Firewall log analysis and dynamic rule re-ordering in firewall policy anomaly management framework
K Lubna, Robin Cyiac, Kavitha Karun A · 2013
Today, there are more many ways to communicate than there were just a few years ago and among them, internet plays a major role. Firewalls are essential for a secure network communication to ensure that only trusted packets are transferred between the private and public network. In firewall, security policy is implemented based on the rules defined by the network administrator; that decides which packets can be allowed to an organization's private network. Manual definition of rules often results in anomalies in the policy. Therefore, an effective anomaly detection and resolution approach is needed. After resolving these conflicts, the rules can be re-ordered dynamically that improves the efficiency of the anomaly management framework. With firewall log analysis, frequently used rules can be set as primitive rules, to which more security can be added.