论文标题
防火墙分析中的布尔表达
Boolean Expressions in Firewall Analysis
论文作者
论文摘要
防火墙政策是网络安全方面的重要防御方法，指定允许哪些数据包通过网络而不是网络。这些防火墙政策由互动规则列表组成。实际上，防火墙可以由数百或数千个规则组成。对于人类而言，这可能非常困难。建议的解决方案是将防火墙策略作为布尔表达式建模，并使用现有的计算机程序（例如SAT求解器）来验证防火墙满足某些条件。本文深入了解了代表防火墙政策的布尔表达式。我们提出了一种算法，将防火墙规则列表转换为连接性正常形式（CNF）或分离正常形式（DNF）的布尔表达式。我们还对CNF和DNF的大小放置了一个上限，该大小在防火墙策略中的规则数中是多项式。这表明过去的结果表明，在防火墙分析的背景下，从CNF中的布尔表达转换为DNF中的一个布尔表达时发生了组合爆炸。
Firewall policies are an important line of defence in cybersecurity, specifying which packets are allowed to pass through a network and which are not. These firewall policies are made up of a list of interacting rules. In practice, firewall can consist of hundreds or thousands of rules. This can be very difficult for a human to correctly configure. One proposed solution is to model firewall policies as Boolean expressions and use existing computer programs such as SAT solvers to verify that the firewall satisfies certain conditions. This paper takes an in-depth look at the Boolean expressions that represent firewall policies. We present an algorithm that translates a list of firewall rules into a Boolean expression in conjunctive normal form (CNF) or disjunctive normal form (DNF). We also place an upper bound on the size of the CNF and DNF that is polynomial in the number of rules in the firewall policy. This shows that past results suggesting a combinatorial explosion when converting from a Boolean expression in CNF to one in DNF does note occur in the context of firewall analysis
