運用關聯規則及改變探勘技術於防火牆政策規則優化

Applying Association Rule and Change Mining Techniques for Firewall Policy Optimization

胡雅涵(Ya-Han Hu) ； 翁政雄(Cheng-Hsiung Weng) ； 楊亞澄(Ya-Cheng Yang)

《資訊管理學報》 23卷3期 (2016/07) Pp. 277-304

摘要

防火牆設備是企業最普遍的網路防護設施，隨著網路環境的改變，防火牆政策規則須不斷的更新，才能維持防火牆功能的正常運作。如何從防火牆日誌記錄中挖掘出有意義的規則，並且適時依據防火牆日誌記錄的變動篩選出不同樣式的規則，進而調整防火牆政策規則是一項有值得研究的議題。本研究嘗試整合關聯規則探勘（Association rule mining）及改變探勘（Change mining）技術，提出Change-Based Association Rule Mining（CBARM）方法。首先，從防火牆日誌記錄中挖掘出有意義的規則，進而運用改變探勘技術辨識出新興樣式（Emerging patterns）、新增樣式（Added patterns）及消失樣式（Perished Patterns）等3種不同樣式的關聯規則。最後，將具有不同樣式的關聯規則運用於防火牆政策規則的調整，藉以提升防火牆效率。經實驗結果得知：CBARM 方法效能提升（封包比對次數減少）相較於Apriori方法約95.19%至582.19%。平均而言，效能約提升212.10%。

關鍵字

防火牆政策 ； 防火牆日誌 ； 資料探勘 ； 關聯規則 ； 改變探勘

並列摘要

Purpose-A firewall is the network security system most frequently used by enterprises. Because of changes in the dynamic network environment, firewall policy rules must be constantly updated to maintain efficient firewall operation. Thus, the aim of this study is to optimize firewall policy rules and improve firewall efficiency by using association rules discovered in firewall logs. Design/methodology/approach-This paper proposes change-based association rule mining (CBARM), which integrates association rule mining and change mining techniques, to discover meaningful firewall policy rules in firewall logs. Specifically, CBARM first determines pertinent association rules by using firewall logs from different time periods. Subsequently, the change mining technique is used to identify emerging, added, and perished patterns. Finally, the three types of patterns can be utilized to optimize the firewall policy rules and enhance firewall efficiency. The firewall logs were collected from a technology company in Central Taiwan. The total number of rules matched in the firewall was used as a performance measure. Findings - The experimental results revealed that the proposed CBARM outperformed the Apriori approach, reducing the number of compared network packets with firewall policy rules by approximately 95.19% to 582.19%. On average, the performance of the proposed CBARM was 212.10% more effective than that of the Apriori approach. Research limitations/implications-This study investigated the firewall logs from one company only. Evaluating the logs from other companies is critical for confirming validity. In addition, future studies can integrate other data mining and machine learning techniques to refine the performance of the proposed method. Practical implications-Two practical implications are provided. First, the association rule mining technique is proven to derive useful firewall policy rules in firewall logs. Second, using the change mining technique can facilitate evaluating the generated rules and applying such rules to optimize firewall policy rules. Originality/value-This study is the first to extend association rule mining and change mining techniques to the domain of firewall log analysis, creating a new approach to optimizing firewall policy rules.

並列關鍵字

firewall policy ； firewall log ； data mining ； association rule ； change mining

參考文獻

Al-Shaer, E.S. and Hamed, H.H. (2003), ‘Firewall policy advisor for anomaly discovery and rule editing’, Proceedings of IFIP/IEEE Eighth International Symposium on Integrated Network Management (IM 2003), Colorado Springs, USA, March 24-28, pp. 17-30.

Al-Shaer, E.S. and Hamed, H.H. (2004), ‘Discovery of policy anomalies in distributed firewalls’, Proceedings of Twenty-third AnnualJoint Conference of the IEEE Computer and Communications Societies (INFOCOM 2004), Vol. 4, Hong Kong, China, March 7-11, pp. 2605-2616.

Bailey, J., Manoukian, T. and Ramamohanarao, K. (2003), ‘A fast algorithm for computing hypergraph transversals and its application in mining emerging patterns, Proceedings of the Third IEEE International Conference on Data Mining (ICDM 03), November 19-22, Melbourne, Florida, USA, pp. 485.

Böttcher, M., Spott, M., Nauck, D. and Kruse, R. (2009), ‘Mining changing customer segments in dynamic markets’, Expert Systems with Applications, Vol. 36, No. 1, pp. 155-164.

Casado, M., Garfinkel, T., Akella, A., Freedman, M. J., Boneh, D., McKeown, N. and Shenker, S. (2006), ‘SANE: a protection architecture for enterprise networks’, Proceedings of the 15th USENIX Security Symposium, Vancouver, B.C., Canada, July 31-Aug 4, pp. 137-151.