# US 2014/0157356 A1 · Firewall policy inspection apparatus and method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157356 A1 - Document ID: US20140157356A1 - Status: Published application - Kind: A1 - Application number: 13/946,852 - Filed: 2013-07-19 - Published: 2014-06-05 - Earliest claimed: 2012-11-30 - Assignees: Electronics and Telecommunications Research Institute - Applicants: Electronics and Telecommunications Research Institute - Inventors: Jae-Sung LEE; Jung-Min KANG; Byung-Chul BAE - Web page: https://patentgrep.com/patent/US20140157356A1 ## CPC - H04L 63/0263: {Rule management} - H04L 63/1433: {Vulnerability analysis} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A firewall policy inspection apparatus and method is provided. The firewall policy inspection apparatus includes an intrusion prevention rule obtainment unit for obtaining intrusion prevention rules from a target firewall policy. An anomaly rule detection unit detects an anomaly rule in a relationship between the intrusion prevention rules. A screen display unit displays an anomaly rule graph on a screen using results of the detection. ## Claims ### Claim 1 A firewall policy inspection apparatus comprising: an intrusion prevention rule obtainment unit for obtaining intrusion prevention rules from a target firewall policy; an anomaly rule detection unit for detecting an anomaly rule in a relationship between the intrusion prevention rules; and a screen display unit for displaying an anomaly rule graph on a screen using results of the detection. ### Claim 2 (depends on 1) The firewall policy inspection apparatus of claim 1, wherein the intrusion prevention rule obtainment unit obtains a protocol, a source Internet Protocol (IP) address, a source port, a destination IP address, a destination port, a policy action, and a rule sequence that are components of the intrusion prevention rules. ### Claim 3 (depends on 2) The firewall policy inspection apparatus of claim 2, wherein the anomaly rule detection unit detects any one of a shadowing anomaly, a redundancy anomaly, a correlation anomaly, and a generalization anomaly in the relationship between the intrusion prevention rules. ### Claim 4 (depends on 3) The firewall policy inspection apparatus of claim 3, wherein the screen display unit is configured to, if the anomaly rule is detected in a relationship between a first intrusion prevention rule and a second intrusion prevention rule, display an anomaly rule graph in which a number of the first intrusion prevention rule, the detected anomaly rule, and a number of the second intrusion prevention rule are sequentially connected. ### Claim 5 (depends on 4) The firewall policy inspection apparatus of claim 4, wherein the screen display unit further displays an intrusion prevention rule graph in which the source IP address, the destination port, and the destination IP address are sequentially connected. ### Claim 6 (depends on 5) The firewall policy inspection apparatus of claim 5, wherein the screen display unit is configured to when displaying the number of the first intrusion prevention rule, the number of the second intrusion prevention rule, the anomaly rule, the source IP address, the destination IP address, and the destination port in a form of graphs, indicate components of the graphs in shapes of figures preset depending on the components. ### Claim 7 (depends on 6) The firewall policy inspection apparatus of claim 6, wherein the screen display unit is configured to: when displaying the number of the first intrusion prevention rule, the number of the second intrusion prevention rule, the source IP address, and the desti nation IP address in a form of graphs, indicate components of the graphs in colors of figures preset depending on a level of importance, and when displaying the anomaly rule and the destination port in a form of graphs, indicate components of the graphs in colors of figures preset depending on one or more of a level of importance and a level of risk. ### Claim 8 (depends on 7) The firewall policy inspection apparatus of claim 7, wherein the screen display unit is configured to, if a user input for selecting a graph node corresponding to any one of the number of the first intrusion prevention rule, the number of the second intrusion prevention rule, the anomaly rule, the source IP address, the destination IP address, and the destination port is received, update the screen in correspondence with the selected graph node. ### Claim 9 (depends on 8) The firewall policy inspection apparatus of claim 8, wherein the screen display unit is configured to, if a user input for selecting the destination IP address is received, update the screen to an intrusion prevention rule graph in which the selected destination IP address is used as a source IP. ### Claim 10 (depends on 9) The firewall policy inspection apparatus of claim 9, wherein the screen display unit is configured to, if a user input for selecting the anomaly rule is received, update the screen to an anomaly rule graph including intrusion prevention rules in which the selected anomaly rule is detected. ### Claim 11 A firewall policy inspection method comprising: obtaining intrusion prevention rules from a target firewall policy; detecting an anomaly rule in a relationship between the intrusion prevention rules; and displaying an anomaly rule graph on a screen using results of the detection. ### Claim 12 (depends on 11) The firewall policy inspection method of claim 11, wherein obtaining the intrusion prevention rules is configured to obtain a protocol, a source Internet Protocol (IP) address, a source port, a destination IP address, a destination port, a policy action, and a rule sequence that are components of the intrusion prevention rules. ### Claim 13 (depends on 12) The firewall policy inspection method of claim 12, wherein detecting the anomaly rule is configured to detect any one of a shadowing anomaly, a redundancy anomaly, a correlation anomaly, and a generalization anomaly in the relationship between the intrusion prevention rules. ### Claim 14 (depends on 13) The firewall policy inspection method of claim 13, wherein displaying on the screen is configured to, if the anomaly rule is detected in a relationship between a first intrusion prevention rule and a second intrusion prevention rule, display an anomaly rule graph in which a number of the first intrusion prevention rule, the detected anomaly rule, and a number of the second intrusion prevention rule are sequentially connected. ### Claim 15 (depends on 14) The firewall policy inspection method of claim 14, wherein displaying on the screen is configured to further display an intrusion prevention rule graph in which the source IP address, the destination port, and the destination IP address are sequentially connected. ### Claim 16 (depends on 15) The firewall policy inspection method of claim 15, wherein displaying on the screen is configured to, when displaying the number of the first intrusion prevention rule, the number of the second intrusion prevention rule, the anomaly rule, the source IP address, the destination IP address, and the destination port in a form of graphs, indicate components of the graphs in shapes of figures preset depending on the components. ### Claim 17 (depends on 16) The firewall policy inspection method of claim 16, wherein displaying on the screen is configured to: when displaying the number of the first intrusion prevention rule, the number of the second intrusion prevention rule, the source IP address, and the destination IP address in a form of graphs, indicate components of the graphs in colors of figures preset depending on a level of importance, and when displaying the anomaly rule and the destination port in a form of graphs, indicate components of the graphs in colors of figures preset depending on one or more of a level of importance and a level of risk. ### Claim 18 (depends on 17) The firewall policy inspection method of claim 17, wherein displaying on the screen is configured to, if a user input for selecting a graph node corresponding to any one of the number of the first intrusion prevention rule, the number of the second intrusion prevention rule, the anomaly rule, the source IP address, the destination IP address, and the destination port is received, update the screen in correspondence with the selected graph node. ### Claim 19 (depends on 18) The firewall policy inspection method of claim 18, wherein displaying on the screen is configured to, if a user input for selecting the destination IP address is received, update the screen to an intrusion prevention rule graph in which the selected destination IP address is used as a source IP address. ### Claim 20 (depends on 19) The firewall policy inspection method of claim 19, wherein displaying on the screen is configured to, if a user input for selecting the anomaly rule is received, update the screen to an anomaly rule graph including intrusion prevention rules in which the selected anomaly rule is detected.