Firewall Design And Analysis

by Alex X Liu

Overview

This unique book represents the first rigorous and comprehensive study of firewall policy design and analysis. Firewalls are the most critical and widely deployed intrusion prevention systems. Designing new firewall policies and analyzing existing firewall policies have been difficult and error-prone. This book presents scientifically sound and practically useful methods for designing and analyzing firewall policies.This book is useful to a variety of readers. First, it can be used as a handbook for network/firewall administrators and network security professionals. Second, it can be used as an advanced textbook for graduate students and senior undergraduate students in computer science and engineering. Third, it is also suitable for non-experts in network security who wish to understand more about firewalls. The presentation of the book is detailed enough to capture the interest of curious readers, and complete enough to provide the necessary background material needed to delve further into the subject of firewalls and network security.

Product Details

ISBN-13:	9789814261654
Publisher:	World Scientific Publishing Company, Incorporated
Publication date:	12/16/2010
Series:	Computer And Network Security , #4
Pages:	124
Product dimensions:	6.20(w) x 9.00(h) x 0.50(d)

Table of Contents

Preface vii

1 Prologue 1

1.1 Background and Motivation 1

1.2 Previous Work 3

1.2.1 Previous Work on Firewall Design 3

1.2.2 Previous Work on Firewall Analysis 4

1.3 Contributions of the Book 5

1.3.1 Structured Firewall Design 5

1.3.2 Diverse Firewall Design 6

1.3.3 Stateful Firewall Model 6

1.3.4 Firewall Queries 7

1.3.5 Firewall Redundancy Detection 8

1.4 Overview of the Book 8

2 Structured Firewall Design 9

2.1 Motivation 9

2.1.1 Consistency, Completeness and Compactness 9

2.1.2 Structured Firewall Design 12

2.2 Firewall Decision Diagrams 13

2.3 FDD Reduction 17

2.4 FDD Marking 18

2.5 Firewall Generation 21

2.6 Firewall Compaction 23

2.7 Firewall Simplification 26

2.8 Summary of Structured Firewall Design 28

3 Diverse Firewall Design 31

3.1 Construction Algorithm 35

3.2 Shaping Algorithm 37

3.2.1 FDD Simplifying 39

3.2.2 Node Shaping 39

3.2.3 FDD Shaping 43

3.3 Comparison Algorithm 44

3.4 Experimental Results 45

4 Stateful Firewall Model 49

4.1 Firewall Model 51

4.2 Firewall Examples 56

4.2.1 Example I: Tracking Outgoing Packets 56

4.2.2 Example II: Tracking FTP Ptotocol 57

4.3 Removing Packets from Firewall State 60

4.4 Firewall States 62

4.4.1 Truly Stateful and Truly Stateless Firewalls 63

4.4.2 Stateless Derivatives 64

4.5 Firewall Properties 65

4.5.1 Conforming Firewalls 65

4.5.2 Proper Firewalls 66

5 Firewall Queries 69

5.1 Structured Firewall Query Language 72

5.1.1 Firewalls 72

5.1.2 Query Language 73

5.2 Firewall Query Examples 74

5.3 Firewall Query Processing 77

5.4 FDT-based Firewall Query Processing Algorithm 79

5.5 Experimental Results 80

6 Firewall Redundancy Detection 83

6.1 Firewall Redundant Rules 86

6.2 Removing Upward Redundancy 88

6.3 Removing Downward Redundancy 94

6.4 Experimental Results 98

7 Epilogue 101

7.1 Conclusions 101

Acknowledgments 103

Bibliography 105

Index 109