FIREMAN: a toolkit for firewall modeling and analysis
Citations Over TimeTop 1% of 2006 papers
Abstract
Security concerns are becoming increasingly critical in networked systems. Firewalls provide important defense for network security. However, misconfigurations in firewalls are very common and significantly weaken the desired security. This paper introduces FIREMAN, a static analysis toolkit for firewall modeling and analysis. By treating firewall configurations as specialized programs, FIREMAN applies static analysis techniques to check misconfigurations, such as policy violations, inconsistencies, and inefficiencies, in individual firewalls as well as among distributed firewalls. FIREMAN performs symbolic model checking of the firewall configurations for all possible IP packets and along all possible data paths. It is both sound and complete because of the finite state nature of firewall configurations. FIREMAN is implemented by modeling firewall rules using binary decision diagrams (BDDs), which have been used successfully in hardware verification and model checking. We have experimented with FIREMAN and used it to uncover several real misconfigurations in enterprise networks, some of which have been subsequently confirmed and corrected by the administrators of these networks.
Related Papers
- → Firewalls: Basic Principles and Some Implications(2009)1 cited
- → Meta-firewall: A sixth generation firewall — Part 2(1998)
- Network Security: A Research on the Technology of Firewall(2003)
- → Meta-firewall: A sixth generation firewall — Part 1(1998)
- → Enhanced Internet firewall design using stateful filters final report(1997)