KR102623276B1 - Method for visualizing firewall policy and apparatus therefor - Google Patents

Abstract

A firewall policy visualization method and device are disclosed. The firewall policy visualization device loads the firewall policy applied to the network and uses a two-dimensional coordinate space with two elements of the source address, destination address, and destination port as each coordinate axis, or a three-dimensional coordinate space with the source address, destination address, and destination port as each coordinate axis. Visualize at least one firewall policy as a graph in a dimensional coordinate space, or visualize the frequency of use of the firewall policy.

Description

Method for visualizing firewall policy and apparatus therefor}

Embodiments of the present invention relate to a method and apparatus for visualizing network firewall policies.

In order to protect internal networks and key assets from external cyber attackers, companies install firewalls in the communication section of the internal network to control unauthorized access. Excessively permissive firewall policies and policies that allow services with vulnerabilities are being abused to provide attackers with an entry path into the internal system. Incorrectly set firewall policies must be continuously managed with high importance because they can be used in cyber attacks and lead to high-impact threats. However, as the amount of policies and the number of information that must be processed increase, the process becomes more complex and requires more human resources. There are limits to understanding policies at a glance from a cognitive perspective.

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predefined security rules. It is used to control access from outside or to implement network separation, and the introduction process is given high priority in most companies. As the scale of services expands and rules controlling access become more complex, multiple firewalls are distributed and deployed, and firewall policies also become more complex and diverse. As complexity increases, management difficulties also increase proportionally. As the scale of corporate services grows and the operation period prolongs, the number of firewall policies that need to be managed and unmanaged policies also increases.

Problems that may arise as unmanaged policies increase are as follows: First, it is impossible to secure visibility of vulnerable services that are permitted by firewall policy and can be exploited for cyber attacks. As the number of policies increases, the complexity of the policies also increases, making it difficult to recognize policies that should not be permitted or services with vulnerabilities. Second, it is difficult to identify interrelated services included in the firewall policy. Due to the increasing number of firewall policies, it is difficult to identify related services in the event of a firewall replacement or failure, which is an area where firewall operators experience operational difficulties. Third, firewall performance deteriorates. As the complexity of firewall policies increases and the number of policies increases, firewall performance is also affected. For companies that provide low-speed services, firewall policy management can be said to be an essential factor in firewall performance management. The number of unused or incorrectly used policies, such as unnecessary or duplicate policies, increases, putting a strain on firewall system performance. The increase in the number of firewall policy lines and the number of policies to be referenced as the firewall system operates is a major cause of deterioration in firewall performance.

The technical problem to be achieved by the present invention is to provide a method and device for visualizing firewall policies as a graph so that a plurality of firewall policies applied to a network can be intuitively understood.

An example of a firewall policy visualization method according to an embodiment of the present invention to achieve the above technical problem includes loading a firewall policy applied to a network; And visualizing at least one firewall policy as a graph in a two-dimensional coordinate space with two elements of the source address, destination address, and destination port as each coordinate axis, or a three-dimensional coordinate space with the source address, destination address, and destination port as coordinate axes. Or, it includes a step of visualizing the frequency of use of the firewall policy.

An example of a firewall policy visualization device according to an embodiment of the present invention for achieving the above technical problem includes a loading unit for loading a firewall policy applied to a network; And visualizing at least one firewall policy as a graph in a two-dimensional coordinate space with two elements of the source address, destination address, and destination port as each coordinate axis, or a three-dimensional coordinate space with the source address, destination address, and destination port as coordinate axes. Or, it includes a visualization unit that visualizes the frequency of use of the firewall policy.

According to an embodiment of the present invention, the firewall policy can be visualized so that it can be intuitively understood. As an example, the Any policy status can be checked overall through visualization to help remove unnecessary Any policies. In another embodiment, the distribution of firewall policies for a specific port or a specific source address or destination address can be checked. For example, if you want to check the details of the server that provides web services, you can check the permission status of port 80 or 443 and check the firewall of the server that provides DB services (e.g., ports 3306, 1433, 1521, etc.). It can be used to check policies. In another example, since it visually provides whether a firewall policy is used, it can help the person in charge easily check whether there is any trace of the policy being used when removing the policy.

1 is a diagram illustrating an example of a firewall policy applied to an embodiment of the present invention;
2 is a diagram illustrating the configuration of an example of a firewall policy visualization device according to an embodiment of the present invention;
3 is a diagram illustrating an example of a screen interface for visualizing an animation policy according to an embodiment of the present invention;
Figures 4 to 9 illustrate an example of a firewall policy including an ANY policy as a 3D graph;
10 is a diagram illustrating an example of a screen interface for filtering and visualizing firewall policies according to an embodiment of the present invention;
11 to 13 are diagrams illustrating an example of a firewall policy filtering result depicted in a graph;
14 is a diagram illustrating an example of a screen interface that visualizes the frequency of use of a firewall policy according to an embodiment of the present invention;
Figures 15 and 16 illustrate an example of a graph showing the frequency of use of a firewall policy;
Figure 17 is a flowchart illustrating an example of a firewall policy visualization method according to an embodiment of the present invention.

Hereinafter, a firewall policy visualization method and device according to an embodiment of the present invention will be described in detail with reference to the attached drawings.

1 is a diagram illustrating an example of a firewall policy applied to an embodiment of the present invention.

Referring to FIG. 1, the firewall policy 100 includes order, protocol, source IP (Internet Protocol) address, destination IP address, destination port, and policy contents (action). ) can be defined by elements such as. However, the firewall policy 100 shown in FIG. 1 is only an example to aid understanding, and the firewall policy may be defined in various forms and is not limited to the example in FIG. 1.

The order of the firewall policy 100 indicates the priority of the firewall, and the lower the order, the higher the priority. For example, if a firewall policy in order 1 and a firewall policy in order 2 exist, the firewall policy in order 1 takes precedence.

The policy content indicates whether the firewall policy 100 blocks (denys) or allows (allows) traffic. For example, firewall policy number 1 blocks (denies) traffic with a source address of 140.192.37.2, a destination address between 161.120.33.40 and 161.120.33.46, and a destination port of 20 among TCP (Transmission Control Protocol) protocol traffic. It's a policy.

Figure 2 is a diagram showing the configuration of an example of a firewall policy visualization device according to an embodiment of the present invention.

Referring to FIG. 2, the firewall policy visualization device 200 includes a loading unit 210 and a visualization unit 220. The firewall policy visualization device 200 of this embodiment may be implemented as a computing device (server, etc.) having a memory, a processor, and an input/output unit. In this case, each configuration may be implemented as software, mounted on the memory, and then performed by the processor. there is.

The loading unit 210 loads the firewall policy 260 applied to the network. For example, if the firewall policy 260 is stored in the network system in the form of at least one file, the loading unit 210 reads the file defining the firewall policy and stores it in memory. As another example, if a plurality of firewalls exist in the network and a plurality of data defining the firewall policy of each firewall exists, the loading unit 210 may load the firewall policy data of each firewall.

The visualization unit 220 displays the firewall policy read by the loading unit 210 in a graph form. For example, the visualization unit 220 is configured in a two-dimensional coordinate space with two elements of the source address, destination address, and destination port as respective coordinate axes, or in a three-dimensional coordinate space with the source address, destination address, and destination port as coordinate axes, respectively. At least one firewall policy can be visualized as a graph, or the frequency of use of the firewall policy can be visualized as a graph. Specifically, the visualization unit 220 may include an animation policy visualization unit 230, a filtering visualization unit 240, and a frequency visualization unit 250.

First, the Annie policy visualization unit 230 visualizes the firewall policy including the ANY policy among the firewall policies. The fact that the firewall policy is allowed as ANY means that at least one of the components of the firewall policy, the source address, destination address, and destination port, is the entire range from 0.0.0.0 to 255.255.255.255, rather than the IP specified as a host or network band. This means that it is set, or set to any port range from 0 to 65535. For example, if the source address or destination address is set to ANY in the firewall policy, the IP range assigned to the source or destination includes all IP addresses from 0.0.0.0 to 255.255.255.255. The number of cases in which the ANY policy can be used is as follows.

Policy contents Origin address destination address destination port


Allow ANY ANY ANY ANY ANY Specific ANY Specific ANY ANY Specific Specific Specific ANY ANY Specific Specific ANY Specific ANY Specific

The existence of a policy allowed as ANY means that the firewall policy is allowed for all origins, all destinations, or all ports. This can provide attackers with an entry path to internal services unknown to the administrator and expose vulnerabilities in unverified services. It is impossible for the administrator to check the traffic applied to the policy each time.

From the operator's perspective, it is not easy to manage and remove the policy allowed as ANY among firewall policies, even though it is a security threat and a major management target. This is because if service history is not managed, it is not easy to identify related services applied to ANY policy and difficult to remove. Once a policy allowed as ANY is applied to the firewall and operated, the administrator who manages the policy must check the allowed log traffic mapped to the policy ID among all traffic passing through the firewall in parallel to check the services associated with the relevant policy. do.

In general, the steps to safely remove an ANY policy once registered are as follows. First, check all traffic logs applied to the firewall's ANY policy and apply it to the firewall by additionally creating an individual firewall policy that reduces the policy specifying the source address, destination address, destination port, and policy content to each host. Second, place the individual firewall policy you created higher than the application order of the ANY policy you want to remove (i.e., set a lower priority than the ANY policy), place it at the top of the ANY policy, and check the long-term trend. Third, if there are no logs that passed using the ANY policy placed at the bottom by lowering the policy priority in this way (i.e., setting a high priority value), then it can be decided whether to remove the ANY policy. This process can take several months.

Therefore, the ANY policy visualization unit 230 of this embodiment visualizes the status of the ANY policy permission using a 3D graph in order to recognize the need for removal of the ANY policy and assist in decision-making. Specifically, the animation policy visualization unit 230 identifies a firewall policy to be visualized in which the value of at least one element of the source address, destination address, and destination port is set to the entire section, and uses the source address, destination address, and destination port as axes, respectively. The firewall policy to be visualized is displayed as a graph in a three-dimensional coordinate space. As an example, the animation policy visualization unit 230 selects at least one of the source address, destination address, and destination port as a search target, and then extracts the firewall policy in which the selected search target is set to the entire section as the visualization target firewall policy. . An example of the screen interface for the Any policy visualization unit 230 is shown in Figure 3, and various examples of visualizing the firewall policy of the Any policy allowing policy as a graph are shown in Figures 4 to 9.

The filtering visualization unit 240 identifies a firewall policy to be visualized that includes a specific value for any one element of the source address, destination address, and destination port, and identifies a specific value among the source address, destination address, and destination port of the firewall policy to be visualized. Excluding the element whose value is specified, the values of the remaining two elements are displayed in a two-dimensional coordinate space. The filtering visualization unit 240 may set the display legend of the two-dimensional coordinate space differently depending on the policy content of the firewall policy to be visualized. An example of a screen interface for the filtering visualization unit is shown in Figure 10, and various examples of visualizing the filtered firewall policy as a graph are shown in Figures 11 to 13.

The frequency visualization unit 250 determines the frequency of use of each firewall policy from the firewall system, and displays the unused firewall policy and the used firewall policy among the firewall policies separately with the identifier of the firewall policy. An example of a screen interface for the frequency visualization unit 250 is shown in FIG. 14, and various examples of visualizing the frequency of firewall policies as a graph are shown in FIGS. 15 and 16.

Figure 3 is a diagram showing an example of a screen interface for visualizing the ANY policy according to an embodiment of the present invention, and Figures 4 to 9 show an example of a firewall policy including the ANY policy as a 3D graph. It is a drawing.

Referring to FIG. 3, the screen interface for visualizing the ANY policy (300) includes a visualization area (320) that displays at least one firewall policy including the ANY policy as a graph, and a visualization area (320) that displays the contents of the firewall policy to be visualized as text. Includes a policy display area 330 to display.

In one embodiment, the screen interface 300 may further include an option selection area 310 in which the user selects a range to search for the existence of ANY policy among the source address, destination address, and destination port. For example, when the user selects a source IP in the option selection area 310, the animation policy visualization unit 230 searches for a firewall policy whose source address is set to ANY among the loaded firewall policies. As another example, when the user selects a source address and a destination address in the option selection area 310, the animation policy visualization unit 230 searches for a firewall policy in which both the source address and the destination address are set to ANY. If there is no selection in the user option selection area 310, the Annie policy visualization unit 230 searches all firewall policies in which ANY policy exists in any one of the source address, destination address, and destination port.

The graph displayed in the visualization area 320 may be a 3D graph with each element of the source address, destination address, and destination port as the coordinate axis. In this embodiment, the source address is mapped to the

The Annie policy visualization unit 230 divides and displays the hexahedron representing the entire section of the elements of the source address, destination address, and destination port into the values of each element of the source address, destination address, and destination port of the firewall policy including the ANY policy. can do. Examples of 3D graphs for each case including the ANY policy are shown in Figures 4 to 9.

ID order Origin address destination address destination port protocol Policy contents 93 23 0.0.0.0 0.0.0.0 8888,8889,9001,9002 tcp, udp allow

Table 2 is a firewall policy where both the source address and destination address are ANY policies. In this embodiment, the ANY policy is displayed as '0.0.0.0', but this is only an example. The ANY policy in the firewall policy can be defined and displayed in various ways.

The firewall policy in Table 2 is represented in a 3D graph as shown in Figure 4. Since the source address and the destination address include the entire section of the address, and only the destination port includes a specific value of a portion of the section rather than the entire section, the animation policy visualization unit 230 uses a cube in a three-dimensional coordinate space as a destination where a specific value exists. It is divided into port sections and displayed. That is, since the destination port in the firewall policy includes four specific values, the animation policy visualization unit 230 divides the cube into four sections horizontally based on the Z axis where the destination port exists to visualize the firewall policy in Table 2. do.

ID order Origin address destination address destination port protocol Policy contents 94 24 0.0.0.0 160.245.228.2 0~65535 tcp, udp allow 94 24 0.0.0.0 160.248.228.10 0~65535 tcp, udp allow

Table 3 is a firewall policy where the source address and destination port are ANY policies. In this embodiment, the ANY policy of the destination port is displayed as '0~65535', but this is only an example. In the firewall policy, the ANY policy of the destination port can be defined and displayed in various ways.

The firewall policy in Table 3 is represented in a 3D graph as shown in Figure 5. Since the source address and destination photo include the entire section, and the destination address includes specific values for some sections rather than the entire section, the animation policy visualization unit 230 vertically moves the cube based on the Y-axis where the destination address exists. The firewall policy in Table 3 can be visualized by dividing it into two sections.

ID order Origin address destination address destination port protocol Policy contents 90 20 0.0.0.0 160.248.228.50 8888 tcp, udp allow 90 20 0.0.0.0 160.248.228.51 8889 tcp, udp allow 90 20 0.0.0.0 160.248.228.52 9001 tcp, udp allow

Table 4 is a firewall policy in which only the source address is the ANY policy. The firewall policy in Table 4 is represented in a 3D graph as shown in Figure 6. Since only the source address includes the entire section, and the destination address and destination port include specific values of some sections rather than the entire section, the animation policy visualization unit 230 uses the value of the destination address on the Y-axis and the value of the destination port on the Z-axis. As a standard, the hexahedron can be divided into horizontal and vertical directions and visualized as a 3D graph.

ID order Origin address destination address destination port protocol Policy contents 92 22 120.31.140.14-17 160.248.228.6-9 0~65535 tcp allow

Table 5 is a firewall policy where only the destination port is the ANY policy. The firewall policy in Table 5 is represented in a 3D graph as shown in Figure 7. Since only the destination port includes the entire section, and the source address and destination address include specific values of some sections rather than the entire section, the animation policy visualization unit 230 uses the value of the source address on the X-axis and the value of the destination port on the Z-axis as the basis. You can divide the hexahedron horizontally and vertically and visualize it as a 3D graph.

ID order Origin address destination address destination port protocol Policy contents 95 25 120.31.140.11-13 0.0.0.0 ANY tcp, udp allow

Table 6 is a firewall policy where the destination address and destination port are ANY policies. The firewall policy in Table 6 is represented in a 3D graph as shown in Figure 8. Since the destination address and destination port include the entire section, and the source address includes specific values of some sections rather than the entire section, the animation policy visualization unit 230 vertically moves the hexahedron based on the value of the source address on the X-axis. It can be divided and visualized as a 3D graph.

ID order Origin address destination address destination port protocol Policy contents 91 21 120.131.140.13 0.0.0.0 8888,8889,9001,9002 tcp, udp allow 91 21 120.131.140.20 0.0.0.0 8888,8889,9001,9002 tcp, udp allow 91 21 120.131.140.21 0.0.0.0 8888,8889,9001,9002 tcp, udp allow

Table 7 is a firewall policy in which only the destination address is the ANY policy. The firewall policy in Table 7 is represented in a 3D graph as shown in Figure 9. Since only the destination address includes the entire section, and the source address and destination port include specific values of some sections rather than the entire section, the animation policy visualization unit creates a cube based on the value of the source address on the X-axis and the destination port on the Z-axis. It can be divided into vertical and horizontal directions and visualized as a 3D graph.

Figure 10 is a diagram showing an example of a screen interface for filtering and visualizing a firewall policy according to an embodiment of the present invention, and Figures 11 to 13 are diagrams showing an example of a graph showing the filtering results of the firewall policy. am.

Referring to FIG. 10, the screen interface 1000 for filtering and visualizing firewall policies includes a search condition area 1012 that receives filtering conditions, and a visualization area 1014 that visualizes and displays firewall policies filtered according to search conditions in a graph. ) includes. The screen interface 1000 may further include a policy display area 1040 that displays the contents of the firewall policy to be visualized filtered according to search conditions in text.

The main elements that identify a firewall policy are source address, destination address, destination port, protocol, and policy content, as shown in Figure 1. The filtering visualization unit 240 specifies the value of the source address, destination address, or destination port, extracts the firewall policy mapped to the specific value as the firewall policy to be visualized, and visualizes it in a 2D graph. For example, when filtering is performed by specifying a destination address, the filtering visualization unit 240 can visualize the firewall policy in a two-dimensional coordinate space with the source address and destination port as each axis. Filtering visualizations are useful for determining the presence of policies that allow or deny at a specific source address, a specific destination address, or a specific destination port. In particular, when visualizing the source address and destination address of a firewall policy searched with specific destination port information, it can be useful for extracting policies that allow vulnerable ports that pose threats that should not be exposed to the outside.

The screen interface 1000 of this embodiment includes a first area 1010 that displays filtered results based on the source address, a second area 1020 that displays filtered results based on the destination address, and a second area 1020 that displays filtered results based on the destination port. It includes a third area 1030 that displays the filtered results. The screen interface 1000 according to the embodiment may be modified in various ways to include at least one of the first area 1010, the second area 1020, and the third area 1030.

When displaying the filtered firewall policy in a two-dimensional coordinate space, the filtering visualization unit 240 may display different legends for cases where the policy content of the firewall policy is allow and deny. For example, if the policy content of a firewall policy is allow, it can be displayed as a white circle (or blue dot), and if it is denied, it can be displayed as a black circle (or red dot). In addition to this, various types of legends may be applied to this embodiment.

Figure 11 is an example of a graph displaying the filtered firewall policy in a two-dimensional coordinate space with the destination address and destination port as each axis when the search results for the firewall policy with the source address of 161.120.33.1 are as shown in Table 8.

FW name ID order Origin address destination address destination port protocol Policy contents FW[A] 10 10 161.120.33.1
~161.120.33.8 140.192.37.1
~140.192.37.11 21,80 tcp deny FW[A] 11 11 161.120.33.1
~161.120.33.11 140.192.37.4
~140.192.37.7 25 tcp allow

Figure 12 is an example of a graph displaying the filtered firewall policy in a two-dimensional coordinate space with the source address and destination port as each axis when the search results for the firewall policy with the destination address of 161.120.33.43 are as shown in Table 9.

FW name ID order Origin address destination address destination port protocol Policy contents FW[A] One One 140.192.37.2 161.120.33.40
~160.120.33.46 25 tcp deny FW[A] 5 5 140.192.37.3 161.120.33.43 21 tcp allow FW[A] 6 6 140.192.37.1
~140.192.37.11 161.120.33.43 21 tcp deny FW[A] 8 8 140.192.37.1
~140.192.37.16 161.120.33.43 50 tcp allow FW[A] 9 9 140.192.37.1
~140.192.37.11 161.120.33.43 54 tcp deny

Figure 13 is an example of a graph displaying the filtered firewall policy in a two-dimensional coordinate space with the source address and destination address as each axis when the results of searching for a firewall policy with a destination port of 80 are as shown in Table 10.

FW name ID order Origin address destination address destination port protocol Policy contents FW[A] 10 10 161.120.33.1
~161.120.33.8 140.192.37.1
~140.192.37.11 21,80 tcp deny FW[A] 12 12 161.120.33.5
~161.120.33.7 140.192.37.4
~140.192.37.7 21,80 tcp allow FW[A] 30 30 121.171.37.53 120.31.140.238 80,8080,443,
8009,6379 tcp allow FW[A] 30 30 60.192.135.85 120.31.140.238 80,8080,443,
8009,6379 tcp allow FW[A] 30 30 147.255.203.42 120.31.140.238 80,8080,443,
8009,6379 tcp allow FW[A] 30 32 68.73.77.253 120.31.140.238 80,8080,443,
8009,6379 tcp allow FW[A] 29 33 121.171.37.53 120.31.140.16 80,1337,8010,443 tcp allow FW[A] 29 34 60.192.135.85 120.31.140.16 80,1337,8010,443 tcp allow

Figure 14 is a diagram showing an example of a screen interface that visualizes the frequency of use of a firewall policy according to an embodiment of the present invention, and Figures 15 and 16 show an example of a graph showing the frequency of use of a firewall policy. It is a drawing.

Referring to FIG. 14, the screen interface 1400 that visualizes the frequency of use of the firewall policy includes a visualization area 1420 showing the frequency of use of the firewall policy, and a policy display area 1430 that displays the contents of the firewall policy in text. Includes. In one embodiment, the screen interface 1400 includes a display selection area 1410 for selecting a firewall policy in use and a firewall policy not in use among firewall policies.

The frequency visualization unit 250 determines the frequency of use of each firewall policy from the firewall system and displays it in a graph. The firewall system includes a function that counts the number of times the firewall policy set for each firewall is used. The frequency visualization unit 250 can determine whether the firewall policy was used during a predefined period of time through the firewall system.

The frequency visualization unit 250 can display identification information (ID) of the firewall policy and different legends to indicate whether the firewall policy is in use or not. For example, the frequency visualization unit 250 can display the firewall policy 1430 in use and the firewall policy 1440 not in use by distinguishing them by color, shape, contrast, etc.

In one embodiment, the frequency visualization unit 250 may display a plurality of firewall policies at any position on the screen. In another embodiment, the frequency visualization unit 250 may display different sizes of shapes representing each firewall policy depending on the frequency of use. For example, the more frequently used a firewall policy is, the larger the circle can be displayed. As another example, the frequency visualization unit 250 may display the frequency of use of each firewall policy in numbers.

Through the display selection area 1410 of the screen interface 1400, only unused firewall policies can be visualized and displayed (FIG. 15), or only firewall policies in use can be visualized and displayed (FIG. 16).

Through visualization through the frequency visualization unit, unused firewall policies can be identified and the policies can be removed. For example, when a user wants to identify firewall policies that allow ANY policies through the ANY policy visualization of Figures 3 to 9 and remove unnecessary ANY policies, the user can identify unused firewall policies through the frequency visualization of Figures 14 to 16. You can check if it is.

Figure 17 is a flowchart illustrating an example of a firewall policy visualization method according to an embodiment of the present invention.

Referring to FIG. 17, a firewall policy visualization device (hereinafter referred to as 'device') loads at least one firewall policy applied to the network (S1700). The device receives a selection of the firewall policy visualization method from the user (S1710).

When ANY policy visualization is selected as the visualization method (S1720), the device identifies the firewall policy to be visualized including the ANY policy and then visualizes it using the method shown in FIGS. 3 to 9. When filtering visualization is selected as the visualization method (S1730), the device filters the firewall policy according to the search conditions, selects the firewall policy to be visualized, and visualizes it using the method of FIGS. 10 to 13. If frequency visualization is selected as the visualization method (S1740), the device visualizes the frequency of use of the firewall policy using the method of FIGS. 14 to 16.

The present invention can also be implemented as computer-readable program code on a computer-readable recording medium. Computer-readable recording media include all types of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage devices. Additionally, computer-readable recording media can be distributed across networked computer systems so that computer-readable code can be stored and executed in a distributed manner.

So far, the present invention has been examined focusing on its preferred embodiments. A person skilled in the art to which the present invention pertains will understand that the present invention may be implemented in a modified form without departing from the essential characteristics of the present invention. Therefore, the disclosed embodiments should be considered from an illustrative rather than a restrictive perspective. The scope of the present invention is indicated in the claims rather than the foregoing description, and all differences within the equivalent scope should be construed as being included in the present invention.

Claims (12)

Loading a firewall policy applied to the network; and
Visualize at least one firewall policy as a graph in a two-dimensional coordinate space with two elements of the source address, destination address, and destination port as each coordinate axis, or a three-dimensional coordinate space with the source address, destination address, and destination port as coordinate axes, respectively. , visualizing the frequency of use of the firewall policy;
The visualization step is,
Determining the frequency of use of each firewall policy from the firewall system;
A firewall policy visualization method comprising the step of distinguishing and displaying an unused firewall policy and a used firewall policy among firewall policies with an identifier of the firewall policy. The method of claim 1, wherein the visualizing step includes:
Identifying a visualization target firewall policy in which the value of at least one element of the source address, destination address, and destination port is set to the entire section; and
A firewall policy visualization method comprising: displaying the firewall policy to be visualized as a graph in a three-dimensional coordinate space with the source address, destination address, and destination port as axes, respectively. The method of claim 2, wherein the step of identifying the firewall policy to be visualized includes:
Selecting at least one element of a source address, a destination address, and a destination port as a search target; and
A firewall policy visualization method comprising: extracting a firewall policy in which the search target is set to the entire section from among a plurality of firewall policies as the visualization target firewall policy. The method of claim 2, wherein the displaying step includes:
A step of dividing and displaying a cube representing the entire section of the source address, destination address, and destination port in the three-dimensional coordinate space by the values of the source address, destination address, and destination port of the firewall policy to be visualized. How to visualize firewall policies. The method of claim 1, wherein the visualizing step includes:
Identifying a firewall policy to be visualized including a specific value of any one of the source address, destination address, and destination port;
A firewall policy comprising: displaying the values of the remaining two elements, excluding the element for which the specific value is specified, among the source address, destination address, and destination port defined in the firewall policy to be visualized, in a two-dimensional coordinate space; How to visualize. The method of claim 4, wherein the displaying step includes:
A firewall policy visualization method comprising setting a display legend of the two-dimensional coordinate space differently according to policy content of the firewall policy to be visualized. delete A loading unit that loads the firewall policy applied to the network; and
Visualize at least one firewall policy as a graph in a two-dimensional coordinate space with two elements of the source address, destination address, and destination port as each coordinate axis, or a three-dimensional coordinate space with the source address, destination address, and destination port as coordinate axes, respectively. , a visualization unit that visualizes the frequency of use of the firewall policy;
The visualization unit includes a frequency visualization unit that determines the frequency of use of each firewall policy from the firewall system and displays the unused firewall policy and the used firewall policy among the firewall policies separately together with the identifier of the firewall policy. Visualizer. The method of claim 8, wherein the visualization unit,
Identify a visualization target firewall policy in which the value of at least one element of the source address, destination address, and destination port is set to the entire section, and visualize the target firewall in a three-dimensional coordinate space with the source address, destination address, and destination port as axes, respectively. A firewall policy visualization device comprising: an animation policy visualization unit that displays the policy as a graph. The method of claim 8, wherein the visualization unit,
Identify a firewall policy to be visualized that includes a specific value of any one of the source address, destination address, and destination port, and determine the element to which the specific value is specified among the source address, destination address, and destination port defined in the firewall policy to be visualized. A firewall policy visualization device comprising a filtering visualization unit that displays the values of the remaining two elements except for in a two-dimensional coordinate space. delete A computer-readable recording medium recording a computer program for performing the method according to any one of claims 1 to 6.

Images