Analysis of Firewall Policy Rules Using Data Mining Techniques

— Firewall is the de facto core technology of today's network security and defense. However, the management of firewall rules has been proven to be complex, error-prone, costly and inefficient for many large-networked organizations. These firewall rules are mostly custom-designed and hand-written thus in constant need for tuning and validation, due to the dynamic nature of the traffic characteristics, ever-changing network environment and its market demands. One of the main problems that we address in this paper is that how much the firewall rules are useful, up-to-dated, well-organized or efficient to reflect the current characteristics of network traffics. In this paper, we present a set of techniques and algorithms to analysis and manage firewall policy rules: (1) Data Mining technique to deduce efficient firewall policy rules by mining its network traffic log based on its frequency, (2) Filtering-Rule Generalization (FRG) to reduce the number of policy rules by generalizatio...

• Type: Conference
• Year: 2006
• Where: NOMS
• Authors: Korosh Golnabi, Richard K. Min, Latifur Khan, Ehab Al-Shaer
• Keywords: Firewall, Firewall Policy Rules, Firewall Rules, NOMS 2006