A firewall policy anomaly automatic detection and intelligent processing method

Abstract

The application discloses a kind of firewall policy exception automation detection and intelligent processing method, comprising the following steps: S1: rule preprocessing and modeling: S2: abnormal detection of exception domain: S3: risk assessment of exception domain: for each exception domain saved in S2, risk assessment is carried out using the ToE risk assessment model based on CVSS improvement, risk value is calculated, and the final security action that the exception domain should execute is determined according to risk threshold value;S4: segmentation and processing of exception domain: for the exception domain after S3 evaluation, two strategies of simple processing or recursive segmentation are adopted, the application closely combines abnormal detection and processing process, optimizes processing efficiency and accuracy using the exception domain information saved in detection stage, significantly reduces the influence range of exception on firewall policy, improves the automation level and security of firewall policy management, can realize efficient, accurate and safe automation policy management, has wide application prospect, and is beneficial to popularization and application.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for automated detection and intelligent processing of firewall policy anomalies. Background Technology

[0002] Currently, firewalls, as the core line of defense for network security, rely heavily on the correct configuration of security policies (rules) for effectiveness. As networks expand, the number of policies increases dramatically and their relationships become more complex. Manual management is prone to errors, leading to anomalies such as "shadowing," "redundancy," "generalization," and "correlation" among rules. These anomalies can trigger security vulnerabilities or communication failures.

[0003] Existing technologies primarily focus on anomaly detection, such as detection algorithms based on decision trees, tuple spaces, or two-dimensional vectors. However, in anomaly handling, existing methods often process the rule set as a whole or divided into subsets, employing approximate algorithms like greedy algorithms to determine the uniform action for the entire subset. However, this approach has significant drawbacks: first, the evaluation granularity is coarse; if the risk assessment is flawed, large areas of rules will be incorrectly processed, creating serious security vulnerabilities; second, the processing methods often involve reordering or adding / deleting rules, compromising the integrity and maintainability of the original rule set; and third, there is a lack of precise evaluation criteria for the processing effect, making it difficult to measure the actual impact of anomalies. Therefore, there is an urgent need to develop an automated and intelligent method for detecting and handling firewall policy anomalies that can manage anomalies with fine precision, ensure a secure and controllable processing process, and preserve the original state of the rule set to the greatest extent possible, in order to solve the aforementioned technical problems.

[0004] In view of this, the present invention is hereby proposed. Summary of the Invention

[0005] The purpose of this invention is to provide an automated detection and intelligent processing method for firewall policy anomalies. This method closely integrates anomaly detection and processing, utilizes the anomaly domain information saved during the detection phase to optimize processing efficiency and accuracy, significantly reduces the impact of anomalies on firewall policies, and improves the automation level and security of firewall policy management. It can achieve efficient, accurate, and secure automated policy management, has broad application prospects, and is conducive to widespread application.

[0006] To achieve the above objectives, the present invention provides an automated detection and intelligent processing method for firewall policy anomalies, comprising the following steps: S1: Rule Preprocessing and Modeling: Clean the original firewall rule set, extract key features, construct a five-tuple rule model with source IP, destination IP, source port, destination port and action as the core, and sort it according to preset rules; S2: Anomaly detection in the anomaly domain: For the five-tuple rule model obtained in S1, the key tree data structure is used to construct the main key tree. Through traversal and matching algorithms, conflicts between rules are detected, and the abnormal rules are classified into normal sets, non-associated anomaly sets, and associated anomaly sets. At the same time, the anomaly domain formed by the intersection of the abnormal rules and the matching rules is calculated and saved into the anomaly domain tree. S3: Risk Assessment of Anomaly Domains: For each anomaly domain stored in S2, a ToE risk assessment model based on the Common Vulnerability Scoring System (CVSS) is used to assess the risk, calculate the risk value, and determine the final security action to be taken for the anomaly domain based on the risk threshold. The ToE risk assessment model based on CVSS not only integrates the CVSS standard framework, but also innovatively quantifies rule attributes (such as priority, update time, and affected domain proportion) into risk factors, and performs dynamic assessment in combination with the security requirements of the real-time network environment. A comprehensive risk value is calculated using Bayes' formula, thereby scientifically determining whether the anomaly domain should be subject to the "allow" or "deny" action.

[0007] S4: Segmentation and Processing of Anomaly Domains: For anomaly domains evaluated in S3, two strategies are employed: simple processing or recursive segmentation. If an anomaly domain is formed by two rules, simple processing is performed, directly configuring priorities in the rule tree based on the risk assessment results to cover the original anomaly actions. If an anomaly domain is formed by multiple overlapping rules, recursive segmentation is performed, dividing the complex anomaly domain into multiple sub-anomaly domains composed of two rules, performing risk assessments in S3 for each sub-domain, and then processing the combined results. This process is recursive, and a maximum depth threshold is set to balance processing accuracy and efficiency until the preset recursion depth threshold is reached or the anomaly domain is completely processed. The entire processing is achieved only by adjusting the tree node priorities, without modifying the original rule text, greatly improving the maintainability and traceability of the system.

[0008] Preferably, in S2, the specific method for anomaly detection of the anomaly domain is as follows: the rule is modeled as a two-dimensional spatial vector projection, and the basic matching situation and corresponding anomaly classification judgment logic are defined by using the matching mode of the rule path in the key tree. During the traversal, the anomaly type (normal, redundant, related, etc.) is determined in real time. During the detection process, when a related or shadow anomaly is detected, the algorithm simultaneously calculates the intersection of the two rule influence domains, i.e., the anomaly domain, and saves it as an independent object to ensure that subsequent processing can accurately locate the conflict area.

[0009] Preferably, in S3, the ToE risk assessment model based on CVSS improvement is based on the general vulnerability scoring system framework, and introduces the rule's own attributes as a basic metric set, including rule priority, impact domain size, update time, and complexity of association between rules. It also combines the security requirements, executability requirements, and potential additional damage of the network environment as an environmental metric set, and uses Bayes' theorem to dynamically calculate the risk value of the anomaly domain.

[0010] Preferably, in S4, the specific method of the recursive segmentation strategy is as follows: in the rule model composed of a key tree, the priority of the rule is represented by the hierarchy of the tree nodes. When processing the abnormal domain, the original rule is not deleted or rewritten, but the node corresponding to the abnormal domain is configured with a higher priority in the tree structure so that the correct security action can take effect, thereby achieving non-intrusive anomaly repair.

[0011] The present invention provides an automated detection and intelligent processing method for firewall policy anomalies, which has the following beneficial effects.

[0012] 1. High processing accuracy: For the first time, the "abnormal domain" is proposed as the smallest processing unit, which realizes refined and surgical processing of strategy conflicts, greatly reducing the scope of security risks caused by processing deviations.

[0013] 2. Integrated detection and processing: The detection algorithm provides directly usable "abnormal domain" information for the processing stage, avoiding information loss and redundant calculations, and improving overall efficiency.

[0014] 3. More scientific risk assessment: The dynamic risk assessment model, which combines rule characteristics and environmental factors, provides more accurate assessment results and is more adaptable to complex network environments than traditional static or greedy strategies.

[0015] 4. High system maintainability: The system adopts a "priority overriding" approach rather than "rule addition, deletion and modification" to fully preserve the original rule set, which facilitates auditing, debugging and rollback, and meets enterprise-level operation and maintenance requirements.

[0016] 5. Efficiency and effectiveness balance: By using a recursion depth threshold, administrators are allowed to flexibly balance thoroughness and execution efficiency based on the actual situation. Detailed Implementation

[0017] The present invention will be further described below with reference to specific embodiments to help understand the content of the present invention.

[0018] This invention provides an automated detection and intelligent processing method for firewall policy anomalies, comprising the following steps: S1: Rule Preprocessing and Modeling: Clean the original firewall rule set, extract key features, construct a five-tuple rule model with source IP, destination IP, source port, destination port and action as the core, and sort it according to preset rules; S2: Anomaly detection in the anomaly domain: For the five-tuple rule model obtained in S1, the key tree data structure is used to construct the main key tree. Through traversal and matching algorithms, conflicts between rules are detected, and the abnormal rules are classified into normal sets, non-associated anomaly sets, and associated anomaly sets. At the same time, the anomaly domain formed by the intersection of the abnormal rules and the matching rules is calculated and saved into the anomaly domain tree. The specific method for anomaly detection in the anomaly domain is as follows: the rules are modeled as two-dimensional spatial vector projections, and the basic matching cases and corresponding anomaly classification judgment logic are defined by using the matching patterns of the rule paths in the key tree. During the traversal, the anomaly type (normal, redundant, related, etc.) is determined in real time. During the detection process, when a related or shadow anomaly is detected, the algorithm simultaneously calculates the intersection of the two rule influence domains, i.e., the anomaly domain, and saves it as an independent object to ensure that subsequent processing can accurately locate the conflict area.

[0019] S3: Risk Assessment of Anomaly Domains: For each anomaly domain stored in S2, a ToE risk assessment model based on the Common Vulnerability Scoring System (CVSS) is used to assess the risk, calculate the risk value, and determine the final security action to be taken for the anomaly domain based on the risk threshold. The ToE risk assessment model based on CVSS not only integrates the CVSS standard framework, but also innovatively quantifies rule attributes (such as priority, update time, and affected domain proportion) into risk factors, and performs dynamic assessment in combination with the security requirements of the real-time network environment. A comprehensive risk value is calculated using Bayes' formula, thereby scientifically determining whether the anomaly domain should be subject to the "allow" or "deny" action.

[0020] The ToE risk assessment model based on CVSS improves upon the general vulnerability scoring system framework by introducing the rule's own attributes as a basic set of metrics, including rule priority, impact domain size, update time, and complexity of inter-rule relationships. It also incorporates the network environment's security requirements, executability requirements, and potential additional damages as an environmental set of metrics and uses Bayes' theorem to dynamically calculate the risk value of the anomaly domain.

[0021] S4: Segmentation and Processing of Anomaly Domains: For anomaly domains evaluated in S3, two strategies are employed: simple processing or recursive segmentation. If an anomaly domain is formed by two rules, simple processing is performed, directly configuring priorities in the rule tree based on the risk assessment results to cover the original anomaly actions. If an anomaly domain is formed by multiple overlapping rules, recursive segmentation is performed, dividing the complex anomaly domain into multiple sub-anomaly domains composed of two rules, performing risk assessments in S3 for each sub-domain, and then processing the combined results. This process is recursive, and a maximum depth threshold is set to balance processing accuracy and efficiency until the preset recursion depth threshold is reached or the anomaly domain is completely processed. The entire processing is achieved only by adjusting the tree node priorities, without modifying the original rule text, greatly improving the maintainability and traceability of the system.

[0022] The specific method of the recursive segmentation strategy is as follows: In the rule model composed of a key tree, the priority of the rule is represented by the hierarchy of the tree nodes. When processing the abnormal domain, the original rule is not deleted or rewritten. Instead, a higher priority is configured for the node corresponding to the abnormal domain in the tree structure, so that the correct safety action can take effect, thereby achieving non-intrusive anomaly repair.

[0023] This invention offers several advantages: High processing precision: It is the first to propose using the "abnormal domain" as the smallest processing unit, achieving refined, surgical-like handling of policy conflicts and significantly reducing the scope of security risks caused by processing errors. Integrated detection and processing: The detection algorithm provides directly usable "abnormal domain" information to the processing stage, avoiding information loss and redundant calculations, thus improving overall efficiency. More scientific risk assessment: The dynamic risk assessment model, combining rule characteristics and environmental factors, provides more accurate assessment results and is more adaptable to complex network environments than traditional static or greedy strategies. Strong system maintainability: Employing a "priority overlay" rather than "rule addition, deletion, and modification" processing method, it fully preserves the original rule set, facilitating auditing, debugging, and rollback, meeting enterprise-level operation and maintenance requirements. Balance between efficiency and effectiveness: By using a recursion depth threshold, administrators can flexibly balance thoroughness and execution efficiency based on actual conditions.

[0024] This article uses specific examples to illustrate the inventive concept in detail. The description of the above embodiments is only for the purpose of helping to understand the core idea of ​​the present invention. It should be noted that any obvious modifications, equivalent substitutions or other improvements made by those skilled in the art without departing from the inventive concept should be included within the protection scope of the present invention.

Claims

1. A firewall policy anomaly automatic detection and intelligent processing method, characterized in that, Includes the following steps: S1: Rule Preprocessing and Modeling: The original firewall rule set is cleaned, key features are extracted, and a five-tuple rule model is constructed with source IP, destination IP, source port, destination port and action as the core. IP address pairs are regarded as a set of points in two-dimensional space, and a two-dimensional vector model of the rule influence domain is constructed. The rules are sorted according to the rule action, priority and influence domain size, laying the foundation for efficient detection of redundancy anomalies. S2: Anomaly detection in the anomaly domain: For the five-tuple rule model obtained in S1, the key tree data structure is used to construct the main key tree. Through traversal and matching algorithms, conflicts between rules are detected, and the abnormal rules are classified into normal sets, non-associated anomaly sets, and associated anomaly sets. At the same time, the anomaly domain formed by the intersection of the abnormal rules and the matching rules is calculated and saved into the anomaly domain tree. S3: Risk assessment of anomaly domains: For each anomaly domain stored in S2, a risk assessment is performed using a ToE risk assessment model based on CVSS improvement, the risk value is calculated, and the final safety action to be performed for the anomaly domain is determined based on the risk threshold. S4: Segmentation and Processing of Anomaly Domains: For anomaly domains evaluated in S3, two strategies are adopted: simple processing or recursive segmentation. If an anomaly domain is formed by two rules, simple processing is performed, and priority is configured in the rule tree directly according to the risk assessment results to cover the original abnormal action. If an anomaly domain is formed by multiple overlapping rules, recursive segmentation is performed, dividing the complex anomaly domain into multiple sub-anomaly domains composed of two rules, performing risk assessment in S3 for each sub-domain, and then processing the combined results. This process is recursive, and a maximum depth threshold is set to balance processing accuracy and efficiency until the preset recursive depth threshold is reached or the anomaly domain is completely processed.

2. The method of claim 1, wherein the method further comprises: In S2, the specific method for anomaly detection of the anomaly domain is as follows: the rule is modeled as a two-dimensional spatial vector projection, the matching mode of the rule path in the key tree is used to define the basic matching situation and the corresponding anomaly classification judgment logic, the anomaly type is determined in real time during the traversal process, and when an associated or shadow anomaly is detected during the detection process, the algorithm simultaneously calculates the intersection of the two rule influence domains, that is, the anomaly domain, and saves it as an independent object to ensure that subsequent processing can accurately locate the conflict area.

3. The method of claim 2, wherein the method further comprises: In S3, the ToE risk assessment model based on CVSS is based on the general vulnerability scoring system framework. It introduces the rule's own attributes as the basic metric set, including rule priority, impact domain size, update time, and complexity of association between rules. It also combines the security requirements, executability requirements, and potential additional damage of the network environment as the environmental metric set, and uses Bayes' theorem to dynamically calculate the risk value of the anomaly domain.

4. The method for automated detection and intelligent processing of firewall policy anomalies according to claim 3, characterized in that, In S4, the specific method of the recursive segmentation strategy is as follows: In the rule model composed of a key tree, the priority of the rule is represented by the hierarchy of the tree nodes. When processing the abnormal domain, the original rule is not deleted or rewritten. Instead, a higher priority is configured for the node corresponding to the abnormal domain in the tree structure, so that the correct safety action can take effect, thereby achieving non-intrusive anomaly repair.