Abstract
While configuring firewalls, firewall rule ordering and distribution must be done cautiously on each of the cooperative firewalls. However, network operators are prone to incorrectly configuring firewalls because there are commonly hundreds of thousands of filtering rules (i.e., rules in the Access Control List file; or ACL for short) which could be setup in a firewall, not mentioning these rules among firewalls could affect mutually. To speed up the crucial but laboring inspection of rule configuration on firewalls, this chapter describes our developed diagnosis mechanism which can speedily figure out rule anomalies among firewalls with an innovative data structure—Adaptive Rule Anomaly Relationship tree (or ARAR tree). With the aid of this data structure and associated algorithms, significant improvements have been made in the field.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Al-Shaer, E., Hamed, H., Boutaba, R., Hasan, M.: Conflict classification and analysis of distributed firewall policies. IEEE J. Select. Areas Commun. 23(10), 2069–2084 (2005)
Thanasegaran, S., Yin, Y., Tateiwa, Y., Katayama, Y., Takahashi, N.: Topological approach to detect conflicts in firewall policies. In: 23rd IEEE international parallel and distributed processing symposium. http://SSN-1569173665-paper-3.pdf, IEEE Press (2009)
Dai, X.-Q.: Data Compression. ISBN 978-957-442-517-4. Flag. Taipei, Taiwan (2009)
Chao, C.-S.: A novel and feasible system for rule anomaly and behavior mismatching diagnosis among firewalls. Springer LNEE 234 (2013)
Chao, C.-S., Chiu, C.-T.: An adaptive RAR tree-based diagnosis system for rule anomalies and behavior mismatching among firewalls. In: 2013 national computer symposium (NCS2013). Session 3, No. 20 (2013)
Acknowledgment
This work is supported by MOST, ROC, under contract MOST-2221-E-035-100.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2016 Springer International Publishing Switzerland
About this paper
Cite this paper
Chao, CS. (2016). An ARAR-Tree-Based Diagnosis Mechanism for Rule Anomalies Among Internet Firewalls. In: Juang, J. (eds) Proceedings of the 3rd International Conference on Intelligent Technologies and Engineering Systems (ICITES2014). Lecture Notes in Electrical Engineering, vol 345. Springer, Cham. https://doi.org/10.1007/978-3-319-17314-6_23
Download citation
DOI: https://doi.org/10.1007/978-3-319-17314-6_23
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-17313-9
Online ISBN: 978-3-319-17314-6
eBook Packages: EngineeringEngineering (R0)