Method for automatically cleaning off-line IP in security policy of network firewall equipment

Abstract

The invention provides an automatic cleaning method for an offline IP in a security policy of network firewall equipment, and belongs to the technical field of network security, and the method comprises the steps: automatically detecting the survival state of a service IP through network detection according to a preset period, and determining a to-be-cleaned IP; querying all firewall policies related to the IP to be cleaned by using a policy analysis algorithm; constructing a reference tree for each firewall policy, traversing nodes of the reference tree, extracting digital intervals of all IPs, and recursively cleaning all to-be-cleaned IPs through difference operation; and verifying that all firewall policies related to the IP to be cleared are cleared. Therefore, all firewall policies related to the offline IP are automatically and accurately identified, and batch cleaning is carried out. While the cleaning efficiency is improved, the safety and the traceability are also remarkably enhanced.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and in particular, relates to a method for automatically cleaning offline IP in a security policy of a network firewall device. BACKGROUND

[0002] A network firewall is the core security line of a network boundary. It realizes accurate control of data flow in and out of a network by configuring a security policy composed of a source IP address, a destination IP address, a protocol type (TCP / UDP / ICMP, etc.), a port number, and an action (allowance / rejection), and protects internal network resources from unauthorized access and malicious attacks.

[0003] With the growth of business of an enterprise, the number of firewall security policies continues to increase. The firewall policies of a large enterprise network often reach several thousand or even tens of thousands. When a business IP needs to be cleaned due to business changes, system offline, or migration, the existing technology generally adopts a manual cleaning method. The specific process is as follows: a business party submits an IP cleaning application, an administrator manually logs in to a firewall management interface (Web / CLI), manually searches for and judges the policies related to the offline IP, and modifies the source / destination address and referenced address group / address object in each policy. The manual cleaning method has the following fundamental defects: (1) It is difficult to accurately locate the related policies. The firewall does not have a batch policy search function based on multiple IPs, and the administrator needs to identify the related rules in the massive policies by experience. Moreover, the IP often exists in the form of address group, network segment, and address object nesting, and the manual cleaning cannot completely clarify the reference relationship, and is easy to miss. If the offline IP reaches dozens / hundreds, it is more tedious to compare one by one. (2) The management complexity increases exponentially. The tens of thousands of policies in a large network need to be browsed one by one, which is time-consuming. Long-term repetitive operation easily leads to inattention, causing omission (policy redundancy) or deletion (affecting business). (3) It cannot respond to IP state changes in a timely manner. It only relies on the active application of the business party, and there is no active IP state monitoring mechanism. The cleaning often lags behind the IP offline, and the invalid policies continue to occupy system resources. Moreover, the IP state needs to be manually pinged for verification, and there is a lack of systematic verification means. (4) There is no operation record and rollback mechanism. The manual operation has no detailed log, and it is difficult to trace back after a fault. It is difficult to quickly recover important policies after a mistake, which affects business continuity. (5) There is no cleaning verification and audit mechanism. After cleaning, it cannot be verified whether there is any omission, there is no standardized process to evaluate the cleaning effect, and quality audit cannot be performed. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a method for automatically cleaning offline IP in a security policy of a network firewall device, which can automatically and accurately identify all firewall policies related to the offline IP and perform batch cleaning.

[0005] In a first aspect, the application provides a method for automatically cleaning offline IP in a security policy of a network firewall device, the method comprising the following steps: automatically detecting the survival state of a business IP by network detection according to a preset period, to determine an IP to be cleaned; querying all firewall policies related to the IP to be cleaned by using a policy analysis algorithm; constructing a reference tree for each firewall policy, and traversing the nodes of the reference tree to extract the numerical interval of all IPs, and recursively cleaning all IPs to be cleaned by difference operation; verifying that all firewall policies related to the IP to be cleaned have been cleaned.

[0006] In some embodiments, the step of automatically detecting the survival state of a business IP by network detection according to a preset period, to determine an IP to be cleaned, comprises the following steps: connecting to a converged switch within a management range through SSH; issuing a batch ping command to each of the converged switches according to a preset period to detect the survival state of a business IP; wherein if an IP is not pinged, the IP is marked as an IP to be cleaned.

[0007] In some embodiments, the step of querying all firewall policies related to the IP to be cleaned by using a policy analysis algorithm comprises the following steps: scanning all firewall configurations to extract all address groups and address objects, generating an unreferenced hash table, and recursively referencing the unreferenced hash table until the value list of the address group and address object is converted into IP, IP range or IP network segment to obtain a referenced hash table; converting the source and destination addresses of all firewall policies after expanding the IP to be cleaned and the referenced hash table into numerical intervals, and determining all candidate firewall policies related to the IP to be cleaned by intersection judgment rules; calculating the number of IPs corresponding to the source and destination addresses of each candidate firewall policy, and determining the candidate firewall policy as a candidate firewall policy related to the IP to be cleaned if at least one of the number of IPs is less than 256.

[0008] In some embodiments, the step of constructing a reference tree for each firewall policy, and traversing the nodes of the reference tree to extract the numerical interval of all IPs, and recursively cleaning all IPs to be cleaned by difference operation, comprises the following steps: parsing the unreferenced hash table by depth-first search (DFS) for the source and destination addresses of each firewall policy to construct a reference tree with the root node being the policy, the first-level child node being the address group, the second-level child node being the address object, and the leaf node being the IP; traverse all leaf nodes of the reference tree in depth-first order, extract the IP therein and convert it into a digital interval; perform a difference set operation on the digital interval of the extracted IP and the digital interval of the IP to be cleaned up, and recombine the difference set result into a single IP, IP range or network segment in the form of an effective IP for firewall configuration update.

[0009] In some embodiments, the firewall configuration update is performed through an API or SSH.

[0010] In some embodiments, the method further comprises the following steps: obtaining the firewall configuration before and after the cleanup; wherein, the firewall configuration after the cleanup is subjected to double reading verification; for each modified firewall policy in the firewall configuration before and after the cleanup, performing a difference set operation on the source address and destination address set to obtain a difference set result; if the difference set result contains a non-cleaned-up IP, it is determined to be a false deletion, and the firewall policy and the false-deleted IP are recorded; for all firewall policies in the firewall configuration after the cleanup, checking whether the source address and destination address contain the IP to be cleaned up; if they do, it is determined to be a missed deletion, and the firewall policy and the uncleaned-up IP are recorded.

[0011] In some embodiments, the method further comprises the following steps: when performing the firewall configuration update, generating an IP cleanup ID, and recording the firewall configuration before and after the cleanup; in response to a rollback operation, using the firewall configuration before the cleanup to overwrite the firewall configuration after the cleanup.

[0012] In a second aspect, the present application provides an apparatus for automatically cleaning up offline IPs in a security policy of a network firewall device, the apparatus comprising: an IP state monitoring module for automatically detecting the survival state of a business IP through network detection according to a preset period to determine an IP to be cleaned up; a policy analysis module for querying all firewall policies related to the IP to be cleaned up using a policy analysis algorithm; a batch cleanup module for constructing a reference tree for each firewall policy, traversing the nodes of the reference tree, extracting the digital interval of all IPs, and recursively cleaning up all IPs to be cleaned up through difference operation; a cleanup verification module for verifying that all firewall policies related to the IP to be cleaned up have been cleaned up.

[0013] Thirdly, this application provides an electronic device, including: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory via the bus, and when the machine-readable instructions are executed by the processor, the steps of the automatic cleanup method for offline IPs in the security policy of a network firewall device as described in any one of the first aspects are executed.

[0014] Fourthly, this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the automatic cleanup method for offline IPs in a network firewall device security policy as described in any of the above claims.

[0015] This application describes an automatic method for cleaning up offline IPs in a network firewall device security policy. The method automatically detects the liveness status of service IPs through network probing at a preset period to determine the IPs to be cleaned up. It then uses a policy parsing algorithm to query all firewall policies related to the IPs to be cleaned up. For each firewall policy, a reference tree is constructed, and the nodes of the reference tree are traversed to extract the numerical ranges of all IPs. All IPs to be cleaned up are recursively cleaned up using difference operations. Finally, it verifies that all firewall policies related to the IPs to be cleaned up have been cleaned. This automatically and accurately identifies all firewall policies related to offline IPs and performs batch cleanup. While improving cleanup efficiency, security and traceability are also significantly enhanced. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart illustrating the automatic cleanup method for offline IPs in the security policy of the network firewall device described in this application embodiment is shown. Figure 2 This document illustrates a flowchart illustrating how, according to an embodiment of this application, the liveness status of service IPs is automatically detected through network probing at a preset period to determine the IPs to be cleaned up. Figure 3 This document illustrates a flowchart illustrating how a policy parsing algorithm is used to query all firewall policies related to the IP address to be cleaned, as described in an embodiment of this application. Figure 4 This illustration shows a schematic diagram of how firewall policies are expanded according to an embodiment of this application; Figure 5The flowchart illustrates the process described in this application embodiment of constructing a reference tree for each firewall policy, traversing the nodes of the reference tree, extracting the numerical range of all IPs, and recursively cleaning up all IPs to be cleaned through difference operations; Figure 6 This illustration shows a schematic diagram of performing a difference operation between the extracted IP's numeric range and the numeric range of the IP to be cleaned, as described in an embodiment of this application. Figure 7 This document illustrates a flowchart illustrating the verification process described in an embodiment of this application, confirming that all firewall policies related to the IP address to be cleaned have been cleared. Figure 8 This illustration shows a schematic diagram of the automatic cleanup device for offline IPs in the security policy of the network firewall device described in this application embodiment; Figure 9 A schematic diagram of the structure of the electronic device described in an embodiment of this application is shown. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.

[0019] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0020] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.

[0021] In view of the technical problems mentioned in the background, this application provides an automatic cleanup method for offline IPs in the security policy of a network firewall device, which can automatically and accurately identify all firewall policies related to offline IPs and perform batch cleanup.

[0022] See the instruction manual appendix Figure 1 This application provides a method for automatically cleaning up offline IPs in the security policy of a network firewall device, the method comprising the following steps: S1. Automatically detect the liveness status of service IPs through network probing according to a preset cycle, and determine the IPs to be cleaned up; S2. Use the policy parsing algorithm to query all firewall policies related to the IP to be cleaned; S3. Construct a reference tree for each firewall policy, traverse the nodes of the reference tree, extract the numeric range of all IPs, and recursively clean up all IPs to be cleaned through difference operation; S4. Verify that all firewall policies related to the IP to be cleaned have been cleaned.

[0023] Specifically, in step S1, please refer to the appendix of the instruction manual. Figure 2 The automatic detection of the liveness status of service IPs through network probing at a preset period to determine the IPs to be cleaned up includes the following steps: S101. Connect to the aggregation switch within the management scope via SSH; S102. Send batch ping commands to each of the aggregation switches according to a preset cycle to check the liveness status of the service IPs; if an IP cannot be pinged, mark the IP as an IP to be cleaned up.

[0024] In one embodiment, the network segments to be managed and the list of aggregation switch devices are first defined. A scheduled detection period (customizable, e.g., 30 minutes / time), the number of times a single ping command is executed (default 3 times to ensure detection stability), and a survival threshold (at least one successful ping out of 3 times indicates survival) are set. Then, connections are established with each aggregation switch via SSH. Batch ping commands are sent to each aggregation switch through the established SSH connections. IPs from different network segments are assigned to the corresponding aggregation switches for detection, and the ping response of each IP is recorded. If at least one of the three pings for an IP is successful (response code 0), it is determined to be a live IP; if all three pings for an IP fail, it is determined to be a dead IP and marked as an IP to be cleaned up.

[0025] It should be noted that for IPs determined to be inactive and marked as requiring cleanup, even if the business party does not request the IP to be taken offline, the inactive IP will be notified and a work order for IP deactivation will be submitted. Thus, by proactively verifying the IP's liveness status in step S1, truly inactive IPs to be cleaned are filtered out, which solves the problems of existing technologies that rely on manual, passive application from the business party, lack of automatic IP status verification, and the easy deletion of live IPs by mistake.

[0026] In other embodiments, network layer probing can also be used to determine whether an IP is inactive: in addition to ICMP-based ping probing, ARP probing can also be used (by checking if the MAC address corresponding to the IP exists to determine its activity on the Layer 2 network). Device status query: The port traffic information or MAC address entry corresponding to the IP on the switch can be queried via the SNMP protocol. If there is no traffic or no corresponding entry for a long time, it can be determined to be inactive. Application layer heartbeat: For specific business systems, the online status of the business IP can be determined by monitoring its application layer heartbeat or API interface accessibility. Traffic log analysis: It can be connected to a traffic analysis platform (such as NetFlow, sFlow). If an IP does not generate any network traffic within a set time window, it can be determined to be offline.

[0027] Step S2 primarily involves overcoming the nested reference barriers of address groups / objects to accurately locate all firewall policies containing the IPs to be cleaned, providing precise targets for subsequent batch cleanup. See the appendix to the manual. Figure 3 In step S2, the process of using a policy resolution algorithm to query all firewall policies related to the IP to be cleaned includes the following steps: S201. Scan all firewall configurations, extract all address groups and address objects, generate an undereferenced hash table, and recursively dereference the undereferenced hash table until the value list of address groups and address objects is converted into IP, IP range or IP segment to obtain the dereferenced hash table. S202. Convert the source and destination addresses of all firewall policies after expanding the dereference hash table and the IP to be cleaned into numeric ranges, and determine all candidate firewall policies related to the IP to be cleaned through intersection judgment rules. S203. For each candidate firewall policy, calculate the number of IPs corresponding to its source address and destination address. If at least one IP is less than 256, determine the candidate firewall policy as a candidate firewall policy related to the IP to be cleaned.

[0028] Firewalls contain address group and address object configurations. While the design is largely similar across different firewall brands, some firewalls treat address groups and address objects as identical objects. For the sake of consistency, this application defines an address object as a collection of multiple IPs, IP ranges, and IP segments, and an address group as a collection of multiple address objects, address groups, IPs, IP ranges, and IP segments. In step S201, a configuration query request is first sent via the firewall API interface, or the firewall is logged into via SSH and the corresponding command is executed to obtain the complete configuration text. Then, all address groups and address objects are extracted and stored in a hash table, with the name as the key (string format) and the content as the value (list format). The parsed hash table is in the form of {'group1':['addr2','192.168.1.0 / 24'],'addr2':['192.168.1.10']....}. The parsed address groups and address objects are not completely dereferenced; that is, the values ​​obtained from the hash table may still contain other address group objects. This is referred to as an undereferenced hash table.

[0029] After parsing, the values ​​stored in the hash table contain address group object names, which need to be dereferenced. This means completely converting the address groups and address objects in the hash table's value list into IP addresses, IP ranges, or IP network segments. To do this, a new dereferenced hash table object needs to be created. For each address group and address object in the original hash table (the undereferenced hash table mentioned above), its contained sub-objects, sub-groups, sub-network segments, and sub-address ranges are recursively searched. Each time a new address group or address object is found in the value list of an address group or address object, the recursion continues until the value list of an address group or address object no longer contains any address group or address object names, indicating that the reference relationship has been completely expanded. For example, {'group1':['addr2','192.168.1.0 / 24'],'addr2':['192.168.1.10']....}, after dereferencing, becomes: {'group1':['192.168.1.10','192.168.1.0 / 24'],'addr2':['192.168.1.10']....}. After complete dereferencing, the dereferenced object is stored in a new hash table, called the dereference hash table. It is important to note that the original hash table cannot be overwritten here; otherwise, multiple address groups will reference the same address object.

[0030] In step S202, firstly, refer to the appendix to the instruction manual. Figure 4It iterates through the firewall policies one by one, collecting all element names (including address groups, address objects, address ranges, network segments, etc.) involved in the source and destination addresses. By dereferencing the hash table, it completely expands the source and destination addresses in the firewall policies into a collection of pure individual IPs, IP ranges, and network segments.

[0031] Next, it is determined whether there are any offline IPs that need to be cleaned up within the set (the IPs to be cleaned up as determined in step S1). Taking IPv4 as an example, since the resolved firewall source address, destination address, and offline IPs are all lists in dotted decimal string format, it is visually apparent that 192.168.1.50 is within the range of 192.168.1.10-192.168.1.100, but the program cannot directly recognize it. To achieve this function, the IP, IP range, and network segment need to be converted into numerical intervals, and then the existence of overlapping intervals is determined to determine whether the address contains offline IPs. Converting dotted-decimal IP addresses to numbers is a common practice in various programming languages, supported by dedicated libraries. For example, in Python, the `ipadress` library can convert 192.168.1.10-192.168.1.100 to the number range [3232235786, 3232235876], and 192.168.1.50 to [3232235826, 3232235826]. Therefore, determining if IP addresses intersect becomes determining if number ranges intersect. For two ranges [a1, b1] and [a2, b2], if they intersect, then a1 is less than or equal to b2 and a2 is less than or equal to b1; otherwise, they do not intersect.

[0032] For the number range [B_start, B_end] of the IPs to be cleaned, if the number range [A_start, A_end] of a certain address in the firewall policy satisfies "A_start≤B_end and A_end≥B_start", then it is determined that the firewall policy contains the IPs to be cleaned.

[0033] In step S203, in addition to determining whether there is an intersection, there may be some special cases in actual business. For example, some firewalls need to enable the default policy of source address as any, destination address as any, and service as ICMP, which is the basic operation and maintenance policy that allows ping by default. When the IP needs to be taken offline, it is not in line with the business logic to perform difference on any. Therefore, the range of IP addresses can be filtered again. For example, the IP address segment or range with less than 256 IP addresses can be taken offline to further accurately filter out the firewall policies that need to be cleaned up.

[0034] This application utilizes the aforementioned strategy parsing algorithm to transform firewall text configurations from different vendors and with varying formats into a standard, program-understandable data structure through structured parsing and recursive dereferencing. Furthermore, it unifies all IP addresses (single, range, and segment) into mathematical number intervals, transforming complex IP inclusion, intersection, and exclusion logic into efficient and unambiguous interval operations. This completely resolves the issues of omissions and errors caused by the nested nature of address objects and diverse IP formats during manual identification.

[0035] Step S3 primarily involves batch-removing IPs to be cleaned while retaining valid configurations, achieving accurate and efficient updates. This solves the problems of low efficiency, easy omissions and errors, and inability to process in batches inherent in existing technologies. (See the attached manual.) Figure 5 The process of constructing a reference tree for each firewall policy, traversing the nodes of the reference tree, extracting the numeric ranges of all IPs, and recursively cleaning up all IPs to be cleaned through difference operations includes the following steps: S301. For each firewall policy, the source address and destination address are parsed using depth-first traversal (DFS) to resolve the unresolved reference hash table, and a reference tree is constructed with the root node as the policy, the first-level child nodes as address groups, the second-level child nodes as address objects, and the leaf nodes as IPs. S302. Traverse all leaf nodes of the reference tree in depth-first order, extract the IPs and convert them into numeric ranges; S303. Perform a difference operation between the extracted IP number range and the IP number range to be cleaned, and re-merge the difference result into a single IP, IP range, or network segment as a valid IP for firewall configuration update.

[0036] Specifically, the unresolved reference hash table is first traversed using a depth-first search (DFS). For each policy, the address groups and address object names contained in the source and destination addresses are used to search the unresolved reference hash table. Since the reference relationships between address groups and address objects are necessarily acyclic, the resolution result will inevitably be a tree structure. The system can ultimately resolve the firewall's source and destination address reference tree. Then, refer to the appendix of the manual. Figure 6 For each firewall source address, destination address, address group, address object, individual IP, IP range, and network segment encountered, perform a range difference operation on the offline IP. The details of the difference operation are as follows: (1) Taking IPv4 as an example, the IPs in the firewall are in dotted decimal string format. It is necessary to convert individual IPs, IP ranges (such as 192.168.1.10-192.168.1.20), and network segments (such as 192.168.1.0 / 24) into numerical ranges (such as [start, end]). All offline IPs are also converted into range sets.

[0037] (2) Perform a difference operation on all intervals involved in the strategy and the set of offline IP intervals to obtain the remaining offline IP intervals. Specifically, for two intervals [a1,b1] and [a2,b2], the difference result may be: [a1,a2-1], [b2+1,b1], [a1,a2-1] and [b2+1,b1].

[0038] (3) Re-merge the difference result into a single IP, IP range or network segment, such as [3232235826,3232235826]. By performing four divisions on 256 and taking the remainder, it can be converted back into dotted decimal format.

[0039] For example, for IPs 192.168.1.10-192.168.1.20 and IP 192.168.1.15, the difference operation results are: 192.168.1.10-192.168.1.14 and 192.168.1.16-192.168.1.20.

[0040] After performing a difference operation on the address groups, address objects, firewall policy source addresses, and firewall policy destination addresses in the reference tree, it is necessary to update the firewall's address groups, address objects, and the source and destination addresses of the firewall policy. This can be done using either an API or SSH solution. If using an API, an HTTP / HTTPS request for firewall updates is sent via the firewall's API interface, using the results of the interval difference operation on the address groups, address objects, and the source and destination addresses of the firewall policy to update the relevant objects. If using an SSH solution, based on the address groups, address objects, and the source and destination addresses of the firewall policy after the difference operation, command-line commands for the firewall are generated, and then the SSH library is invoked to automatically execute the relevant modification commands on the firewall command line.

[0041] Step S4 primarily verifies the cleaning results to ensure no data is missed or mistakenly deleted, guaranteeing data reliability and addressing the problems of low efficiency, proneness to missed or mistaken deletions, and inability to process data in batches inherent in existing technologies. (See the appendix in the instruction manual.) Figure 7 The verification process confirms that all firewall policies related to the IP address to be cleaned have been cleared, including the following steps: S401. Obtain the firewall configuration before and after cleanup; among them, perform dual-read verification on the cleanup firewall configuration; S402. For each modified firewall policy in the firewall configuration before and after cleanup, perform a difference operation on the source address and destination address sets to obtain the difference result; if the obtained difference result contains an IP that is not to be cleaned, it is determined to be a mistaken deletion, and the firewall policy and the mistakenly deleted IP are recorded. S403. For all firewall policies in the cleaned firewall configuration, check whether the source address and destination address contain the IP to be cleaned. If they do, it is determined that they were missed and the firewall policy and the IP that was not cleaned are recorded.

[0042] Specifically, to ensure the accuracy of the cleaned firewall policy configuration and avoid occasional garbled text issues in the output of large sections of configuration on some firewall devices, the complete firewall configuration is read twice consecutively before any operation is performed. Only when the policy content read and parsed twice is the data source considered reliable, and the subsequent cleanup process begins, fundamentally eliminating the possibility of a series of subsequent errors caused by a single read error.

[0043] After ensuring the data source is reliable, compare the firewall policies before and after the cleanup. For each modified firewall policy, perform a difference operation between the source / destination address set before cleanup and the source / destination address set after cleanup. If the difference result contains any IP address not in the list of IPs taken offline in this task, it is determined as "erroneously deleted," and the policy and the mistakenly deleted IP are recorded. Then, iterate through all cleaned policies and check if their source / destination addresses still contain any IPs from the list of IPs taken offline in this task. If so, it is determined as "missed deletion," and the policy and the IPs that were not successfully cleaned are recorded.

[0044] As can be seen, the proposed method for automatically cleaning up offline IPs in a network firewall security policy involves several steps. First, it automatically discovers inactive IPs by executing ping commands in batches via SSH; it quickly locates all relevant policies using hash tables and recursive dereferencing; and it executes cleanup commands concurrently via API or SSH. The entire process is automated, reducing what would have taken hours of manual work to minutes. This full automation significantly reduces human intervention and increases policy cleanup speed by several orders of magnitude. Second, by recursively dereferencing address groups and address objects, a complete reference tree is constructed, ensuring accurate identification regardless of the depth of the IP's nesting. Simultaneously, converting IP addresses into numerical ranges and performing intersection and difference operations mathematically guarantees the accuracy of IP range and network segment determination. Most importantly, by comparing policies before and after cleanup, rigorous checks for "false deletion" and "missed deletion" are performed, forming a closed-loop verification process that ensures 100% accuracy of the final result. By using intelligent recognition algorithms and closed-loop verification mechanisms, the problems of "not being able to see everything, not being able to calculate accurately, and being prone to omissions" in manual operations are fundamentally solved, ensuring the accuracy and completeness of the cleaning process.

[0045] Furthermore, the automatic cleanup method for offline IPs in a network firewall device security policy provided in this application also supports rollback operations, allowing the system to quickly restore the firewall policy to its state before cleanup in special circumstances. In one embodiment, the rollback operation is based on detailed logging of all automated cleanup operations. The log information includes operation time, operator, policy entries involved, content before and after cleanup, execution results, etc. Specifically, a cleanup ID is assigned to each batch cleanup operation. If an anomaly is found after cleanup, during the rollback operation, all operation records of this batch of automatic cleanup are retrieved from the database based on the cleanup ID. Based on the content before and after changes in the records, all firewall policies, address groups, and address objects are restored. Forced or non-forced restoration can be used. For forced restoration, the content before cleanup in the records is directly overwritten with the current firewall policy content. For non-forced restoration, it is first checked whether the content after cleanup is consistent with the current actual firewall configuration. If they are consistent, the content before cleanup is used to overwrite the firewall policy. Thus, the rollback operation automatically restores the policy state before cleanup based on the operation logs and backup files, ensuring business continuity and security, and facilitating subsequent tracking and accountability.

[0046] By providing comprehensive logging, a reliable rollback mechanism, and upfront verification, the originally high-risk manual change operation is transformed into an automated process with controllable risks and traceable procedures, greatly improving the security of network changes.

[0047] Based on the same inventive concept, this application also provides an automatic cleanup device for offline IPs in the security policy of a network firewall device. Since the principle of the device in this application is similar to the automatic cleanup method for offline IPs in the security policy of a network firewall device described above, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0048] As per the instruction manual Figure 8 As shown in the illustration, this application also provides an automatic cleanup device for offline IPs in the security policy of a network firewall device, the device comprising: The IP status monitoring module 801 is used to automatically detect the liveness status of service IPs through network probing at a preset period and determine the IPs to be cleaned up. The policy parsing module 802 is used to query all firewall policies related to the IP to be cleaned using a policy parsing algorithm; The batch cleanup module 803 is used to construct a reference tree for each of the firewall policies, traverse the nodes of the reference tree, extract the numeric range of all IPs, and recursively clean up all IPs to be cleaned through difference operation; The cleanup verification module 804 is used to verify that all firewall policies related to the IP to be cleaned have been cleaned.

[0049] In some embodiments, the IP status monitoring module 801 automatically detects the liveness status of service IPs through network probing at a preset period and determines the IPs to be cleaned up, including: connecting to the aggregation switch within the management scope via SSH; sending batch ping commands to each of the aggregation switches at a preset period to detect the liveness status of service IPs; wherein, if an IP cannot be pinged, the IP is marked as an IP to be cleaned up.

[0050] In some embodiments, the policy parsing module 802 uses a policy parsing algorithm to query all firewall policies related to the IP to be cleaned, including: scanning all firewall configurations, extracting all address groups and address objects, generating an undereferenced hash table, and recursively dereferencing the undereferenced hash table until the value list of address groups and address objects is converted into IPs, IP ranges, or IP segments to obtain a dereferenced hash table; converting the source address and destination address of all firewall policies after the IP to be cleaned and the dereferenced hash table are expanded into numeric ranges, and determining all candidate firewall policies related to the IP to be cleaned through intersection judgment rules; calculating the number of IPs corresponding to the source address and destination address of each candidate firewall policy, and if at least one IP count is less than 256, determining the candidate firewall policy as a candidate firewall policy related to the IP to be cleaned.

[0051] In some embodiments, the batch cleanup module 803 constructs a reference tree for each firewall policy, traverses the nodes of the reference tree, extracts the numeric ranges of all IPs, and recursively cleans up all IPs to be cleaned through difference operations. This includes: parsing the unresolved reference hash table for the source and destination addresses of each firewall policy using depth-first traversal (DFS), constructing a reference tree with the root node as the policy, first-level child nodes as address groups, second-level child nodes as address objects, and leaf nodes as IPs; traversing all leaf nodes of the reference tree in depth-first order, extracting the IPs and converting them into numeric ranges; performing a difference operation between the extracted numeric ranges of IPs and the numeric ranges of the IPs to be cleaned, and merging the resulting difference results back into a single IP, IP range, or network segment as a valid IP for firewall configuration updates. The firewall configuration update is performed via API or SSH.

[0052] In some embodiments, the cleanup verification module 804 verifies that all firewall policies related to the IP to be cleaned have been cleaned, including: obtaining the firewall configuration before and after cleanup; wherein, a double-read verification is performed on the cleaned firewall configuration; for each modified firewall policy in the firewall configuration before and after cleanup, a difference operation is performed on the source address and destination address sets to obtain the difference result; if the obtained difference result contains an IP that is not to be cleaned, it is determined to be a mistaken deletion, and the firewall policy and the mistakenly deleted IP are recorded; for all firewall policies in the cleaned firewall configuration, it is checked whether the source address and destination address contain the IP to be cleaned, and if they do, it is determined to be a missed deletion, and the firewall policy and the uncleaned IP are recorded.

[0053] In some embodiments, the apparatus further includes a rollback module, which generates an IP cleanup ID and records the firewall configuration before and after cleanup when performing firewall configuration updates; and responds to a rollback operation by overwriting the cleanup firewall configuration with the firewall configuration before cleanup.

[0054] The automatic IP cleanup device in the network firewall security policy described in this application automatically detects the liveness status of service IPs through network probing at preset intervals using an IP status monitoring module to determine the IPs to be cleaned. A policy parsing module uses a policy parsing algorithm to query all firewall policies related to the IPs to be cleaned. A batch cleanup module constructs a reference tree for each firewall policy, traverses the nodes of the reference tree, extracts the numerical ranges of all IPs, and recursively cleans all IPs to be cleaned using difference operations. A cleanup verification module verifies that all firewall policies related to the IPs to be cleaned have been cleaned. This automatically and accurately identifies all firewall policies related to offline IPs and performs batch cleanup. While improving cleanup efficiency, security and traceability are also significantly enhanced.

[0055] Based on the same concept of the present invention, as shown in the appendix to the specification. Figure 9 As shown in the figure, an embodiment of this application provides the structure of an electronic device 900, which includes: at least one processor 901, at least one network interface 904 or other user interface 903, a memory 905, and at least one communication bus 902. The communication bus 902 is used to realize the connection and communication between these components. The electronic device 900 may optionally include a user interface 903, including a display (e.g., touch screen, LCD, CRT, holographic imaging, or projector, etc.), a keyboard, or a clicking device (e.g., mouse, trackball, touchpad, or touch screen, etc.).

[0056] Memory 905 may include read-only memory and random access memory, and provides instructions and data to processor 901. A portion of memory 905 may also include non-volatile random access memory (NVRAM).

[0057] In some implementations, memory 905 stores executable modules or data structures, or subsets thereof, or extended sets thereof: The 9051 operating system contains various system programs used to implement various basic business functions and handle hardware-based tasks. Application module 9052 contains various applications, such as launcher, media player, and browser, to implement various application functions.

[0058] In this embodiment, by calling the program or instructions stored in the memory 905, the processor 901 is used to execute steps such as the automatic cleanup method for offline IPs in a network firewall device security policy.

[0059] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs steps such as those in an automatic cleanup method for offline IPs in a network firewall device security policy.

[0060] Specifically, the storage medium can be a general-purpose storage medium, such as a removable disk or hard drive. When the computer program on the storage medium is run, it can automatically and accurately identify all firewall policies related to the offline IP and perform batch cleanup.

[0061] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and there may be other division methods in actual implementation. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the mutual coupling or direct coupling or communication connection shown or discussed may be through some communication interface, and the indirect coupling or communication connection of the apparatus or units may be electrical, mechanical, or other forms.

[0062] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0063] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0064] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0065] Finally, it should be noted that the above embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A method for automatically cleaning up offline IPs in the security policy of a network firewall device, characterized in that, The method includes the following steps: The system automatically detects the liveness status of service IPs through network probing at preset intervals to determine the IPs to be cleaned up. Use a policy parsing algorithm to query all firewall policies related to the IP address to be cleaned; For each of the aforementioned firewall policies, a reference tree is constructed, and the nodes of the reference tree are traversed to extract the numerical range of all IPs. All IPs to be cleaned are then recursively cleaned up through difference operations. Verification confirms that all firewall policies related to the IP address to be cleaned have been cleaned.

2. The automatic cleanup method for offline IPs in the security policy of a network firewall device according to claim 1, characterized in that, The process of automatically detecting the liveness status of service IPs through network probing at a preset period and determining the IPs to be cleaned up includes the following steps: Connect to the aggregation switch within the management scope via SSH; A batch ping command is sent to each of the aggregation switches at a preset cycle to check the liveness status of the service IPs; if an IP cannot be pinged, it is marked as an IP to be cleaned up.

3. The automatic cleanup method for offline IPs in the security policy of a network firewall device according to claim 1, characterized in that, The process of using a policy parsing algorithm to query all firewall policies related to the IP address to be cleaned includes the following steps: Scan all firewall configurations, extract all address groups and address objects, generate an undereferenced hash table, and recursively dereference the undereferenced hash table until the value list of address groups and address objects is converted into IPs, IP ranges, or IP segments to obtain the dereferenced hash table. The source and destination addresses of all firewall policies after the IP to be cleaned and the dereference hash table are expanded are converted into numeric ranges, and all candidate firewall policies related to the IP to be cleaned are determined by the intersection judgment rule. For each candidate firewall policy, calculate the number of IPs corresponding to its source address and destination address. If at least one IP is less than 256, the candidate firewall policy is determined as a candidate firewall policy related to the IP to be cleaned.

4. The automatic cleanup method for offline IPs in the security policy of a network firewall device according to claim 3, characterized in that, The process of constructing a reference tree for each firewall policy, traversing the nodes of the reference tree, extracting the numeric ranges of all IPs, and recursively cleaning up all IPs to be cleaned through difference operations includes the following steps: For each firewall policy, the source and destination addresses are parsed using depth-first traversal (DFS) to resolve the unresolved reference hash table, and a reference tree is constructed with the root node representing the policy, the first-level child nodes representing the address group, the second-level child nodes representing the address object, and the leaf nodes representing the IP address. Traverse all leaf nodes of the reference tree in depth-first order, extract the IPs and convert them into numeric ranges; Perform a difference operation between the extracted IP range and the IP range to be cleaned, and then merge the difference results back into a single IP, IP range, or network segment as a valid IP for firewall configuration updates.

5. The automatic cleanup method for offline IPs in the security policy of a network firewall device according to claim 4, characterized in that, in, Update firewall configuration via API or SSH.

6. The automatic cleanup method for offline IPs in the security policy of a network firewall device according to claim 4, characterized in that, The verification process confirms that all firewall policies related to the IP address to be cleaned have been cleared, including the following steps: Obtain the firewall configuration before and after cleanup; perform dual-read verification on the cleanup firewall configuration. For each modified firewall policy in the firewall configuration before and after cleanup, perform a difference operation on the source address and destination address sets to obtain the difference result; if the obtained difference result contains IPs that are not to be cleaned, it is determined to be a mistaken deletion, and the firewall policy and the mistakenly deleted IPs are recorded. For all firewall policies in the cleaned firewall configuration, check whether the source address and destination address contain the IPs to be cleaned. If they do, it is determined that they were missed and the firewall policy and the IPs that were not cleaned are recorded.

7. The automatic cleanup method for offline IPs in a network firewall device security policy according to claim 4, characterized in that, The method further includes the following steps: When updating firewall configuration, an IP cleanup ID is generated, and the firewall configuration before and after cleanup is recorded. In response to the rollback operation, the firewall configuration before cleanup is overwritten with the firewall configuration after cleanup.

8. An automatic cleanup device for offline IPs in a network firewall security policy, characterized in that, The device includes: The IP status monitoring module is used to automatically detect the liveness status of service IPs through network probing at preset intervals and determine the IPs to be cleaned up. The policy parsing module is used to query all firewall policies related to the IP to be cleaned using a policy parsing algorithm; The batch cleanup module is used to construct a reference tree for each firewall policy, traverse the nodes of the reference tree, extract the numeric range of all IPs, and recursively clean up all IPs to be cleaned through difference calculation; The cleanup verification module is used to verify that all firewall policies related to the IP to be cleaned have been cleaned.

9. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the automatic cleanup method for offline IPs in a network firewall device security policy as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the automatic cleanup method for offline IPs in a network firewall device security policy as described in any one of claims 1 to 7.

Images