Firewall rule optimization method, device, equipment, medium and program product

Abstract

The application provides a firewall rule optimization method, device, equipment, medium and program product, and relates to the fields of big data and information security. The method comprises the following steps: for each rule pair composed of two firewall rules, obtaining the size of a matching range according to the number of communication paths matched by the firewall rules, wherein each communication path is determined by a source object and a destination object, the source object is uniquely determined by a source IP address and a source port, and the destination object is uniquely determined by a destination IP address and a destination port; obtaining the size of a matching range intersection according to the number of same communication paths in the communication paths matched by the two firewall rules; calculating the size of a matching range union of the rule pair; calculating a matching range overlap degree according to the size of the matching range intersection and the size of the matching range union; when the matching range overlap degree is greater than or equal to an overlap degree threshold, performing subsequent redundancy processing on the rule pair, otherwise, determining that the rule pair is not redundant.

Description

Technical Field

[0001] This application relates to the fields of big data and information security, and can be used in the fields of fintech or other fields. More specifically, it relates to a method, apparatus, device, medium, and program product for optimizing firewall rules. Background Technology

[0002] With the rapid development of technologies such as cloud computing, big data, and the Internet of Things, network traffic is growing exponentially, and network attack methods are becoming increasingly diversified and complex. As the core infrastructure of network security protection systems, firewalls are experiencing explosive growth in the size of their rule sets. For example, statistics show that the firewall rule sets of large enterprises and financial institutions have generally reached thousands or even tens of thousands of rules, and are still growing. Therefore, it is crucial to conduct more precise, efficient, and effective management and optimization of firewall rule sets. Summary of the Invention

[0003] In view of the above problems, embodiments of this application provide a method, apparatus, device, media, and program product for optimizing firewall rules.

[0004] A first aspect of this application provides a method for optimizing firewall rules. The method includes: acquiring a first rule dataset, the first rule dataset including runtime configuration data for N firewall rules, the runtime configuration data including matching conditions and actions, where N is an integer greater than or equal to 2; traversing every two firewall rules in the first rule dataset, including treating each pair of traversed firewall rules as a rule pair, and performing the following redundancy optimization processing on the rule pair: obtaining the matching range of each firewall rule based on the number of communication paths matched by each firewall rule, where each communication path is determined by a source object and a destination object, the source object being uniquely determined by the source IP address and source port in the matching conditions, and the destination object being uniquely determined by the destination IP address and destination port in the matching conditions; and further optimizing the matching range based on the number of communication paths matched by each firewall rule. The size of the intersection of the matching ranges of the two firewall rules in the rule pair is obtained by counting the number of identical communication paths matched by the two firewall rules in the rule pair; the size of the union of the matching ranges of the rule pair is obtained by summing the sizes of the matching ranges of the two firewall rules in the rule pair and then subtracting the size of the intersection of the matching ranges of the rule pair; the ratio of the size of the intersection of the matching ranges of the rule pair to the size of the union of the matching ranges of the rule pair is calculated to obtain the overlap of the matching ranges of the rule pair; and when the overlap of the matching ranges of the rule pair is greater than or equal to a preset overlap threshold, the two firewall rules in the rule pair are processed for redundancy through a subsequent redundancy detection process; otherwise, the two firewall rules in the rule pair are determined to be non-redundant.

[0005] According to an embodiment of this application, obtaining the matching range of each firewall rule based on the number of communication paths matched by each firewall rule includes: calculating the source IP address range, source port range, destination IP address range, and destination port range of the firewall rule according to the matching conditions of each firewall rule; and multiplying the source IP address range, source port range, destination IP address range, and destination port range of the firewall rule to obtain the matching range of each firewall rule.

[0006] According to an embodiment of this application, obtaining the size of the intersection of the matching ranges of the rule pair based on the number of identical communication paths matched by the two firewall rules in the rule pair includes: calculating the intersection size of the source IP address range, the intersection size of the source port range, the intersection size of the destination IP address range, and the intersection size of the destination port range in the matching conditions of the two firewall rules in the rule pair; and multiplying the intersection size of the source IP address range, the intersection size of the source port range, the intersection size of the destination IP address range, and the intersection size of the destination port range to obtain the size of the intersection of the matching ranges.

[0007] According to an embodiment of this application, before obtaining the first rule dataset, the method further includes: obtaining a second rule dataset, the second rule dataset including the runtime configuration data and traffic characteristics of M firewall rules, wherein the traffic characteristics are obtained based on the historical hit data of each firewall rule, and M is an integer greater than N; processing the runtime configuration data and traffic characteristics of each firewall rule in the second rule dataset into a feature vector; clustering the M firewall rules in the second rule dataset based on the feature vector to obtain a preliminary clustering result; and subdividing each preliminary cluster in the preliminary clustering result layer by layer according to preset multi-level classification conditions to obtain at least one fine cluster; wherein the first rule dataset is taken from any one of the fine clusters.

[0008] According to an embodiment of this application, the step of subdividing each preliminary cluster in the preliminary clustering result into at least one refined cluster according to preset multi-level classification conditions includes: in the first-level division, subdividing the preliminary cluster into one or more first-level clusters according to protocol type and traffic direction; in the second-level division, subdividing the first-level cluster into one or more second-level clusters according to the destination port and the service type of the destination IP; and in the third-level division, subdividing the second-level cluster into one or more third-level clusters according to the network segment of the source IP address and the range of the source port; wherein the refined cluster is obtained based on the third-level cluster.

[0009] According to an embodiment of this application, the step of clustering the M firewall rules in the second rule dataset based on the feature vector to obtain preliminary clustering results includes: using the elbow rule to obtain the range of candidate cluster numbers; for each cluster number value within the range of candidate cluster numbers, calculating the average silhouette coefficient of the clusters obtained after clustering the M firewall rules according to the cluster number value; selecting the cluster number value with the largest average silhouette coefficient as the final cluster number value K; and clustering the M firewall rules according to the final cluster number value K to obtain the preliminary clustering results.

[0010] According to an embodiment of this application, the step of clustering the M firewall rules according to the final value K of the number of clusters to obtain the preliminary clustering result further includes: when there is an isolated firewall rule whose distance from the centroid of each cluster is greater than S times the average distance of each cluster, the isolated firewall rule is marked as an outlier and not assigned to any cluster, where S is greater than 1.

[0011] According to an embodiment of this application, when the overlap of the matching range of the rule pair is greater than or equal to a preset overlap threshold, the redundancy processing of the two firewall rules in the rule pair through a subsequent redundancy detection process includes: determining the redundancy type of the two firewall rules in the rule pair according to the redundancy rule precise determination conditions, and obtaining a redundancy type determination result; wherein the redundancy type is one of non-redundancy, full redundancy, and partial redundancy; and processing the two firewall rules in the rule pair by adopting the elimination strategy corresponding to the redundancy type in the redundancy type determination result, wherein different redundancy types correspond to different elimination strategies.

[0012] According to embodiments of this application, the precise determination conditions for redundancy rules include protocol type consistency determination, traffic direction consistency determination, action consistency determination, and matching range inclusion determination. The determination of the redundancy type of the two firewall rules in the rule pair based on the precise determination conditions includes: when any one of the protocol type consistency determination, traffic direction consistency determination, and action consistency determination is inconsistent, the two firewall rules in the rule pair are determined to be non-redundant; the elimination strategy corresponding to the non-redundant type is not to eliminate the rule. When the results of the protocol type consistency determination, traffic direction consistency determination, and action consistency determination are all consistent, the rule pair is processed through the matching range inclusion determination, specifically including: when the matching ranges of the two firewall rules in the rule pair contain and are included, the two firewall rules in the rule pair are determined to be completely redundant; the elimination strategy corresponding to the completely redundant type includes deleting the firewall rule whose matching range is included; and when the matching ranges of the two firewall rules in the rule pair intersect rather than contain and are included, the two firewall rules in the rule pair are determined to be partially redundant; the elimination strategy corresponding to the partially redundant type includes merging the two firewall rules in the rule pair.

[0013] According to an embodiment of this application, after traversing the first rule dataset, the method further includes: evaluating the redundancy optimization effect based on a comparative analysis of the first rule dataset and the third rule dataset; wherein the third rule dataset is a rule dataset obtained after redundancy optimization processing of the first rule dataset through the traversal method.

[0014] A second aspect of this application provides a firewall rule optimization apparatus. The apparatus includes: a first acquisition module, a traversal module, and a redundancy optimization module. The first acquisition module acquires a first rule dataset, which includes runtime configuration data for N firewall rules. The runtime configuration data includes matching conditions and actions, where N is an integer greater than or equal to 2. The traversal module traverses every two firewall rules in the first rule dataset. The redundancy optimization module treats every two firewall rules traversed by the traversal module as a rule pair and performs redundancy optimization processing on the rule pair.

[0015] The redundancy optimization module specifically includes: a matching range size determination submodule, a matching range intersection size determination submodule, a matching range union size determination submodule, an overlap calculation submodule, and a redundancy processing submodule. The matching range size determination submodule determines the matching range size of each firewall rule based on the number of communication paths matched by each firewall rule. Each communication path is determined by a source object and a destination object. The source object is uniquely determined by the source IP address and source port in the matching conditions, and the destination object is uniquely determined by the destination IP address and destination port in the matching conditions. The matching range refers to the range of communication paths matched by the firewall rule. The matching range intersection size determination submodule determines the size of the intersection of the matching ranges of the rule pair based on the number of identical communication paths matched by the two firewall rules in the rule pair. The matching range union size determination submodule sums the matching range sizes of the two firewall rules in the rule pair and then subtracts the size of the intersection of the matching ranges of the rule pair to obtain the size of the union of the matching ranges of the rule pair. The overlap calculation submodule is used to calculate the ratio of the size of the intersection of the matching ranges of the rule pair to the size of the size of the union of the matching ranges of the rule pair, thus obtaining the overlap of the matching ranges of the rule pair. The redundancy processing submodule is used to perform redundancy processing on the two firewall rules in the rule pair through a subsequent redundancy detection process when the overlap of the matching ranges of the rule pair is greater than or equal to a preset overlap threshold; otherwise, it determines that the two firewall rules in the rule pair are not redundant.

[0016] A third aspect of this application also provides an electronic device, including: one or more processors; and a memory for storing one or more computer programs. The one or more processors perform the steps of the method described above.

[0017] A fourth aspect of the present application provides a computer-readable storage medium having a computer program or instructions stored thereon, wherein the computer program or instructions, when executed by a processor, implement the steps of the above-described method.

[0018] A fifth aspect of this application also provides a computer program product, including a computer program or instructions, which, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0019] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0020] Figure 1 The illustration shows an application scenario diagram of a firewall rule optimization method, apparatus, device, media, and program product according to embodiments of this application;

[0021] Figure 2 The flowchart illustrating a method for optimizing firewall rules according to an embodiment of this application is shown schematically.

[0022] Figure 3 This illustration shows a schematic diagram of the subsequent redundancy detection process in a method according to an embodiment of this application;

[0023] Figure 4 A supplementary flowchart illustrating a method for optimizing firewall rules according to another embodiment of this application is shown schematically;

[0024] Figure 5 A flowchart illustrating a method for optimizing firewall rules according to another embodiment of this application is shown schematically;

[0025] Figure 6 Schematic illustration Figure 5 The system architecture of the firewall rule optimization method shown;

[0026] Figure 7 A block diagram of a firewall rule optimization apparatus according to an embodiment of this application is shown schematically;

[0027] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing a method for optimizing firewall rules according to embodiments of this application. Detailed Implementation

[0028] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0029] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0030] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0031] The following is an explanation or definition of some technical terms used in this article:

[0032] A firewall rule is a specific, executable instruction used to assess network traffic and determine what action to take (such as allowing or denying). It typically includes matching conditions and actions to be performed.

[0033] Matching conditions, specifically firewall matching conditions, refer to the set of features a firewall uses to filter network traffic. A data packet must simultaneously meet all the conditions defined in the firewall rules to be considered a successful match. Firewall matching conditions may include, but are not limited to: network layer and transport layer conditions, such as the basic 5-tuple source IP address (Internet Protocol address), destination IP address, protocol, source port, and destination port; application layer and context conditions, such as application / service, geographical location, domain name, traffic direction (outbound or inbound, time, packet header / parameters, etc.).

[0034] A communication path, a term defined in this document, refers to the path from a specific source object to a specific destination object. A communication path is determined or defined by the source object and the destination object at its two ends, where the source object is a network object uniquely identified by the source IP address and source port, and the destination object is a network object uniquely identified by the destination IP address and destination port.

[0035] Matching Scope: In this article, the matching scope specifically refers to the firewall's matching scope, which is the range of all communication paths that a firewall rule can match. Theoretically, the matching scope of a firewall rule can be determined by splitting and combining the source IP address range, source port range, destination IP address range, and destination port range in the matching conditions of the firewall rule. A source IP address and a source port, or a destination IP address and a destination port, can be combined to form a communication path matched by the firewall rule.

[0036] Firewall rule sets are the concrete manifestation of network security protection strategies and the core basis for firewalls to identify and block malicious traffic. Their quality and management level directly determine the overall network security protection capabilities and operational efficiency. How to conduct more precise, efficient, and effective management and optimization of firewall rule sets is a problem that must be solved in the process of improving network security protection capabilities and ensuring the stable operation of business systems.

[0037] In view of this, embodiments of this application provide a method, apparatus, device, medium, and program product for optimizing firewall rules. This method can quickly identify rule pairs that do not require redundant detection by traversing a rule dataset and analyzing the overlap of matching ranges between two firewall rules based on the traversal results. Only rule pairs with high overlap in their matching ranges are subjected to more refined redundant detection processing, reducing unnecessary computational overhead for redundant detection. This also solves the problems of extremely low efficiency in redundant rule detection and high false negative rates for complex redundant rules under large-scale rule sets. It should be noted that the firewall rule optimization method, apparatus, device, medium, and program product determined in embodiments of this application can be used in the fintech field, or in any field other than fintech; this application does not limit the application field.

[0038] Figure 1 The illustration shows an application scenario diagram of a firewall rule optimization method, apparatus, device, media, and program product according to embodiments of this application.

[0039] like Figure 1 As shown, application scenario 100 according to an embodiment of this application may include a first terminal device 101, a second terminal device 102, a rule base 103, a network 104, and a server 105. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the rule base 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables. For example, a user (e.g., an operations and maintenance personnel) can use the first terminal device 101 and the second terminal device 102 to interact with the server 105 and / or the rule base 103 through the network 104 to receive or send information, etc.

[0040] The first terminal device 101 and the second terminal device 102 can be electronic devices such as smartphones, wearable devices, personal computers, intelligent voice interaction devices, smart home appliances, smart vehicles, in-vehicle terminals, aircraft, unmanned vending terminals, and extended reality devices. Among them, extended reality devices can include virtual reality devices, augmented reality devices, and mixed reality devices.

[0041] Server 105 can be a server providing various services. Server 105 can analyze and process user requests (such as requests to optimize firewall rules within a specified range) sent by the first terminal device 101 or the second terminal device 102, and feed the processing results back to the first terminal device 101 or the second terminal device 102. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services such as cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and big data. The server can be a backend server for the aforementioned target application, providing backend services to the client of the target application.

[0042] Rule base 103 is a professional storage system for storing and managing firewall rules, possessing management capabilities such as adding, deleting, modifying, querying, backing up, and restoring data. In this application scenario, rule base 103 can be connected to server 105 via a communication link. Server 105 can retrieve the required firewall rules from rule base 103 for processing based on requests from the first terminal device 101 and the second terminal device 102. It can also synchronously store new data generated by the operations of the first terminal device 101 and the second terminal device 102 into rule base 103, thereby achieving data persistence and efficient retrieval.

[0043] It should be noted that the firewall rule optimization method provided in this application embodiment can be implemented by server 105. Correspondingly, the firewall rule optimization apparatus, device, media, and program product provided in this application embodiment can also be configured in server 105. It should be understood that... Figure 1 The number of terminal devices, networks, databases, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, databases, and servers can be included.

[0044] The following combination Figure 1 Application scenarios, through Figures 2-6 The method for optimizing firewall rules according to embodiments of this application will be described in detail.

[0045] Figure 2 A flowchart illustrating a method for optimizing firewall rules according to an embodiment of this application is shown schematically. Figure 2 As shown, the firewall rule optimization method of this embodiment may include steps S210 to S2110.

[0046] In step S210, a first rule dataset is obtained. The first rule dataset includes the running configuration data of N firewall rules. The running configuration data includes matching conditions and actions, where N is an integer greater than or equal to 2.

[0047] In step S220, every two firewall rules in the first rule dataset are traversed, and each pair of traversed firewall rules is treated as a rule pair.

[0048] Next, for each pair of rules, perform the redundancy optimization process in steps S230 to S290.

[0049] In step S230, the matching range of each firewall rule is obtained based on the number of communication paths matched by each firewall rule. Each communication path is determined by a source object and a destination object. The source object is uniquely determined by the source IP address and source port in the matching conditions, and the destination object is uniquely determined by the destination IP address and destination port in the matching conditions.

[0050] Specifically, the matching range of a firewall rule is the number of communication paths it matches. Each communication path is determined by four parameters: source IP address, source port, destination IP address, and destination port. Considering that the possible values ​​for these four parameters for each communication path within the matching range of a firewall rule all originate from the matching conditions of that firewall rule, in one embodiment, the calculation process for the matching range of a firewall rule can be modeled as a permutation and combination problem. Specifically, the calculation may include: calculating the range of source IP addresses, source ports, destination IP addresses, and destination ports for each firewall rule based on its matching conditions; and then multiplying these ranges together to obtain the matching range for each firewall rule. This simplifies the calculation of the matching range to a permutation and combination problem, allowing for a rapid determination of the matching range of a firewall rule.

[0051] In step S240, the size of the intersection of the matching ranges of the rule pair is obtained based on the number of identical communication paths in the communication paths matched by the two firewall rules in the rule pair.

[0052] Similarly, the calculation of the size of the intersection of matching ranges can be modeled as a mathematical problem of permutations and combinations. In this model, communication paths that are matched by both firewall rules have the same source and destination objects; the same source objects have the same source IP address and the same source port; and the same destination objects have the same destination IP address and the same destination port. Thus, for each communication path matched by both firewall rules, the possible values ​​for the source IP address are derived from the intersection of the source IP address ranges in the matching conditions of the two firewall rules; the possible values ​​for the source port are derived from the intersection of the source ports in the matching conditions of the two firewall rules; the possible values ​​for the destination IP address are derived from the intersection of the destination IP address ranges in the matching conditions of the two firewall rules; and the possible values ​​for the destination port are derived from the intersection of the destination ports in the matching conditions of the two firewall rules. Based on this, in one embodiment, the calculation process for the size of the intersection of the matching ranges of two firewall rules may include: calculating the intersection size of the source IP address range, the source port range, the destination IP address range, and the destination port range in the matching conditions of the two firewall rules in the rule pair; and multiplying the intersection size of the source IP address range, the source port range, the destination IP address range, and the destination port range to obtain the size of the intersection of the matching ranges. By simplifying the size of the intersection of the matching ranges into a permutation and combination problem, the size of the intersection of the matching ranges of the two firewall rules in the rule pair can be calculated quickly.

[0053] In step S250, the sizes of the matching ranges of the two firewall rules in the rule pair are summed, and then the size of the intersection of the matching ranges of the rule pair is subtracted to obtain the size of the union of the matching ranges of the rule pair. This union of matching ranges is the sum of the number of non-repeating communication paths matched by the two firewall rules in the rule pair.

[0054] In step S260, the ratio of the size of the intersection of the matching ranges of the rule pairs to the size of the size of the union of the matching ranges of the rule pairs is calculated to obtain the overlap of the matching ranges of the rule pairs.

[0055] In step S270, it is determined whether the overlap of the matching range of the rule pair is greater than or equal to a preset overlap threshold. If yes, then step S280 is executed; otherwise, step S290 is executed.

[0056] In step S280, when the overlap of the matching range of the rule pair is greater than or equal to the preset overlap threshold, the two firewall rules in the rule pair are subjected to redundancy processing through the subsequent redundancy detection process, and the result of the redundancy processing is output to the third rule dataset.

[0057] In step S290, when the overlap of the matching range of the rule pair is less than a preset overlap threshold, it is determined that the two firewall rules in the rule pair are not redundant.

[0058] Next, in step S2100, it is determined whether all rules in the first rule dataset have been traversed. If yes, step S2110 is executed; otherwise, step S220 is returned.

[0059] It should be noted that the embodiments of this application do not limit the different rule pairs to be executed sequentially. Specifically, step S220 can traverse one rule pair at a time, or it can traverse multiple rule pairs in parallel, thereby performing the redundancy optimization processing of steps S230 to S290 in parallel on multiple rule pairs.

[0060] In step S2110, after traversing the first rule dataset, the traversal is completed, and the third rule dataset is output.

[0061] This embodiment assesses the probability of redundancy for each pair of firewall rules in the first rule dataset based on the overlap of their matching ranges. If the overlap is higher than a preset threshold (e.g., 80%), it means that more than 80% of the communication paths they match overlap, and in this case, further redundancy detection is considered. If the overlap is lower than the preset threshold, it indicates that the overlap of their matching communication paths is low, and the protected communication paths differ significantly, so no redundancy detection analysis is needed. This quickly identifies rule pairs that do not require redundancy detection based on the overlap of their matching ranges, reducing the computational load of subsequent detailed redundancy detection and thus minimizing unnecessary computational costs. Furthermore, by traversing and filtering based on the overlap of matching ranges, the comprehensive screening of potentially redundant rule pairs in the first rule dataset can be improved, avoiding missed detections.

[0062] In one embodiment, after step S2110, the redundancy optimization effect can be evaluated based on a comparative analysis of the first rule dataset and the third rule dataset. The redundancy optimization quality is analyzed and evaluated, forming a closed loop for firewall rule optimization.

[0063] In one embodiment, the subsequent redundancy detection process in step S280 above can be as follows: Figure 3 As shown, it includes steps S301 and S302.

[0064] In step S301, the redundancy type of the two firewall rules in the rule pair is determined according to the redundancy rule precise determination condition, and the redundancy type determination result is obtained; wherein the redundancy type is one of non-redundancy, full redundancy, and partial redundancy.

[0065] In step S302, the two firewall rules in the rule pair are processed using the elimination strategy corresponding to the redundancy type in the redundancy type determination result, wherein different redundancy types correspond to different elimination strategies.

[0066] In the subsequent redundancy detection process, the embodiments of this application first distinguish the redundancy type, and then select a targeted elimination strategy to achieve refined redundancy elimination.

[0067] In one embodiment, the precise determination criteria for redundant rules may include protocol type consistency determination, traffic direction consistency determination, action consistency determination, and matching range inclusion determination. Accordingly, in step S301, when any one of the protocol type consistency determination, traffic direction consistency determination, and action consistency determination is inconsistent, the two firewall rules in the rule pair are determined to be non-redundant. When the results of the protocol type consistency determination, traffic direction consistency determination, and action consistency determination are all consistent, complete redundancy and partial redundancy can be distinguished by the matching range inclusion. Accordingly, the elimination strategy for the non-redundant type is to directly output to the third rule dataset without performing rule elimination. The elimination strategy for the complete redundancy type may be to delete the firewall rules whose matching range is included in the rule pair. The elimination strategy for the partial redundancy type may include, but is not limited to, merging the two firewall rules in the rule pair.

[0068] In this way, in the subsequent redundancy detection process, the two situations of no redundancy or redundancy are accurately identified by the consistency of protocol type, traffic direction, and action. Then, if redundancy is indeed present, the matching range is used to determine whether it is completely redundant or partially redundant, and targeted processing is carried out. This provides detailed processing measures and improves the targeting and automation of redundancy elimination.

[0069] The first rule dataset in step S210 above can be a rule dataset within a range specified by the user through the first terminal device 101 and the second terminal device 102, or it can be a fine-grained clustering of the rule dataset within the specified range after clustering processing. For example, in one embodiment, the following can be performed before step S210 above: Figure 4 The supplementary process shown is for clustering and subdividing the original large-scale rule dataset before applying... Figure 2 The process shown improves the optimization efficiency of large-scale rule datasets and reduces the rate of redundant missed detections.

[0070] Figure 4 A supplementary flowchart illustrating a method for optimizing firewall rules according to another embodiment of this application is shown schematically. Figure 4 As shown, combined with Figure 2The firewall rule optimization method of this embodiment may include steps S410 to S440 before step S210.

[0071] In step S410, a second rule dataset is obtained, which includes the running configuration data and traffic characteristics of M firewall rules, where M is an integer greater than N.

[0072] Traffic characteristics are obtained based on the historical hit data of each firewall rule, including but not limited to: number of hits, average hit interval, average packet size, etc.

[0073] In step S420, the runtime configuration data and traffic characteristics of each firewall rule in the second rule dataset are processed into feature vectors.

[0074] In step S430, the M firewall rules in the second rule dataset are clustered based on the feature vectors to obtain preliminary clustering results.

[0075] In step S440, each preliminary cluster in the preliminary clustering result is subdivided layer by layer according to preset multi-level classification conditions to obtain at least one refined cluster. The first rule dataset is taken from any one of these refined clusters. The multi-level classification conditions may include, but are not limited to, division according to various parameters in the matching conditions (such as protocol type, traffic direction, IP address network segment, and source port range), or division according to service type (such as database service, web service), etc., where the multi-level classification conditions can be various combinations of multiple classification parameters.

[0076] This embodiment can perform preliminary clustering on a large number of firewall rules in the second rule dataset based on feature vectors obtained from processing runtime configuration data and traffic characteristics. The firewall rules in the resulting preliminary clusters have high similarity. Furthermore, considering that rule similarity is only a vague premise that rules may be redundant, the preliminary clusters are further subdivided through multi-level classification conditions after clustering. Then, the overlap of matching ranges is analyzed and filtered within the subdivided fine clusters. By subdividing multiple times, the range of potentially redundant rules can be gradually narrowed, thereby reducing the amount of invalid computation in filtering based on the overlap of matching ranges and improving the efficiency and accuracy of filtering potentially redundant rule pairs. This embodiment of the application, by aggregating similar rules into clusters and then subdividing them according to classification conditions, can largely solve the problems of extremely low efficiency in detecting redundant rules and high false negative rates for complex redundancies under large-scale rule sets, reducing the time complexity of redundancy detection from O(M²) to O(Σmi²), and achieving efficient simplification of large-scale rule sets.

[0077] Figure 5A flowchart illustrating a method for optimizing firewall rules according to another embodiment of this application is shown schematically. Figure 6 Schematic illustration Figure 5 The system architecture of the firewall rule optimization method shown.

[0078] like Figure 5 As shown, the firewall rule optimization method in this embodiment may include steps S1 to S5. Combined with... Figure 6 The system architecture, for Figure 5 The method is described in detail below.

[0079] Step S1: Firewall rule data collection and preprocessing. Specifically, the firewall rule data (including runtime configuration data and traffic characteristics) can be collected by the rule dataset collection module 601, and then the firewall rule data can be processed into feature vectors by the feature engineering preprocessing module 602. The specific process may include (1.1) to (1.4).

[0080] (1.1) Data Acquisition. This is performed by the rule dataset acquisition module 601. The firewall rule data collected by the rule dataset acquisition module 601 can be aggregated to form the second rule dataset described above.

[0081] The firewall's current running configuration is read using the Secure Shell (SSH) protocol provided by the firewall device. All firewall rules are extracted, and traffic log data from the firewall over a period of time (e.g., one year) is read to analyze traffic characteristics such as the number of hits, total bytes, number of sessions, number of source IPs, and number of destination IPs for each rule.

[0082] (1.2) Structured feature extraction of runtime configuration data. The runtime configuration data for each rule is parsed to extract the following core fields:

[0083] Protocol types include, but are not limited to, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), and any protocol type (ANY).

[0084] The source IP address range includes, but is not limited to, the start IP and the end IP (supports CIDR format and single IP), where CIDR is an abbreviation for Unclassified Domain Interception Routing.

[0085] Source port range, including start port and end port (supports single port and port range);

[0086] The destination IP address range, including the starting IP and the ending IP;

[0087] Destination port range, including the start port and the end port;

[0088] Traffic direction, including but not limited to inbound, outbound, and bidirectional;

[0089] Rule-based actions include, but are not limited to, allowing, denying, and issuing alarms;

[0090] Threat levels, including but not limited to low, medium, high, and urgent (obtained from rule bases or threat intelligence systems).

[0091] The extracted fields are vectorized. For example, a 12-dimensional standard feature vector V=[v1,v2,v3,v4,v5,v6,v7,v8,v9,v10,v11,v12] is constructed as follows. Wherein: v1-v3: Protocol type one-hot encoding (TCP: [1,0,0], UDP: [0,1,0], ICMP: [0,0,1], ANY: [1,1,1]); v4: Source IP start address (32-bit unsigned integer); v5: Source IP end address (32-bit unsigned integer); v6: Source port start value (16-bit integer); v7: Source port end value (16-bit integer); v8: Destination IP start address (32-bit unsigned integer); v9: Destination IP end address (32-bit unsigned integer); v10: Destination port start value (16-bit integer); v11: Destination port end value (16-bit integer); v12: Traffic direction (Inbound: 0, Outbound: 1, Bidirectional: 2); v13: Rule action (Allow: 0, Deny: 1, Alarm: 2); v14: Threat level (Low: 0, Medium: 1, High: 2, Urgent: 3).

[0092] (1.3) Feature numerical conversion. Details may include:

[0093] IP address translation, such as converting a dotted decimal IP address to a 32-bit unsigned integer;

[0094] Range feature processing, such as converting a CIDR-formatted IP address range into a start IP and an end IP;

[0095] Normalization is performed, for example, by scaling all feature values ​​to the [0,1] interval using the min-max normalization method.

[0096] (1.4) Extract traffic features and organize them into corresponding traffic feature vectors (e.g., normalization).

[0097] The following traffic characteristics are analyzed for each firewall rule from the traffic logs:

[0098] Number of hits, such as the total number of packets matched by this firewall rule in the past year;

[0099] Average hit interval, such as the average time (in seconds) between two consecutive hits.

[0100] The number of source IP addresses, i.e., the number of different source IP addresses that match this firewall rule;

[0101] Number of destination IP addresses, i.e., the number of different destination IP addresses that match this firewall rule;

[0102] Average packet size is the average number of bytes in a packet that matches this firewall rule.

[0103] The above (1.2) to (1.4) are executed by the feature engineering preprocessing module 602.

[0104] Step S2: Clustering the collected firewall rule data is performed by the clustering engine module 603. The clustering engine module 603 can cluster the second rule dataset obtained and preprocessed in step S1 based on the feature vector of each firewall rule.

[0105] In one embodiment, the K-Means++ algorithm can be used for clustering, and step S2 can include the following (2.1) to (2.4). The K-Means++ algorithm divides the firewall rule set into K clusters such that the sum of the squared distances from each firewall rule in a cluster to the centroid of that cluster is minimized. The first centroid is randomly selected, and the probability of selecting subsequent centroids is proportional to the squared distance from the firewall rule to the nearest selected centroid, thereby significantly improving the stability and accuracy of clustering and reducing local optima.

[0106] (2.1) Determination of the optimal number of clusters K.

[0107] For example, the optimal number of clusters K can be determined by combining the elbow rule with the profile coefficient method, thereby improving the clustering effect.

[0108] The elbow rule is an intuitive method for determining the optimal number of clusters (K) in the K-Means algorithm for cluster analysis. Its core idea is to observe the changes in the sum of squared errors (SSE) of the model under different K values, find the "inflection point" (resembling the bend of an elbow) where the rate of SSE decreases suddenly slows down, and thus optimize the number of clusters.

[0109] The silhouette coefficient method is an unsupervised learning metric used to evaluate clustering performance, measuring the compactness of samples within their clusters and their separation from other clusters. Unlike the elbow rule, it not only determines the optimal number of clusters K but also evaluates the reasonableness of the clustering results.

[0110] The process of determining the optimal number of clusters K using a combination of the elbow rule and the silhouette coefficient method can include the following steps: First, the elbow rule is used to obtain the range of candidate cluster numbers. Then, for each cluster number within the range of candidate cluster numbers, the average silhouette coefficient of the resulting clusters after clustering the firewall rules in the second firewall rule dataset according to the cluster number is calculated. Finally, the cluster number with the largest average silhouette coefficient is selected as the final cluster number (i.e., the optimal number of clusters). For example, different values ​​of the cluster number K from 2 to 20 can be tried. For each cluster number value, the K-Means++ algorithm is run 10 times, the within-cluster sum of squares (WCSS) is calculated, and the K-WCSS curve is plotted. The "elbow" point of the curve is found to obtain the range of candidate cluster numbers. For each cluster number within the range of candidate cluster numbers, the average silhouette coefficient is calculated, and the K value with the largest average silhouette coefficient is selected as the final number of clusters. The selected final number of clusters K can avoid the problem of local optima in traditional K-Means and improve the reliability of clustering.

[0111] (2.2) Next, the initial centroid is selected using the K-Means++ algorithm.

[0112] The K-Means++ algorithm is used to select initial centroids, ensuring that the distances between initial centroids are as far as possible. First, one firewall rule is randomly selected from the second firewall rule dataset as the first initial centroid. Then, the shortest distance from each of the remaining firewall rules to all selected centroids is calculated. Following the idea of ​​the K-Means++ algorithm, K initial centroids are selected. For example, weighted Manhattan distance can be used as the distance metric between firewall rules.

[0113] (2.3) K-Means iterative process.

[0114] The standard K-Means iterative process is executed: each firewall rule is assigned to the cluster containing the nearest centroid. After one round of assignment, the centroid of each cluster is recalculated; the centroid is the average of the feature vectors of all rules within the cluster. Then, the next round of clustering is performed. Multiple rounds of iteration are conducted until the clustering results converge to a consistent value, or the number of iterations exceeds a threshold. After the iteration terminates, the preliminary clustering results are output.

[0115] (2.4) Post-processing of clustering results.

[0116] Based on the preliminary clustering results, the silhouette coefficient of each cluster is calculated to evaluate the clustering quality. Furthermore, firewall rules whose distance from the centroid of each cluster is greater than twice the average distance of that cluster can be marked as outliers. For outliers, a separate "special rule" cluster is created for management. Outliers are isolated firewall rules and have no possibility of redundancy with other firewall rules; therefore, they are not classified into clusters, thus eliminating the need for matching range overlap analysis and redundancy detection.

[0117] Step S3: Multi-level classification and management after clustering, executed by the rule-based hierarchical grouping module 604.

[0118] Specifically, considering that the similarity of each cluster after clustering is merely an ambiguous premise that firewall rules may be redundant, this embodiment further subdivides the initial cluster results through multi-level classification conditions after clustering, thereby further narrowing the scope of potentially redundant firewall rules. In this embodiment, the multi-level classification may include the three-level classification shown in (3.1) to (3.3) below.

[0119] (3.1) First-level classification (coarse classification): The preliminary clusters can be divided into one or more first-level clusters according to protocol type and traffic direction. For example, they can be divided into TCP, UDP, ICMP, or other protocol rule clusters according to protocol type. Further classification can also be performed according to traffic direction, either inbound or outbound. For example, the final classification could include TCP inbound rule clusters, TCP outbound rule clusters, UDP inbound rule clusters, UDP outbound rule clusters, ICMP inbound rule clusters, ICMP outbound rule clusters, other protocol inbound rule clusters, and other protocol outbound rule clusters, etc.

[0120] (3.2) Secondary Classification (Business Classification): Each primary cluster can be subdivided into one or more secondary clusters according to the business type of the destination port and destination IP. Each secondary cluster belongs to a specific business rule group. For example, the TCP inbound cluster can be further subdivided into business groups such as web services, database services, and remote management. Similarly, the TCP outbound cluster can be further subdivided into business groups such as HTTP access, HTTPS access, and email services. And the UDP cluster can be further subdivided into business groups such as Domain Name System (DNS) services and Network Time Protocol (NTP) services.

[0121] (3.3) Three-level division (further refined classification): For example, each secondary cluster can be subdivided into one or more tertiary clusters according to the network segment and source port range of the source IP address. Each tertiary cluster is a specific access control rule group. For example, it can be divided according to the source IP network segment to distinguish between internal IP and external IP. Another example is to divide according to the source port range to distinguish between client ports and server ports.

[0122] After the three-level subdivision (3.1) to (3.3), since the clusters themselves are obtained by clustering, the similarity of rules in each three-level cluster is guaranteed. Furthermore, by considering the protocol type, traffic direction, service type, IP address network segment and source port range, the category of key parameters in the matching conditions of firewall rules in each three-level cluster is ensured to be consistent. This further narrows the scope of judgment of potentially redundant firewall rules, making the scope of judgment of potential redundancy of firewalls gradually more accurate.

[0123] After the three-level subdivision described in (3.1) to (3.3) above, human-understandable descriptive information can be automatically generated for each three-level cluster. For example, the feature vector of the cluster centroid is extracted, and for each feature domain, the typical value range of the cluster is determined. Combined with the business knowledge base, the large model is instructed to generate standardized names for each three-level cluster for easy management.

[0124] Step S4: Based on the overlap of matching ranges, redundant rules are filtered and accurately determined and eliminated, which is executed by the redundancy optimization module 630.

[0125] Specifically, redundant rule pairs are filtered and processed for each third-level cluster (i.e., the first rule dataset mentioned above), which may include the following (4.1) to (4.5).

[0126] (4.1) Calculate the matching range of each firewall rule.

[0127] For example, the matching range size for each firewall = source IP address range size × source port range size × destination IP address range size × destination port range size. Where: IP address range size = end IP address integer - start IP address integer + 1, port range size = end port - start port + 1.

[0128] (4.2) Calculation of the overlap of matching ranges of every two firewall rules in each third-level cluster.

[0129] For each pair of rules (such as Ri and Rj) in each third-level cluster, their matching range overlap can be calculated as follows:

[0130] The overlap of matching ranges (Ri, Rj) = the size of the intersection of matching ranges / the size of the union of matching ranges;

[0131] in:

[0132] The size of the intersection of matching ranges = the size of the intersection of source IP address ranges × the size of the intersection of source port ranges × the size of the intersection of destination IP ranges × the size of the intersection of destination port ranges.

[0133] The size of the union of matching ranges = the size of the matching range of Ri + the size of the matching range of Rj - the size of the intersection of their matching ranges.

[0134] The size of the intersection of IP address ranges is equal to the larger of 0 and min(Ri.end_ip,Rj.end_ip)-max(Ri.start_ip,Rj.start_ip)+1).

[0135] The size of the intersection of the port ranges is equal to the larger of 0 and min(Ri.end_port,Rj.end_port)-max(Ri.start_port, Rj.start_port)+1).

[0136] (4.3) Redundancy rule precise determination.

[0137] An overlap threshold of 0.8 is set. For rule pairs whose matching range overlap exceeds this threshold, a precise redundancy type determination is performed using the redundancy rule precise determination condition. For example, the following determination steps are executed: check if the protocol types are the same; if they are different, there is no redundancy; check if the traffic directions are the same; if they are different, there is no redundancy; and check if the actions in the rules are the same; if they are different, there is no redundancy. Next, for rule pairs (Ri and Rj) with the same protocol type, the same traffic direction, and the same action, check if the matching range of Ri completely contains the matching range of Rj: if so, Rj is a completely redundant rule; if the matching range of Rj completely contains the matching range of Ri, then Ri is a completely redundant rule; if the matching range of Ri and the matching range containing Rj only partially overlap, rather than having an inclusion relationship, then it is partially redundant or cross-redundant.

[0138] (4.4) Redundancy elimination.

[0139] Different redundancy types employ different elimination strategies. For example, for complete redundancy, the completely redundant rules are deleted. For partial redundancy, one approach is to merge two firewall rules; another is to split the rule pair into three rules based on the matching scope of the two rules: a part belonging only to Ri, a part belonging only to Rj, and an overlapping part, while simultaneously deleting the original rule pair.

[0140] (4.5) Preliminary security verification.

[0141] Perform preliminary security verification on the rule set after redundancy elimination. For example, generate a test traffic set covering all original rule matching ranges. Process the test traffic using both the original and optimized rule sets, and compare the results. If discrepancies exist, mark them as potential issues. For potential issues, generate alerts to prompt administrators for manual review.

[0142] Step S5: Security verification and optimization rule set output, executed by the security verification and output module 606 and the firewall rule execution engine module 607. Specifically, it may include the following (5.1) to (5.4).

[0143] (5.1) Comprehensive security verification. The following security verification steps can be performed:

[0144] Simulate traffic tests, such as generating a comprehensive test set containing normal traffic and attack traffic, to verify that the optimized rule set can correctly block attack traffic and allow normal traffic;

[0145] Logical consistency checks, such as checking whether the optimized rule set has logical contradictions and security risks;

[0146] Performance testing, such as testing the matching speed of the optimized rule set, ensures that the performance improvement meets expectations;

[0147] Rollback testing, such as verifying the effectiveness of the rollback mechanism, ensures that the system can quickly revert to the original rule set in the event of a problem;

[0148] (5.2) Optimization Report Generation. Detailed optimization analysis reports can be generated, which may include, for example, the following:

[0149] Comparison of rule sets before and after optimization, such as changes in the number of rules, simplification rate, and average matching time;

[0150] Redundancy rule analysis, such as analyzing the number of redundant rules, their type distribution, and the business systems involved;

[0151] Priority adjustment analysis, such as analyzing the number of rules to be adjusted and the changes in position before and after the adjustment;

[0152] Security verification results include, but are not limited to, test traffic pass rate, attack interception rate, false positive rate, and false negative rate;

[0153] Risk assessment, such as assessing potential risks and countermeasures during the optimization process.

[0154] (5.3) Canary release and rollback mechanism. An optimized rule set can be deployed using a canary release strategy, including:

[0155] First, deploy the optimized rule set in the test environment and run it for 24 hours for verification. Then, deploy it on non-core firewall devices in the production environment and run it for a period of time (e.g., 7 days) for verification. Finally, deploy it on all firewall devices.

[0156] Establish a one-click rollback mechanism, such as saving a complete backup of the original rule set, so that if a problem is found, it can be restored to the original state in a short time (such as within 1 minute).

[0157] The above (5.1) to (5.3) can be executed by the security verification and output module 606.

[0158] (5.4) The final rule set output can be executed by the firewall rule execution engine module 607. The firewall rule execution engine module 607 can convert the final optimized rule set that has been verified by security into a configuration format supported by the firewall device, and push it to the firewall device through API interface or configuration file to update the firewall rule execution engine and make the optimized rule set effective.

[0159] As can be seen, this embodiment can optimize firewall rule sets based on the K-Means++ algorithm, and constructs a multi-dimensional rule and traffic fusion feature engineering, a K-Means++ adaptive clustering mechanism, a cluster-driven multi-level classification, a redundancy detection and elimination model based on matching range overlap, and a multi-security verification closed-loop mechanism, effectively improving the management and optimization of firewall rule sets. This embodiment has outstanding technical advancement and engineering practicality, and its specific beneficial effects can include the following: 1) Based on K-Means++ adaptive clustering optimization, it solves the problems of traditional K-Means being prone to local optima and unstable clustering results, improving the accuracy and reliability of rule clustering. 2) It constructs a multi-dimensional fusion feature and weighted distance measurement system, solving the defects of traditional technical features being single and inaccurate similarity matching, and realizing refined quantitative representation of rules. 3) It adopts a cluster-driven multi-level classification and a redundancy detection and elimination model based on matching range overlap, solving the problems of low efficiency and high false negative rate of traditional full-domain comparison, and realizing efficient simplification of large-scale rule sets. 4) Integrating incremental clustering with multiple security verification loops solves the shortcomings of traditional static optimization, such as poor adaptability, high security risks, and lack of iterative capabilities, ensuring the long-term stable operation of the rule set.

[0160] Based on the firewall rule optimization methods described in the above embodiments, embodiments of this application also provide a firewall rule optimization apparatus. The following will be combined with... Figure 7 The device is described in detail.

[0161] Figure 7 A block diagram of a firewall rule optimization apparatus 700 according to an embodiment of this application is shown schematically. Figure 7 As shown, the device 700 may include a first acquisition module 610, a traversal module 620, and a redundancy optimization module 630.

[0162] The first acquisition module 610 is used to acquire a first rule dataset, which includes runtime configuration data for N firewall rules. The runtime configuration data includes matching conditions and actions, where N is an integer greater than or equal to 2. In one embodiment, the first acquisition module 610 can execute step S210 as described above.

[0163] The traversal module 620 is used to traverse every two firewall rules in the first rule dataset. In one embodiment, the traversal module 620 may perform step S220 as described above.

[0164] The redundancy optimization module 630 is used to treat every two firewall rules traversed by the traversal module as a rule pair and perform redundancy optimization processing on the rule pair.

[0165] The redundancy optimization module 630 specifically includes: a matching range size determination submodule 631, a matching range intersection size determination submodule 632, a matching range union size determination submodule 633, an overlap calculation submodule 634, and a redundancy processing submodule 635.

[0166] The matching range determination submodule 631 is used to determine the matching range of each firewall rule based on the number of communication paths matched by each firewall rule. Each communication path is determined by a source object and a destination object. The source object is uniquely determined by the source IP address and source port in the matching conditions, and the destination object is uniquely determined by the destination IP address and destination port in the matching conditions. The matching range refers to the range of communication paths matched by the firewall rule. In one embodiment, the matching range determination submodule 631 can execute step S230 as described above.

[0167] The matching range intersection size determination submodule 632 is used to determine the size of the matching range intersection of the rule pair based on the number of identical communication paths in the communication paths matched by the two firewall rules in the rule pair. In one embodiment, the matching range intersection size determination submodule 632 can perform step S240 as described above.

[0168] The submodule 633 for determining the union size of the matching ranges is used to sum the sizes of the matching ranges of the two firewall rules in the rule pair, and then subtract the size of the intersection of the matching ranges of the rule pair to obtain the size of the union of the matching ranges of the rule pair. In one embodiment, the submodule 633 for determining the union size of the matching ranges can perform step S250 as described above.

[0169] The overlap calculation submodule 634 is used to calculate the ratio of the size of the intersection of the matching ranges of the rule pairs to the size of the size of the union of the matching ranges of the rule pairs, thereby obtaining the overlap of the matching ranges of the rule pairs. In one embodiment, the overlap calculation submodule 634 may perform step S260 as described above.

[0170] The redundancy processing submodule 635 is used to perform redundancy processing on the two firewall rules in the rule pair through a subsequent redundancy detection process when the overlap of the matching range of the rule pair is greater than or equal to a preset overlap threshold; otherwise, it determines that the two firewall rules in the rule pair are not redundant. In one embodiment, the redundancy processing submodule 635 can execute steps S270 to S290 described above.

[0171] As an optional embodiment, the device 700 may further include a rule dataset acquisition module 601, a feature engineering preprocessing module 602, a clustering engine module 603, and a rule hierarchical grouping module 604.

[0172] The rule dataset acquisition module 601 is used to acquire a second rule dataset, which includes the runtime configuration data and traffic characteristics of M firewall rules. The traffic characteristics are obtained based on the historical hit data of each firewall rule, where M is an integer greater than N. In one embodiment, the rule dataset acquisition module 601 can execute step S410 as described above.

[0173] The feature engineering preprocessing module 602 is used to process the runtime configuration data and traffic characteristics of each firewall rule in the second rule dataset into feature vectors. In one embodiment, the feature engineering preprocessing module 602 may perform step S420 as described above.

[0174] The clustering engine module 603 is used to cluster the M firewall rules in the second rule dataset based on the feature vectors to obtain preliminary clustering results. In one embodiment, the clustering engine module 603 can perform step S430 as described above.

[0175] The rule hierarchical grouping module 604 is used to subdivide each preliminary cluster in the preliminary clustering result layer by layer according to preset multi-level classification conditions to obtain at least one refined cluster, wherein the first rule dataset is taken from any one of the refined clusters. In one embodiment, the rule hierarchical grouping module 604 can perform step S440 described above.

[0176] The device 700 can perform reference Figures 2-5 The optimization methods for firewall rules introduced are described in detail above and will not be repeated here.

[0177] According to embodiments of this application, any and multiple modules among the first acquisition module 610, traversal module 620, redundancy optimization module 630, rule dataset acquisition module 601, feature engineering preprocessing module 602, clustering engine module 603, rule hierarchical grouping module 604, security verification and output module 606, and firewall rule execution engine module 607 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the first acquisition module 610, traversal module 620, redundancy optimization module 630, rule dataset acquisition module 601, feature engineering preprocessing module 602, clustering engine module 603, rule hierarchical grouping module 604, security verification and output module 606, and firewall rule execution engine module 607 can be at least partially implemented as hardware circuits, such as field-programmable gate arrays, programmable logic arrays, systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits, or any other reasonable means of integrating or packaging circuits, or implemented in software, hardware, or firmware, or in any one of the three implementation methods or any appropriate combination of several of them. Alternatively, at least one of the following modules can be implemented, at least partially, as a computer program module: first acquisition module 610, traversal module 620, redundancy optimization module 630, rule dataset acquisition module 601, feature engineering preprocessing module 602, clustering engine module 603, rule hierarchical grouping module 604, security verification and output module 606, and firewall rule execution engine module 607. When the computer program module is run, it can perform the corresponding function.

[0178] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing a method for optimizing firewall rules according to embodiments of this application.

[0179] like Figure 8As shown, an electronic device 1200 according to an embodiment of this application includes a processor 1201, which can perform various appropriate actions and processes according to a program stored in a read-only memory 1202 or a program loaded from a storage portion 1208 into a random access memory 1203. The processor 1201 may include, for example, a general-purpose microprocessor, an instruction set processor and / or an associated chipset and / or a dedicated microprocessor. The processor 1201 may also include onboard memory for caching purposes. The processor 1201 may include a single processing unit or multiple processing units for executing different steps of the method flow according to an embodiment of this application.

[0180] Random access memory 1203 stores various programs and data required for the operation of electronic device 1200. Processor 1201, read-only memory 1202, and random access memory 1203 are interconnected via bus 1204. Processor 1201 executes various steps of the method flow according to embodiments of this application by executing programs in read-only memory 1202 and / or random access memory 1203. It should be noted that the programs may also be stored in one or more memories other than read-only memory 1202 and random access memory 1203. Processor 1201 may also execute various steps of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0181] According to embodiments of this application, the electronic device 1200 may further include an input / output interface 1205, which is also connected to the bus 1204. The electronic device 1200 may also include one or more of the following components connected to the input / output interface 1205: an input section 1206 including a keyboard, mouse, etc.; an output section 1207 including a cathode ray tube, liquid crystal display, etc., and a speaker, etc.; a storage section 1208 including a hard disk, etc.; and a communication section 1209 including a network interface card, such as a local area network card, modem, etc. The communication section 1209 performs communication processing via a network such as the Internet. A drive 1210 is also connected to the input / output interface 1205 as needed. A removable medium 1211, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1210 as needed so that computer programs read from it can be installed into the storage section 1208 as needed.

[0182] Embodiments of this application also provide a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0183] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof. In embodiments of this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include the read-only memory 1202, and / or random access memory 1203, and / or one or more memories other than read-only memory 1202 and random access memory 1203 described above.

[0184] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this application.

[0185] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1209, and / or installed from the removable medium 1211. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0186] In embodiments of this application, the computer program can be downloaded and installed from a network via communication section 1209, and / or installed from removable medium 1211. When the computer program is executed by processor 1201, it performs the functions defined in the system of this application embodiment. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0187] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0188] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0189] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A method for optimizing firewall rules, comprising: Obtain the first rule dataset, which includes the running configuration data of N firewall rules. The running configuration data includes matching conditions and actions, where N is an integer greater than or equal to 2. Iterate through every two firewall rules in the first rule dataset, including treating each pair of firewall rules as a rule pair, and perform the following redundancy optimization process on the rule pairs: The matching range of each firewall rule is determined by the number of communication paths matched by each firewall rule. Each communication path is determined by a source object and a destination object. The source object is uniquely determined by the source IP address and source port in the matching conditions, and the destination object is uniquely determined by the destination IP address and destination port in the matching conditions. The size of the intersection of the matching ranges of the rule pair is obtained based on the number of identical communication paths matched by the two firewall rules in the rule pair. Sum the sizes of the matching ranges of the two firewall rules in the rule pair, and then subtract the size of the intersection of the matching ranges of the rule pair to obtain the size of the union of the matching ranges of the rule pair. The overlap of the matching ranges of the rule pairs is obtained by calculating the ratio of the size of the intersection of the matching ranges of the rule pairs to the size of the union of the matching ranges of the rule pairs. as well as When the overlap of the matching range of the rule pair is greater than or equal to the preset overlap threshold, the two firewall rules in the rule pair are processed for redundancy through the subsequent redundancy detection process; otherwise, it is determined that the two firewall rules in the rule pair are not redundant.

2. The method according to claim 1, wherein, The process of determining the matching range of each firewall rule based on the number of communication paths matched by each firewall rule includes: Based on the matching conditions of each firewall rule, calculate the source IP address range, source port range, destination IP address range, and destination port range of the firewall rule; Multiply the source IP address range, source port range, destination IP address range, and destination port range of the firewall rule to obtain the matching range size for each firewall rule.

3. The method according to claim 1, wherein, The step of determining the size of the intersection of the matching ranges of the rule pair based on the number of identical communication paths matched by the two firewall rules in the rule pair includes: Calculate the intersection size of the source IP address range, the intersection size of the source port range, the intersection size of the destination IP address range, and the intersection size of the destination port range in the matching conditions of the two firewall rules in the rule pair; and The size of the intersection of the source IP address range, the size of the intersection of the source port range, the size of the intersection of the destination IP address range, and the size of the intersection of the destination port range are multiplied together to obtain the size of the intersection of the matching range.

4. The method according to claim 1, wherein, Before obtaining the first rule dataset, the method further includes: Obtain the second rule dataset, which includes the runtime configuration data and traffic characteristics of M firewall rules. The traffic characteristics are obtained based on the historical hit data of each firewall rule, where M is an integer greater than N. The runtime configuration data and traffic characteristics of each firewall rule in the second rule dataset are processed into a feature vector; Based on the feature vectors, cluster the M firewall rules in the second rule dataset to obtain preliminary clustering results; and Based on preset multi-level classification conditions, each preliminary cluster in the preliminary clustering results is subdivided level by level to obtain at least one refined cluster; The first rule dataset is taken from any of the fine-grained clusters.

5. The method according to claim 4, wherein, The step of subdividing each preliminary cluster in the preliminary clustering result according to preset multi-level classification conditions to obtain at least one refined cluster includes: In the primary classification, the initial clusters are further subdivided into one or more primary clusters according to protocol type and traffic direction; In the secondary classification, the primary cluster is further subdivided into one or more secondary clusters according to the destination port and the service type of the destination IP. In the three-level division, the second-level clusters are further subdivided into one or more third-level clusters according to the range of the source IP address network segment and the source port; The refined clusters are obtained based on the three-level clusters.

6. The method according to claim 4, wherein, The preliminary clustering results obtained by clustering the M firewall rules in the second rule dataset based on the feature vectors include: The elbow rule is used to obtain the range of values ​​for the number of candidate clusters; For each cluster number value within the range of candidate cluster number values, calculate the average profile coefficient of the clusters obtained after clustering the M firewall rules according to the cluster number value; The cluster number with the largest average contour coefficient is selected as the final cluster number K; and The M firewall rules are clustered according to the final value K of the number of clusters to obtain the preliminary clustering result.

7. The method according to claim 6, wherein, The step of clustering the M firewall rules according to the final value K of the number of clusters to obtain the preliminary clustering result also includes: When there is an isolated firewall rule whose distance from the centroid of each cluster is greater than S times the average distance of each cluster, the isolated firewall rule is marked as an outlier and is not assigned to any cluster, where S is greater than 1.

8. The method according to claim 1, wherein, When the overlap of the matching range of the rule pair is greater than or equal to a preset overlap threshold, the redundancy processing of the two firewall rules in the rule pair through the subsequent redundancy detection process includes: The redundancy type of the two firewall rules in the rule pair is determined based on the redundancy rule precise determination conditions, and the redundancy type determination result is obtained; wherein the redundancy type is one of non-redundancy, full redundancy, and partial redundancy; The two firewall rules in the rule pair are processed using the elimination strategy corresponding to the redundancy type in the redundancy type determination result, where different redundancy types correspond to different elimination strategies.

9. The method according to claim 8, wherein, The precise determination criteria for redundancy rules include protocol type consistency determination, traffic direction consistency determination, action consistency determination, and matching range inclusion determination. Specifically, determining the redundancy type of the two firewall rules in the rule pair based on the precise determination criteria for redundancy rules includes: When any one of the protocol type consistency determination, traffic direction consistency determination, and action consistency determination is inconsistent, the two firewall rules in the rule pair are determined to be of the non-redundant type; the elimination policy corresponding to the non-redundant type is not to perform rule elimination. When the results of the protocol type consistency determination, traffic direction consistency determination, and action consistency determination are all consistent, the rule pair is processed by the matching range inclusion determination, specifically including: When the matching scope of the two firewall rules in the rule pair contains and is contained within each other, the two firewall rules in the rule pair are determined to be completely redundant. The elimination strategy corresponding to the completely redundant type includes deleting the firewall rule whose matching scope is contained within the redundancy. When the matching ranges of the two firewall rules in the rule pair overlap rather than being contained in each other, the two firewall rules in the rule pair are determined to be partially redundant. The elimination strategy corresponding to the partially redundant type includes merging the two firewall rules in the rule pair.

10. The method according to claim 1, wherein, After traversing the first rule dataset, the method further includes: Based on the comparative analysis of the first rule dataset and the third rule dataset, the redundancy optimization effect is evaluated; wherein, the third rule dataset is the rule dataset obtained after redundancy optimization processing of the first rule dataset through the traversal method.

11. A firewall rule optimization device, wherein, The device includes: The first acquisition module is used to acquire a first rule dataset, which includes the running configuration data of N firewall rules. The running configuration data includes matching conditions and actions, where N is an integer greater than or equal to 2. The traversal module is used to traverse every two firewall rules in the first rule dataset; A redundancy optimization module is used to treat every two firewall rules traversed by the traversal module as a rule pair and perform redundancy optimization processing on the rule pairs; wherein, the redundancy optimization module includes: The matching range size determination submodule is used to determine the matching range size of each firewall rule based on the number of communication paths matched by each firewall rule. Each communication path is determined by a source object and a destination object. The source object is uniquely determined by the source IP address and source port in the matching conditions, and the destination object is uniquely determined by the destination IP address and destination port in the matching conditions. The matching range refers to the range of communication paths matched by the firewall rule. The matching range intersection size determination submodule is used to determine the size of the matching range intersection of the rule pair based on the number of identical communication paths in the communication paths matched by the two firewall rules in the rule pair. The submodule for determining the size of the union of matching ranges is used to sum the sizes of the matching ranges of the two firewall rules in the rule pair, and then subtract the size of the intersection of the matching ranges of the rule pair to obtain the size of the union of the matching ranges of the rule pair. The overlap calculation submodule is used to calculate the ratio of the size of the intersection of the matching ranges of the rule pair to the size of the union of the matching ranges of the rule pair, so as to obtain the overlap of the matching ranges of the rule pair. The redundancy processing submodule is used to perform redundancy processing on the two firewall rules in the rule pair through a subsequent redundancy detection process when the overlap of the matching range of the rule pair is greater than or equal to a preset overlap threshold; otherwise, it is determined that the two firewall rules in the rule pair are not redundant.

12. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having a computer program or instructions stored thereon, wherein, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 10.

14. A computer program product comprising a computer program or instructions, wherein, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 10.

Images