Optimiranje sigurnosnih pravila vatrozida

scientific master's theses

• Title (english): Optimisation of firewall security rules
• Author: Tihomir Katić
• Mentor: Mile Šikić (mentor)
• Committee member: Gordan Gledec (predsjednik povjerenstva)
• Committee member: Mile Šikić (član povjerenstva)
• Committee member: Vedran Batoš (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; (Department of Electronic Systems and Information Processing); Zagreb
• Defense date and country: 2011-12-13, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing
• Universal decimal classification (UDC): 004 - Computer science and technology. Computing. Data processing

Abstract

Ovaj rad prezentira Firo (FIRewall Optimizer), statički optimizator sigurnosnih pravila prvenstveno baziran na Iptables vatrozidu, ali prilagodljiv i za druge tipove vatrozida koji sadrže sigurnosna pravila. U radu su opisane meni poznate metode optimiranja, od statički baziranih do dinamičkih koje prate karakteristike mrežnog prometa, kao i postojeća klasifikacija anomalija. Budući da Firo, za razliku od drugih tehnika, radi s mnogo većim brojem parametara uspoređivanja, a uz akcije prihvaćanja ili odbacivanja uvodi i druge tipove akcija (koje su proširive i s akcijskim parametrima), uz postojeću klasifikaciju anomalija definirani su i novi tipovi anomalija kao i nove tehnike optimizacije. Tako je u radu već poznata shadowing anomalija nazvana shadowed after te je proširena i na neprekidajuće akcije, a zatim je predstavljena shadowed before anomalija. Osim toga, predstavljene su i tzv. mikro-optimizacije koje su zasnovane na uklanjanju redundantnih parametara iz sigurnosnih pravila te na uklanjanju redundantnih elemenata iz parametara sigurnosnih pravila. Dio dokumenta posvećen je i optimiranju sigurnosnih pravila za logiranje i limitiranje mrežnog prometa. Budući da postojeći radovi pretpostavljaju uglavnom jednostavne parametre, u ovom radu su predstavljeni i algoritmi uspoređivanja i spajanja različitih složenih tipova parametara.

Abstract (english)

This paper presents Firo (FIRewall Optimizer), static firewall rules optimizer primarily based on Iptables, adaptable for other types of firewalls which include rules. Paper contains optimisation methods known to author, both static and dynamic optimisation methods, as well as the existing classification of anomalies. Since Firo works with larger number of comparing parameters then existing methods, and it includes actions that don’t only accept or reject network packets, this work defines new types of anomalies as well as new optimisation techniques. So, in this paper already known shadowing anomaly is extended to non-breaking actions and renamed to shadowed after anomaly; because new shadowed before anomaly is defined as well. New micro-optimizations, based on elimination of redundant parameters from rules and on elimination of redundant elements from parameters, are also presented. One part of this paper is dedicated to optimizing logging rules and rules which are limiting network traffic. Because existing papers assume simple parameters, this work presents algorithms for comparing and merging different types of complex parameters.

• Keywords: Firo; statički optimizator vatrozid; anomalija; shadowed after anomalija; shadowed before anomalija; redundancije; spajanje pravila; LOG pravila; prekidajuće i neprekidajuće akcije; parametri usporedbe; akcijski parametri; Iptables
• Keywords (english): Firo; firewall static optimizer; anomaly; shadowed after anomaly; shadowed before anomaly; redundancy; merge rules; LOG rules; breaking and not-breaking actions; parameters of comparison; action parameters; Iptables
• Language: croatian
• URN:NBN: urn:nbn:hr:168:165487
• Study programme: Title: Postgraduate master programe in computing; Study programme type: university; Study level: postgraduate; Academic / professional title: magistar inženjer računarstva (magistar inženjer računarstva)
• Catalog URL: http://lib.fer.hr/cgi-bin/koha/opac-detail.pl?biblionumber=37195
• Type of resource: Text
• Extent: 123 str. ; 30 cm.
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2019-07-03 07:14:51