Firewall Management: Rapid Anomaly Detection

The detection of anomalies in large firewall rule sets is a commonly agreed challenge. Several approaches have been proposed in literature but have not been adapted broadly due to their limited performance. In this work, we present an approach that adapts the concept of Header Space Analysis (HSA) to the static analysis of firewall rule sets. The proposed Domain oriented Header Space Analysis (DHSA) enables a domain-specific modeling and the characterization of anomalies which, in turn, can be transferred to classic HSA. Hence, the approach benefits from HSA's efficient solving techniques. Our evaluation demonstrates the scalability of our approach checking very large realistic rule sets within few seconds. In comparison with other state of the art tools from literature, our approach shows at least 115-fold performance gain for real world workloads.