【摘要】 随着防火墙规则数目的增多,Diverse Firewall Design设计方法越来越受到重视。在应用该方法进行规则集设计时,多个开发团队会独立地编写若干规则集。由于规则集配置的复杂性,这些规则集有可能不一致。因此,需要使用规则集比较算法,判断这些规则集是否等价,以达到检测出错误配置的目的。然而现有规则集比较算法,实现复杂且效率较低。针对这一问题,提出了一种基于规则交集运算的规则集比较算法。该算法首先使用规则冲突消除算法对规则集进行预处理,将规则集比较问题,转换成多维空间中的图形比较问题;然后利用规则交集运算,判断图形所占区域和颜色是否一致,进而确定规则集是否等价。理论分析和测试表明,算法能检测出规则集之间的不同点,且时空效率优于现有算法。更多还原

【Abstract】 When Diverse Firewall Design was employed to configure a firewall rule set,multiple teams,who got the same requirement specification of the firewall rule set,independently configured different versions of the rule set.Therefore rule sets comparing algorithms were employed to decide whether multiple rule sets were equal or not.However,the performance of the present algorithm was not very good.A rule sets comparing algorithm based on rules intersection was proposed.First,rule conflicts resolution was employed to eliminate conflicts among rule sets.Then the problem of rule sets comparing was transformed into pictures comparing in multi-dimensional space.At last,the algorithm proposed here compared the areas and the color of pictures to decide whether the rule sets were equal or not by employing rules intersection.The results of experiments showed that the algorithm could not only find out all discrepancies among rule sets,but also has the better performance than the present algorithm.更多还原