CN111049801B

CN111049801B - A Firewall Policy Detection Method

Info

Publication number: CN111049801B
Application number: CN201911121211.XA
Authority: CN
Inventors: 凌子文; 刘翠媚; 陆庭辉; 吴毅良; 郭凤婵; 殷锦辉; 郝霞; 罗序良; 李文祺; 刘可欣; 尹婕
Original assignee: Guangdong Power Grid Co Ltd; Jiangmen Power Supply Bureau of Guangdong Power Grid Co Ltd
Current assignee: Guangdong Power Grid Co Ltd; Jiangmen Power Supply Bureau of Guangdong Power Grid Co Ltd
Priority date: 2019-11-15
Filing date: 2019-11-15
Publication date: 2022-02-11
Anticipated expiration: 2039-11-15
Also published as: CN111049801A

Abstract

The invention relates to the technical field of information security, in particular to a firewall policy detection method, which comprises the following steps: s10, constructing a firewall policy database and a firewall log file, and analyzing the recording and displaying modes of address book information, policy configuration information and port information of a firewall visual page; s20, extracting the IP address configured in the strategy configuration information, converting the IP address into a specific numerical value or a numerical value range, and giving an alarm when an alarm rule is met; s30, analyzing the firewall log file recording mode in the step S10, analyzing the meaning of each field storage information in the firewall log file, classifying the fields, and writing the field classification into a firewall policy database; and S40, storing the firewall policy database in the terminal for displaying and inquiring policy configuration information. The method can quickly and comprehensively acquire the firewall policy configuration information, and can realize quick query; and converting the IP address into a specific numerical value, and improving the identification speed of the computer strategy by using numerical value comparison.

Description

Firewall strategy detection method

Technical Field

The invention relates to the technical field of information security, in particular to a firewall policy detection method.

Background

Currently, information security has attracted much attention, wherein data security is a very important link in information security, and lan security mainly relies on firewalls for management and control. In recent years, one of the key points of network information security protection is access control, and a firewall does not allow redundant policy to be reserved, does not allow an excessively wide address field to be configured, does not allow an excessively wide port to be configured, and completely blocks a high-risk port. In addition, the access strategies configured in the enterprise-level firewall account for hundreds, time and labor are consumed for manually detecting and checking the configuration condition of the strategies, and the conditions of wrong checking and omission are generated, so that the network stability and the safe operation of an information system are influenced.

At present, the following problems mainly exist in firewall policy detection and problem troubleshooting: (1) network access strategies configured and used in the firewall are hundreds, most firewalls require an administrator to name a source IP address and a destination IP address before configuring the access strategies, so that once the administrator needs to query the strategies according to the IP, the strategy naming and strategy configuration pages need to be repeatedly switched, the time and energy consumption is large, the labor cost is high, and errors are easy to occur when a plurality of addresses need to be checked; (2) the firewall can count the hit times by itself when the strategy is hit, and if a certain strategy fails, the number of strategy hits is displayed as zero; according to the information security requirement, the working personnel need to restart and switch the firewall every month; after switching and restarting, the strategy hit number of the firewall is cleared; effective strategies and failure strategies cannot be distinguished, and the access strategies are related to the operation of a global production network and have great influence; (3) each piece of log information output by the firewall log has more fields, the amount of information data generated every day is huge, and the log file is in a text document format and is not beneficial to query and analysis of the firewall log.

Disclosure of Invention

The invention aims to overcome the defects of the prior art and provides a firewall policy detection method, which can quickly acquire firewall configuration data, simultaneously acquire policy information and a policy hit number, can completely export the firewall information and can realize quick detection of firewall policy configuration.

In order to solve the technical problems, the invention adopts the technical scheme that:

the firewall policy detection method comprises the following steps:

s10, constructing a firewall policy database and a firewall log file, analyzing the recording and displaying modes of address book information, policy configuration information and port information of a firewall visual page, and establishing a firewall data extraction mode;

s20, extracting the IP address configured in the strategy configuration information by using a crawler tool and the matching function of the firewall strategy database in the step S10, converting the IP address into a specific numerical value or a numerical value range, and giving an alarm when the specific numerical value or the numerical value range meets an alarm rule;

s30, analyzing the firewall log file recording mode in the step S10, analyzing the meaning of each field storage information in the firewall log file, classifying the fields, and writing the field classification into a firewall policy database;

and S40, storing the firewall policy database in the terminal for displaying and inquiring policy configuration information.

The firewall policy detection method can quickly and comprehensively acquire firewall configuration data such as policy ID, number of hits, source address name, source address IP, source port, destination address name, destination address IP, destination port and the like, is completely presented on a table after automatic matching, and can realize quick query through any information; and converting the IP address into a specific numerical value or a numerical value range, and comparing the numerical values, thereby improving the identification speed of the computer strategy.

Preferably, step S10 is performed as follows: regularly logging in a firewall by using a crawler technology to capture firewall data, wherein the firewall data comprises a strategy ID, a number of hits, a source address name, a source address IP, a source interface, a destination address name, a destination address IP and a destination port; and matching the firewall data with each other, displaying the matched firewall data on a table and exporting the matched firewall data.

Preferably, step S20 is performed as follows:

s21, extracting the IP address configured in the strategy configuration information, and judging the IP address: if the address is a single IP address, directly calculating; if the address field is the IP address field, extracting the minimum value and the maximum value in the IP address field;

s22, calculating and extracting numerical values of the IP addresses, and numbering the numerical values;

s23, summing and converting the numerical values in the step S22 to obtain an IP conversion value;

s24, traversing all IP addresses to convert the IP addresses to obtain a conversion value N, and converting the conversion values N of any two IP addresses₁、N₂Comparing, and alarming if the following rules are satisfied: when N is present₁、N₂When it is a single address, if N is satisfied₁＝N₂Then an alarm is given; when N is present₁As a single address, N₂When it is an address field, if N is satisfied_2min≤N₁≤N_2maxThen an alarm is given; when N is present₁、N₂When all are address fields, if all are satisfied

Or

An alarm is given.

Preferably, in step S22, according to the characteristics of IPV4 addresses, each IPV4 address is 4 bytes, 32-bit binary, and is divided into ". quadrature.", then IPV4 ═ is expressed as (P1.P2.P3.P4), and decimal numbers converted from 4 groups of 8-bit binary are extracted by way of de-dotting extraction, and the extracted numerical values are respectively expressed as P1, P2, P3, and P4, and 0 ≦ P1, P2, P3, and P4 ≦ 256.

Preferably, in step S22, bit number i is set for the 4 sets of values P1, P2, P3, P4 calculated in the first step, and is respectively expressed as: i (P1) is 0, i (P2) is 1, i (P3) is 2, and i (P4) is 3.

Preferably, in step S23, the values are summed and converted to obtain an IP conversion value according to the following formula: sigma N-P/256X 256^3-iN is a conversion value, P is an IP address extraction value, and i is an address extraction value number.

Preferably, step S30 is performed as follows: and importing a firewall log file, splitting log fields, and storing the log fields in a firewall policy database according to field category collection.

Preferably, the firewall log files are sorted by field using scripts.

Preferably, the field types include a value type, a character string type and a date type, and can be divided into a date field, an src field, a dst field, a Sport field and a smac field.

Preferably, in step S40, when querying the policy configuration information, the query is performed by matching keywords.

Compared with the prior art, the invention has the beneficial effects that:

the firewall policy detection method can quickly and comprehensively acquire firewall configuration data such as policy ID, number of hits, source address name, source address IP, source port, destination address name, destination address IP, destination port and the like, is completely presented on a table after automatic matching, and can realize quick query through any information; the invention converts the IP address into a special numerical value or a numerical value range, and judges the alarm condition by using numerical value comparison, thereby improving the strategy identification speed.

Drawings

FIG. 1 is a flow diagram of firewall policy capture detection;

fig. 2 is a flow chart of firewall log file query.

Detailed Description

The present invention will be further described with reference to the following embodiments.

Examples

Fig. 1 to fig. 2 show an embodiment of a firewall policy detection method according to the present invention, which includes the following steps:

s20, extracting the IP address configured in the strategy configuration information by using a crawler tool and the matching function of the firewall strategy database in the step S10, converting the IP address into a specific numerical value or a numerical value range, and giving an alarm when the specific numerical value or the numerical value range meets the alarm rule;

Wherein, step S10 is performed according to the following steps: regularly logging in a firewall by using a crawler technology to capture firewall data, wherein the firewall data comprises a strategy ID, a number of hits, a source address name, a source address IP, a source interface, a destination address name, a destination address IP and a destination port; and matching the firewall data with each other, displaying the matched firewall data on a table and exporting the matched firewall data.

Step S20 is performed as follows:

s24, traversing all IP addresses to convert the IP addresses to obtain a conversion value N, and converting the conversion values N of any two IP addresses₁、N₂And comparing, and giving an alarm if the following rules are met: when N is present₁、N₂When it is a single address, if it is satisfiedN₁＝N₂Then an alarm is given; when N is present₁As a single address, N₂When it is an address field, if N is satisfied_2min≤N₁≤N_2maxThen an alarm is given; when N is present₁、N₂When all are address fields, if all are satisfied

Or

An alarm is given.

In step S22, according to the characteristics of IPV4 addresses, each IPV4 address is 4 bytes, a 32-bit binary system is divided into "·", and IPV4 ═ is expressed as (p1.p2.p3.p4), and a decimal number converted from 4 groups of 8-bit binary systems is extracted by way of dotting extraction, and the implementation code is: the extracted values are represented as P1, P2, P3 and P4, and 0 ≦ P1, P2, P3 and P4 ≦ 256.

In step S22, digit number i is set for the 4 sets of values P1, P2, P3, and P4 calculated in the first step, and is respectively expressed as: i (P1) is 0, i (P2) is 1, i (P3) is 2, and i (P4) is 3.

In step S23, the values are summed and converted according to the following formula to obtain an IP conversion value: sigma N-P/256X 256^3-iN is a conversion value, P is an IP address extraction value, and i is an address extraction value number. The core code to implement this formula on C # is:

step S30 is performed as follows: and importing a firewall log file, splitting log fields, and storing the log fields in a firewall policy database according to field category collection. The firewall log files are classified according to fields by using scripts; the field types comprise a numerical value type, a character string type and a date type and can be divided into a date field, an src field, a dst field, a Sport field and a smac field.

In step S40, when policy configuration information is queried, a matching keyword is used for query. Those skilled in the art can develop a desktop tool based on c #/winform, and when the tool is opened on a desktop, inquiry and display of firewall information can be conveniently realized.

Through the steps, the firewall configuration data can be rapidly acquired, the strategy information and the strategy number of hits are acquired, the firewall information can be completely exported, and the firewall strategy configuration can be rapidly detected.

It should be understood that the above-described embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. Other variations and modifications will be apparent to persons skilled in the art in light of the above description. And are neither required nor exhaustive of all embodiments. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. a firewall policy detection method, is characterized in that, comprises the following steps:

S10. Build a firewall policy database and a firewall log file, analyze the address book information, policy configuration information, and the recording and display method of port information on the firewall visualization page, and establish a firewall data extraction mode;

S20. Utilize the matching function of the crawler tool and the firewall policy database described in step S10, extract the IP address configured in the policy configuration information, and convert the IP address into a unique numerical value or numerical value range, in the unique numerical value or numerical value range Alarm when the alarm rules are met;

S30. Analyze the firewall log file recording mode described in step S10, analyze the meaning of each field storage information in the firewall log file and classify, and write the field classification into the firewall policy database;

S40. Store the firewall policy database in the terminal for displaying and querying policy configuration information;

Step S20 is performed according to the following steps:

S21. Extract the IP address configured in the policy configuration information, and judge the IP address: if it is a single IP address, directly calculate; if it is an IP address segment, extract the minimum value in the IP address segment and maximum value;

S22. Calculate and extract the numerical value of the IP address, and number the numerical value;

S23. The numerical value described in the step S22 is summed and transformed to obtain the IP transformation value;

S24. Traverse all IP addresses, convert the IP addresses to obtain the conversion value N, compare the conversion values N ₁ and N ₂ of any two IP addresses, and generate an alarm if the following rules are met: when N ₁ and N ₂ are a single address , if N ₁ =N ₂ is satisfied, an alarm will be issued; when N ₁ is a single address and N ₂ is an address segment, an alarm will be issued if N _2min ≤N ₁ ≤N _2max is satisfied; when N ₁ and N ₂ are both address segments, if satisfied

or

alarm.

2. firewall policy detection method according to claim 1, is characterized in that, step S10 is carried out according to the following steps: utilize crawler technology to log in firewall regularly to grab firewall data, and described firewall data comprises policy ID, hit number, source address name , source address IP, source interface, destination address name, destination address IP and destination port; after matching the firewall data with each other, display on a table and export.

3. firewall policy detection method according to claim 1, is characterized in that, in step S22, according to the feature of IPV4 address, each IPV4 address is 4 bytes, 32-bit binary, divides with ".", then represents It is IPV4=(P1.P2.P3.P4), and 4 groups of decimal numbers converted from 8-bit binary numbers are extracted by de-point extraction. The extracted values are expressed as P1, P2, P3, P4, and 0 ≤P1, P2, P3, P4≤256.

4. firewall policy detection method according to claim 3, is characterized in that, in step S22, for the 4 groups of numerical values P1, P2, P3, P4 that the first step calculates, set the number of digits i, respectively expressed as: i (P1)=0, i(P2)=1, i(P3)=2, i(P4)=3.

5. The firewall policy detection method according to claim 4, characterized in that, in step S23, the numerical value is summed and transformed to obtain an IP transformation value according to the following formula: ∑N=P/256×256 ^3-i , N is the conversion value, P is the IP address extraction value, and i is the address extraction value number.

6. The firewall policy detection method according to any one of claims 1 to 5, wherein step S30 is carried out according to the following steps: importing a firewall log file, splitting log fields, and collecting and storing in the firewall policy database according to field categories middle.

7 . The firewall policy detection method according to claim 6 , wherein the firewall log file is classified according to fields by using a script. 8 .

8 . The firewall policy detection method according to claim 7 , wherein the field categories include numeric value categories, character string categories and date categories. 9 .

9 . The firewall policy detection method according to claim 7 , wherein in step S40 , when querying the policy configuration information, the method of matching keywords is used to query. 10 .