1. Georg-Christian Pranschke Supervisor: Barry Irwin Security and Networks Research Group Department of Computer Science Rhodes University AUTOMATED FIREWALL RULE SET GENERATION THROUGH PASSIVE TRAFFIC INSPECTION

2. AUTOMATED FIREWALL RULE SET GENERATION Background WiresharkTcpdump / Windump ACM Classification System (1998) C.2.0. Security and Protection Introducing firewalls into existing networks is often problematic Production traffic cannot be interrupted Necessitates time consuming manual analysis of network traffic Ever increasing traffic volumes make manual analysis less feasible

3. AUTOMATED FIREWALL RULE SET GENERATION Traffic Analyser – Flow Creation

4. AUTOMATED FIREWALL RULE SET GENERATION High Level Design Overview – System Components

5. Pipeline: bpf -> sql -> scripts -> fwbuilder

7. Charybdis screencast Scylla screencast

8. AUTOMATED FIREWALL RULE SET GENERATION Results / Critical Evaluation Misconfigured firewall provides only the illusion of network security Imperfect information -> no proof of correctness “Dancing bears” HTTP universal firewall traversal protocol -> SQLi

10. AUTOMATED FIREWALL RULE SET GENERATION Questions ?