«上一篇/Previous Article|本期目录/Table of Contents|下一篇/Next Article»

《计算机技术与发展》[ISSN:1006-6977/CN:61-1281/TN]

卷:

期数:

2025年06期

页码:

77-86

栏目:

网络空间安全

出版日期:

2025-06-10

文章信息/Info

Title:

AT4FP:An Anomaly Detection Tool for Security Policies in Operational Firewalls

文章编号:

1673-629X(2025)06-0077-10

作者:

赖清楠1; 2

1. 北京大学 计算中心,北京 100871;

2. 北京大学 长沙计算与数字经济研究院,湖南 长沙 410205

Author(s):

LAI Qing-nan1; 2

1. Computing Center,Peking University,Beijing 100871,China;

2. PKU-Changsha Institute for Computing and Digital Economy,Changsha 410205,China

关键词:

异常检测; 安全策略; 算法设计; 自动化运维; 网络安全

Keywords:

anomaly detection; security policies; algorithm design; automated operations and maintenance; cyber security

分类号:

TP393

DOI:

10.20165/j.cnki.ISSN1673-629X.2025.0030

摘要:

随着网络规模的扩大和业务的持续增长,防火墙安全策略规则数量的急剧增加给网络运维团队带来了重大挑战。策略冲突和异常可能导致严重的安全漏洞,因此开发有效的策略分析工具至关重要。 该文设计了一种名为 AT4FP 的安全策略分析工具,该工具采用基于区间树和状态图的检测算法,旨在快速且准确地识别策略间的潜在冲突和异常,从而预防潜在的安全风险。 为了验证该工具的有效性,使用生成的策略数据和实际运行的安全策略数据进行了实验,并将其与现有开源安全策略分析工具进行了对比。 结果表明,AT4FP 在检测效率和实用性方面均有显著提升,能够有效检测并分析真实运行防火墙上的策略异常,为运维人员提供了有价值的参考。 基于 AT4FP 工具,提出了一个自动化策略异常处理的框架 AFPR,框架通过 API 接口与防火墙交互,采用 AT4FP 工具发现异常策略,使用策略引擎技术自动化处理异常,通过策略匹配日志进行监控与验证,实现了从检测到处理的全流程自动化,极大地提高了异常策略处理效率。

Abstract:

With the expansion of network scale and continuous business growth,the rapid increase in firewall security policy rules poses significant challenges to network operation and maintenance teams. Policy conflicts and anomalies can lead to serious security vulnerabilities,making the development of effective policy analysis tools crucial. We introduce a security policy analysis tool named AT4FP,which employs a detection algorithm based on interval trees and state diagrams. It is designed to quickly and accurately identify potential conflicts and anomalies between policies,thereby preventing potential security risks. To validate the effectiveness of this tool,we conducted experiments using both generated policy data and actual operational security policy data,comparing it with existing open - source security policy analysis tools. The results demonstrate that AT4FP significantly improves detection efficiency and practicality,ef-fectively detecting and analyzing policy anomalies on real operational firewalls,providing valuable insights for maintenance personnel.Based on the AT4FP tool,we propose an Automated Firewall Policy Anomaly Resolution Framework (AFPR). The framework interacts with firewalls through API interfaces,uses the AT4FP tool to identify anomalous policies,employs a policy engine for automated anomaly resolution,and monitors and verifies through policy matching logs, achieving full automation from detection to resolution, greatly enhancing the efficiency of handling anomalous policies.

常用功能

更新日期/Last Update: 2025-06-10