Classification and Discovery on Intrafirewall Policy Anomalies

Firewalls are core elements in network security. However, managing firewall rules is anerror-prone task especially for less experienced administrator. The reason is that firewall filteringrules itself might cause network vulnerability due to the firewall policy anomalies were notcarefully written and ordered them. Thus, firewall rule classification is essential to determine theproper rule placement and ordering without any policy anomalies when they are inserting ormodifying filtering rules. In this thesis, a firewall rules classifier is developed based on IntraFirewall Policy Anomaly Algorithm in order to discover and alert all possible policy anomalies inIPCop firewall that is used in Small Office Home Office (SOHO) network. And the main purposeof this classifier is to assist the administrator who he or she is setting their firewall to be able toconfigure conflict-free firewall rules easily by giving advising alerts. This firewall is implementedin a small campus network prototype and experimented it in a virtual network that is built by usingVMware Workstation 10. Firewall policy for this system is based on own predefined securitypolicy for this network. The developed classifier can assist the administrators by advising allpossible types of firewall anomalies in firewall setting