First step towards automatic correction of firewall policy faults

Fei Chen, Alex X. Liu, Jeehyun Hwang, Tao Xie

Research output: Contribution to journalArticle


Firewalls are critical components of network security and have been widely deployed for protecting private networks. A firewall determines whether to accept or discard a packet that passes through it based on its policy. However, most real-life firewalls have been plagued with policy faults, which either allow malicious traffic or block legitimate traffic. Due to the complexity of firewall policies, manually locating the faults of a firewall policy and further correcting them are difficult. Automatically correcting the faults of a firewall policy is an important and challenging problem. In this article, we first propose a fault model for firewall policies including five types of faults. For each type of fault, we present an automatic correction technique. Second, we propose the first systematic approach that employs these five techniques to automatically correct all or part of the misclassified packets of a faulty firewall policy. Third, we conducted extensive experiments to evaluate the effectiveness of our approach. Experimental results show that our approach is effective to correct a faulty firewall policy with three of these types of faults.

Original languageEnglish (US)
Article number27
JournalACM Transactions on Autonomous and Adaptive Systems
Issue number2
StatePublished - Jul 1 2012
Externally publishedYes


  • Automatic fault fixing
  • Firewall faults
  • Firewall policy

ASJC Scopus subject areas

  • Control and Systems Engineering
  • Computer Science (miscellaneous)
  • Software

Fingerprint Dive into the research topics of 'First step towards automatic correction of firewall policy faults'. Together they form a unique fingerprint.

  • Cite this