Ant colony optimization-based firewall anomaly mitigation engine

Area of Science:

• Network Security
• Cybersecurity
• Computer Science

Background:

• Firewall rulesets are prone to anomalies like shadowing, generalization, correlation, and redundancy due to human error and multiple administrators.
• Efficient resolution of these anomalies while maintaining security policy compliance is a significant challenge.

Purpose of the Study:

• To propose an automated system for detecting and resolving anomalies in firewall rulesets.
• To ensure that the resolved or reordered rulesets conform to organizational security policies.
• To minimize manual intervention required for firewall rule management.

Main Methods:

• Development of an Ant Colony Optimization (ACO)-based firewall anomaly mitigation engine.
• Introduction of modified strategies for automatic anomaly detection.
• Implementation of an adaptive reordering strategy for efficient handling of new rules.

Main Results:

• The ACO-based engine successfully resolved a significant number of firewall rule conflicts.
• The proposed approach demonstrated minimal availability loss and marginal security risk.
• The system effectively mitigated anomalies and ensured conformance to security policies.

Conclusions:

• Ant Colony Optimization is an effective metaheuristic search technique for improving packet-filter firewall performance.
• The developed engine automates anomaly resolution and reordering, enhancing network security and policy adherence.
• The study highlights the potential of metaheuristic approaches in complex cybersecurity challenges.