Test Case Generation for Firewall Testing

Firewall tests have to be performed to verify that the firewall works as specified. In this work, a test case generation approach is developed, which defines test cases based on the firewall rule sequence and uses real traffic database to prepare test packets. Test packets can be used or injected to check if the firewall implementation is erroneous, i.e. the rules do not correspond to the actions of the firewall. Although injection based firewall testing is accepted as an inefficient way of testing firewall implementations in the literature [1], there has been no alternative method developed yet. Most of the academic work focuses on testing of firewall rules where firewall implementation is assumed error-free. Even if firewall implementation is errorfree, a firewall can be hacked and programmed to behave differently from the intended security policy. In that case, real time injection based testing is one of the ways to reveal the security breach. There are three general approaches to firewall testing; penetration testing, testing of the firewall implementation, and testing of the firewall rules [2]. Penetration testing is performed to check the firewall for potential breaches of security that can be exploited. The firewall implementation testing approach evaluates the correspondence of firewall rules with respect to the actions the firewall performs (e.g. if a rule indicates to block a packet but the firewall forwards the packet, that means a firewall implementation error exists) [2]. Testing of the firewall rules verifies whether the security policy is correctly enforced by a sequence o