CAJ | 학술논문

状态防火墙是一种新型防火墙,而传统防火墙决策图(FDD)构造算法并不适用于状态防火墙的规则集比对.本文在 FDD 基础上,提出一种状态防火墙决策图(SFDD)构造算法,将规则集转化成图形化的等价的 SFDD,用于状态防火墙规则集比对.理论分析和仿真实验结果表明,利用 SFDD 构造算法进行比对,能有效检测出规则集之间的全部不同点；当状态防火墙的状态部分规则和无状态部分规则条目数量均达到3000时,比对过程所耗费的平均时间不超过2 s.
상태방화장시일충신형방화장,이전통방화장결책도(FDD)구조산법병불괄용우상태방화장적규칙집비대.본문재 FDD 기출상,제출일충상태방화장결책도(SFDD)구조산법,장규칙집전화성도형화적등개적 SFDD,용우상태방화장규칙집비대.이론분석화방진실험결과표명,이용 SFDD 구조산법진행비대,능유효검측출규칙집지간적전부불동점；당상태방화장적상태부분규칙화무상태부분규칙조목수량균체도3000시,비대과정소모비적평균시간불초과2 s.
The stateful firewall is a new type of firewall,and the traditional firewall decision diagrams (FDD)construction algorithm does not apply to stateful firewall rule set.This paper presented a stateful firewall decision diagrams (SFDD)construction algorithm,which transforms the stateful firewall ACLs in-to equivalent stateful firewall decision diagrams,and is applied to the stateful firewall rule set comparison. Theoretical analysis and simulation results have shown that the method can effectively detect all the differ-ences between the rule sets.And when the number of rules for both the stateful and stateless section is 3000,the time cost is less than 2 s.