HSViz: Hierarchy Simplified Visualizations for Firewall Policy Analysis

Abstract

Most of the companies have firewalls in order to protect their internal networks and assets from the attacker of the cyber space. Firewall policies should be maintained and organized with high importance. However, considering the length of time needed in analyzing the highly complex policies and the risks of disabling firewall that may arise in case of a false policy setting. It is extremely hard to securely optimize the performance of firewalls. This paper is to suggest a visualization tool that shows the status and the types of policies applied throughout the firewalls so that such difficulties related to the maintenance of firewall policies can be resolved. The proposed tool is designed in six different angles; (1) Hierarchy-view, (2) Anomaly-view, (3) Distributed-view, (4) ANYPolicy-view, (5) SearchResult-view, and (6) Top and Bottom Used-view. The core of the overall function is to facilitate the easy identification of the policy interrelationships. The visualization tool has been tested by being applied across approximately 24 different firewall policies. The processing speed of each function, abuse detection rate were all reviewed positively. By the help of the tool, identifying the services, performance improvement, and visibility of the policy relations, which thereby will lead to better safety in preserving the assets intact. A video of the proposed visualization tool can be found on the web site: https://youtu.be/43OfHN8dteU

An Optimized Approach for Assisted Firewall Anomaly Resolution

“…Another relevant classes of related work about the topic of firewall anomaly analysis is composed of studies ( [27], [28], [29], [30], [31], [32], [33], [34]) that propose platforms based on Graphic User Interfaces (GUIs), which provide functionalities such as zooming and manual adjustment of the firewall filtering effect areas to help human administrators to identify firewall policy anomalies. Specifically, Tran et al [27] propose PolicyVis, a 2D graphic interface that allows a thorough visualization of all possible firewall behaviors by considering all rules fields, actions and orders.…”

“…Its visualization model allows to represent all ranges of source and destination IP addresses, thus enabling control on each application service, to identify active and inactive domains, and to detect possible anomalies. Lee et al [33] propose HSViz, a firewall policy visualization tool that offers multiple view to analyses firewall policies. Among them, the most useful ones are the hierarchy view, which visualizes firewall policy ranges based on destination IP octets at the user's choice, and the anomaly and distributed views, which represent the policy in parallel coordinate charts, easing anomaly detection.…”