Systematic structural testing of firewall policies

Jeehyun Hwang, Tao Xie, Fei Chen, Alex X. Liu

Research output: Chapter in Book/Report/Conference proceedingConference contribution


Firewalls are the mainstay of enterprise security and the most widely adopted technology for protecting private networks. As the quality of protection provided by a firewall directly depends on the quality of its policy (i.e., configuration), ensuring the correctness of firewall policies is important and yet difficult. To help ensure the correctness of a firewall policy, we propose a systematic structural testing approach for firewall policies. We define structural coverage (based on coverage criteria of rules, predicates, and clauses) on the policy under test. To achieve high structural coverage effectively, we have developed three automated packet generation techniques: the random packet generation, the one based on local constraint solving (considering individual rules locally in a policy), and the most sophisticated one based on global constraint solving (considering multiple rules globally in a policy). We have conducted an experiment on a set of real policies and a set of faulty policies to detect faults with generated packet sets. Generally, our experimental results show that a packet set with higher structural coverage has higher fault-detection capability (i.e., detecting more injected faults). Our experimental results show that a reduced packet set (maintaining the same level of structural coverage with the corresponding original packet set) maintains similar fault-detection capability with the original set.

Original languageEnglish (US)
Title of host publicationProceedings of the 27th IEEE International Symposium on Reliable Distributed Systems, SRDS 2008
Number of pages10
StatePublished - 2008
Externally publishedYes
Event27th IEEE International Symposium on Reliable Distributed Systems, SRDS 2008 - Napoli, Italy
Duration: Oct 6 2008Oct 8 2008

Publication series

NameProceedings of the IEEE Symposium on Reliable Distributed Systems
ISSN (Print)1060-9857


Other27th IEEE International Symposium on Reliable Distributed Systems, SRDS 2008

ASJC Scopus subject areas

  • Software
  • Theoretical Computer Science
  • Hardware and Architecture
  • Computer Networks and Communications


Dive into the research topics of 'Systematic structural testing of firewall policies'. Together they form a unique fingerprint.

Cite this