發展知識密集模型檢查防火牆規則之衝突

A knowledge-intensive model for inspecting the conflicts of firewall rules

許家榮(Chia-Jung Hsu)

指導教授 ： 戚玉樑

中原大學/商學院/資訊管理研究所/碩士(2013年)

https://doi.org/10.6840/CYCU.2013.00329

摘要

中文摘要
本研究提出｢知識密集模型」用於解決防火牆規則衝突，此機制利用知識本體論來進行防火牆規則的知識塑模，使用語意網規則語言檢查規則的衝突及異常規則的推論。網路防火牆已被確認為在佈署電腦網路安全是最有效的方法之一，透過網路安全政策中的網路資源和流量的控制，防火牆提供了不同程度的網路存取。在實際應用上，防火牆配置跨越多個網路來執行成千上萬的存取控制規則，其複雜性可能會增加配置錯誤的可能性。但是如果網路管理員不具備足夠技能和專門知識來正確配置它們，將導致對網路資源會有未經授權存取的威脅，或者是阻擋已被授權存取的不正常動作產生。因此，獲得正確和一致的規則對於防火牆是必要的。本論文所提出的方法，網路管理人員能夠在設計新防火牆規則時能事先檢查和驗證其正確性和一致性和整合到既有的規則，而能達到防火牆整體防護架構的高安全性。

關鍵字

語意網規則語言 ； 語意網 ； Web本體語言 ； 防火牆規則衝突檢查 ； 知識本體論

並列摘要

Abstract
In this paper, proposed to use Ontology and the semantic language tool for querying the conflicts and reasoning the anomalies among firewall rules, besides the knowledge modeling of firewall policy rules. Internet firewall has been recognized as one of the most effective way to deploy computer network security. Through controlling of network resources and traffic in using the network security policy, the firewall provides a different level of trust between the network demarcation points. In practice firewall configuration, usually to perform thousands of access control rules across multiple networks, this complexity may increase the possibility of configuration errors. However, if the network administrator does not have sufficient skills and expertise to configure them correctly, could lead to unauthorized access with threats to network resources or blocking the authorized access to network resources. Therefore, the correct and consistent rules for the firewall are essential. This proposed method, assists the network administrators to verify the accuracy and consistency at the design of new firewall rules and properly integrate those new rules into the existing rules prior to production deployment, to achieve the requirement of a high security firewall.

並列關鍵字

Semantic Web ； SWRL (Semantic Web Rule Language) ； Firewall Rule Conflict Inspecting ； Ontology ； OWL (Web Ontology Language)

參考文獻

戚玉樑 (2006)。知識擷取與知識表達協同程序於建構本體的概念架構。資訊管理學報，13(2)，193-215。

Al-Shaer, E., & Hamed, H. (2002). Design and implementation of firewall policy advisor tools. DePaul University, CTI, Tech.Rep,

Al-Shaer, E., Hamed, H., Boutaba, R., & Hasan, M. (2005). Conflict classification and analysis of distributed firewall policies. Selected Areas in Communications, IEEE Journal on, 23(10), 2069-2084.

Al-Shaer, E. S., & Hamed, H. H. (2003). Firewall policy advisor for anomaly discovery and rule editing. Integrated Network Management, 2003. IFIP/IEEE Eighth International Symposium on, , 17-30.

Al-Shaer, E. S., & Hamed, H. H. (2003). Management and translation of filtering security policies. Communications, 2003. ICC'03. IEEE International Conference on, 1, 256-260.