基于SMFDD实现分布式防火墙异常规则检测及优化.pdfVIP

计算机工程与设计 Nov. 2014 2014 年 11 月 COMPUTER ENG卧mERING AND DESIGN Vo l. 35 No.11 第 35 卷第11 期 基于S如iFDD 实现分布式防火墙异常规则检测及优化 吴军，邓宝龙，邵定宏 (南京工业大学电子与信息工程学院，江苏南京 211816) 摘 要z 为提高分布式防火墙异常规则的检测效率并优化异常规则，提出基于半同构标记防火墙决策图 (SMFDD)的分布 式防火墙异常规则检测算法与异常规则优化算法。异常规则检测算法在保持原始规则完整性、一致性、紧凑性的基础上， 消除独立防火墙规则间异常;通过SMFDD之间的比较操作，提高异常规则的检测效率。异常规则优化算法根据 SMFDD 之间逻辑操作，定位引起规则异常的重叠或交叉域，修正分布式防火堵规则间异常，优化防火墙规则。仿真结果表明，当防 火墙含有一定规则时，异常规则检测算法可以提高分布式防火堵规则间异常检测效率，异常优化算法能够快速优化异常规则。 关键词:分布式防火墙;半同构标记防火墙决策图;异常规则;规则优化;网络安全 中图法分类号: TP393 文献标识号:A 文章编号: 1000-7024 (2014) 11-3741-06 Anomaly detection and optimization of distributed firewall rules based on SMFDD WU Jun , DENG Bao-long , SHAO Ding-hong (College of Information Science and Engineeri吨， Nanjing University of Technology , Nanjing 211816 , China) Abstract: To improve the detection efficiency of distributed firewall anomaly rules and optimize anomaly rules , the discovering and optimizing anomaly rules algorithm based on a model named semi-isomorphic marked firewall decision diagram (SMFDD) was proposed. The discovering anomaly rules algorithm kept the consistency , completeness and compactness of the original rules , as well as eliminated the rule anomalies in intra-firewall. Through the ∞mparison operation between SMFDDs, the dis- covering anomaly rules algorithm improved the efficiency on detecting anomaly rules. As to the optimizing anomaly rules algo- rithm , the logical operation between the SMFDDs located the overlap or cross domain between anomaly rules , and corrected and optimized the anomaly rules in the distributed firewal l. The simulation results demonstrate that the discovering