基于统计规则匹配的防火墙优化方案设计  

Fault identification and location for intelligent photoelectric composite cable

作　　者：刘嘉 黄馨漪 和志成 LIU Jia;HUANG Xin-yi;HE Zhi-cheng(Yuxi Power Supply Bureau,Yunnan Power Grid Co.,Ltd.,Yuxi 653100,China)

机构地区：[1]云南电网有限责任公司玉溪供电局

出　　处：《电子设计工程》2019年第23期135-138,143,共5页Electronic Design Engineering

基　　金：2018年主机安全防护建设及优化项目(050400HA42180003)

摘　　要：为了应对复杂且快速发展的网络环境的安全问题,文中给出了基于统计规则匹配的防火墙优化方案设计。该方案首先利用ASBV方法对存在冲突的初始规则集合进行筛选,同时利用一种基于匹配时间的规则次序动态调整方法对筛选后的规则集合进行优先级调整,以增加规则匹配效率。然后利用多报文分类对优化后的规则集合进行处理并得到规则映射表,通过映射表进行匹配可以进一步减少匹配次数。最后为应对匹配结果的误差,提出了利用统计信息进行结果筛选。实验表明,该方法在提高防火墙效率的同时保证了其安全性。In order to deal with the security problem of complex and fast-developing network environment,this paper presents a firewall optimization scheme design based on statistical rule matching.The scheme first uses the ASBV method to filter the initial rule set with conflicts.At the same time,a rule order adjustment method based on matching time is used to prioritize the filtered rule and increase the rule matching efficiency.Then,the multi-message classification is used to process the optimized rule set and obtain the rule mapping table.By using the mapping table to match,the number of matching can be further reduced.Finally,in order to cope with the error of the matching result,the statistical information is used to filter the result.Experiments show that this method improves the efficiency of the firewall while ensuring its security.

关 键 词：防火墙 规则次序 多报文分类 统计规则匹配 

分 类 号：TN91[电子电信—通信与信息系统]