運用關聯規則於提升防火牆效率之研究

Applying Association Rule Mining to Enhance Firewall Operational Efficiency

楊亞澄(Ya-Cheng Yang)

指導教授 ： 胡雅涵

國立中正大學/管理學院/資訊管理學系/碩士(2014年)

摘要

近年來企業越來越依賴網際網路，已是企業不可或缺的資源，雖然透過網路可以提供各式服務及開拓市場，但倚靠網路程度越高，則網路的安全將是非常重要的議題。企業網路防護最普遍是防火牆設備，針對防火牆設備的政策規則調整，隨著網路環境的改變，防火牆規則需不斷的更新，才能維持功能的正常及效率提升。本研究主要以防火牆日誌記錄來透過分析，在大量的日誌記錄中透過人工分析篩選是曠日廢時且容易出錯的，透過資料探勘技術來輔助企業去分析防火牆政策規則的優劣，並協助企業管理人員加以調整改進政策規則表，來達到提升防火牆設備的運作效率。

本論文使用企業防火牆日誌記錄資料，並透過關聯規則演算法加以分析，找出較頻繁的網路特徵規則，例如找出頻繁存取的目的位址、最頻繁被阻擋的來源位址等，接著把這些規則整合透過Change mining方法的Emerging Patterns 、Added Patterns及Perished Patterns三種定義來深入研究兩個不同時間點所產生關聯規則，來決定是否要來針對現行防火牆政策規則加入、調整或刪除規則。對於之前學者的研究而言，本論文使用企業防火牆設備的日誌記錄來加以分析研究，與之前的研究相比， 可以找出更為關鍵的關聯規則，提升防火牆運作效能。

本研究結果顯示，透過Change mining將有效改善異動規則表的次數頻率，產生的規則都非常關鍵，避免異動太多的防火牆政策規則，反而造成企業管理人員的負擔，整合防火牆規則表後可以維持防火牆效率的提升，並非一昧的異動政策規則表，研究結果也找出存取目的位址較為異常的規則，進而發現內部網路的異常來源端。

關鍵字

改變探勘 ； 政策管理 ； 日誌分析 ； 防火牆 ； 關聯規則 ； 資料探勘

並列摘要

In recent years, internet is an indispensable business resource. The security of network becomes a very important issue. Despite years of experience and experimentation, these firewall protection mechanisms are far from ideal. Due to the rapid changes of network environment, firewall policy rules must be regularly revised for maintaining system function and impring efficiency. Application of data mining techniques to analyze firewall logs can assist companies analyze the merits of the firewall policy table. Enterprise administrators are able to adjust the firewall device rules to enhance operational efficiency.
This paper use a corporate firewall logging data to detect frequent characteristic rules through a network of association rules, such as identifying the frequently accessed destination address or blocked ip address. And joining, adjusting or removing rules by using Emerging Patterns, Added Patterns and Perished Patterns of Change mining methods to investigate association rules from two different period of time. Comparing with prior studies, using a analyzed enterprise firewall logging data can help administrators to find much more critical association rules, improve the firewall device efficiency.
Compare to asscocitation rules analysis, the results of this study show that combing adjusted rule table through Change mining will effectively reducing the burdens on business administrator. Besides, integrated firewall policy rules can identify some specific unusal accesses of destination address, what’s more to find out the abnormal internal network source address.

並列關鍵字

policy management ； log analysis ； firewall ； association rules ； Data Mining ； Change mining

參考文獻

Abdulmohsin, I. M. A. (2009). Techniques and algorithms for access control list optimization. Computers & Electrical Engineering, 35(4), 556-566.

Al-Shaer, E. S., & Hamed, H. H. (2004, March). Discovery of policy anomalies in distributed firewalls. Paper presented at the Twenty-third Annual Joint Conference of the IEEE Computer and Communications Societies(INFOCOM 2004), Hong Kong.

Böttcher, M., Spott, M., Nauck, D., & Kruse, R. (2009). Mining changing customer segments in dynamic markets. Expert Systems with Applications, 36(1), 155-164.

Bailey, J., Manoukian, T., & Ramamohanarao, K. (2003). A Fast Algorithm for Computing Hypergraph Transversals and its Application in Mining Emerging Patterns. Paper presented at the International Conference on Data Mining, Melbourne, Florida.

Chang, R.-I., Lai, L.-B., Su, W.-D., Wang, J.-C., & Kouh, J.-S. (2007). Intrusion detection by backpropagation neural networks with sample-query and attribute-query. International Journal of Computational Intelligence Research (IJCIR), 3(1), 6-10.