to the comparison results, including: If the standard deviation of the abnormal coefficient in the abnormal set is not less than the preset abnormal coefficient standard deviation threshold, the firewall will immediately send out an alarm signal and immediately block the traffic from the abnormal session; If the standard deviation of the anomaly coefficient in the anomaly set is less than the preset standard deviation threshold of the anomaly coefficient, the firewall works normally and does not issue an alarm signal.