一种基于逻辑编程的防火墙规则形式化分析方法  

Logic Programming Based Formal Analysis Method of Firewall Rules

作　　者：李鼎[1] 鲁柯 周保群[1] 赵彬[1] 

机构地区：[1]信息工程大学电子技术学院,河南郑州450004 [2]河南预备役136师,河南开封475004

出　　处：《信息工程大学学报》2009年第2期195-199,共5页Journal of Information Engineering University

基　　金：军队科研基金资助项目

摘　　要：防火墙作为网络安全体系的基础和核心控制设备,其作用的发挥取决于防火墙规则的正确配置。由于防火墙规则配置的复杂性,导致规则间可能存在冲突,使其不能满足安全目标。文章提出一种基于逻辑编程的防火墙规则形式化分析方法,将安全目标与防火墙规则转换为逻辑程序后加载到推理引擎,制订一系列推理规则,通过提出高级查询进行防火墙规则的冲突检测和正确性验证,并对分析结果进行解释。Firewall is the basal and principal equipment of network security architecture, its function lying on the correctness of firewall rules. Firewall rules are so complex that they may not consistent with each other. In this paper, a logic programming based formal analysis method to confirm anoma- ly detection and property checking are proposed. Firewall rules and security requirement into logic programs are translated, then import into reasoning engine and performing analysis through submit- ting queries. All of the results are explained.

关 键 词：防火墙规则 逻辑编程 冲突检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]