Implementation of Filter Reverse Search System based on Spatial Relationships of Filters

Firewall is a useful technique that ensures network security. Firewall examines network packets and determines whether to accept or deny them based on an ordered set of filters. If anomalies, such as no packets reach to a server in a local network, which is protected by an individual firewall or by the most downstream firewall of hierarchical structure firewalls, exist in local network, an administrator wants to know which filters cause the anomalies. For this reason, it is necessary to search filters related to the server from individual or hierarchical firewalls and decide which filters are intrinsically executed to deal with packets. Since firewall policy consists of a lot of filters, and the behavior of this sequence of filters is too complicate to understand, an administrator is difficult to search some certain filters from firewall policies and decide which filters are really executed to deal with packets. In this paper, we propose a filter reverse search system to help the administrator easily search filters that satisfy some conditions and decide filters that are really executed to deal with packets, and then introduce how to implement the proposed system based on spatial relationships between filters. The main contribution of the proposed system is that it not only can search out filters from an individual or hierarchical firewalls, but also can decide which filters that are really effective to be carried out on packets especially when firewalls in hierarchical structure. We have extensively evaluated the effectiveness of the proposed system. Our experiments demonstrate that the proposed system achieves good effectiveness.