Firewall rule set optimization method based on rule matching hit rate and distribution variance

Abstract

The invention relates to a firewall rule set optimization method based on rule matching hit rate and distribution variance, belonging to the technical field of computer and information science. The method comprises the following steps: firstly preprocessing a firewall initialization rule set, wherein content of preprocessing comprises rule set exception detection, exception processing and rule combination, and obtaining a simplest firewall rule set without exceptional rules after preprocessing; then, collecting firewall logs of a period of time in real time, calculating rule weight according to the firewall log information, wherein rule weight calculation is divided into three parts including rule hit rate frequency statistic, rule hit time distribution statistic and a rule weight value calculated according to the two statistic data; finally, according to the calculated rule weight value, reordering the firewall rule set, and placing the rules with relatively higher weight values at positions with higher priority. Compared with the conventional firewall rule set optimization method, the method provided by the invention has better optimization effect, can enable a firewall to keep relatively higher data packet filtering rate and has relatively excellent flexibility and transportability.

Description

technical field [0001] The invention relates to a firewall rule set optimization method based on rule matching hit rate and distribution variance, and belongs to the technical field of computer and information science. Background technique [0002] Firewall is currently one of the most widely used and mainstream network security technologies, and is the first line of defense in the network security system. The security of the firewall largely depends on the configuration of policies, that is, a set of ordered rule sets formed based on preset security policies. With the improvement of network security requirements, the complexity of firewall rules continues to increase. The firewall rule sets have strict priorities. In the case of a stable network environment, the filtering efficiency of the rule set will not fluctuate too much. However, the general network environment is constantly changing, and the filtering efficiency of the rule set will also change with As the network ...

AI Technical Summary

Problems solved by technology

[0013] The purpose of the present invention is to improve the matching efficiency of firewall data packets and solve the problems of poor flexibility and poor compatibility of existing methods, and propose a firewall rule set optimization method based on rule matching hit frequency and hit time distribution variance

Images