{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,18]],"date-time":"2026-04-18T05:59:10Z","timestamp":1776491950965,"version":"3.51.2"},"reference-count":24,"publisher":"MDPI AG","issue":"12","license":[{"start":{"date-parts":[[2022,12,16]],"date-time":"2022-12-16T00:00:00Z","timestamp":1671148800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Natural Science Foundation of China","award":["61872090"],"award-info":[{"award-number":["61872090"]}]},{"name":"National Natural Science Foundation of China","award":["2019H0010"],"award-info":[{"award-number":["2019H0010"]}]},{"name":"National Natural Science Foundation of China","award":["FJ-ICH201901"],"award-info":[{"award-number":["FJ-ICH201901"]}]},{"name":"Fujian Provincial Science and Technology Guidance Project","award":["61872090"],"award-info":[{"award-number":["61872090"]}]},{"name":"Fujian Provincial Science and Technology Guidance Project","award":["2019H0010"],"award-info":[{"award-number":["2019H0010"]}]},{"name":"Fujian Provincial Science and Technology Guidance Project","award":["FJ-ICH201901"],"award-info":[{"award-number":["FJ-ICH201901"]}]},{"name":"Open Fund of Fujian Provincial University Engineering Research Center","award":["61872090"],"award-info":[{"award-number":["61872090"]}]},{"name":"Open Fund of Fujian Provincial University Engineering Research Center","award":["2019H0010"],"award-info":[{"award-number":["2019H0010"]}]},{"name":"Open Fund of Fujian Provincial University Engineering Research Center","award":["FJ-ICH201901"],"award-info":[{"award-number":["FJ-ICH201901"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>To solve the problems regarding how to detect anomalous rules with an asymmetric structure, which leads to the firewall not being able to control the packets in and out according to the administrator\u2019s idea, and how to carry out an incremental detection efficiently when the new rules are added, anomaly detection algorithms based on an asymmetric double decision tree were considered. We considered the packet filter, the most common and used type of First Matching Rule, for the practical decision space of each rule and the whole policy. We adopted, based on the asymmetric double decision tree detection model, the policy equivalent decision tree and the policy decision tree of anomalies. Therefore, we can separate the policy\u2019s effective decision space and the anomalous decision space. Using the separated decision trees can realize the optimization of the original policy and the faster incremental detection when adding new rules and generating a detailed report. The simulation results demonstrate that the proposed algorithms are superior to the other decision tree algorithms in detection speed and can achieve incremental detection. The results demonstrate that our approach can save about 33% of the time for complete detection compared with the other approaches, and the time of incremental anomaly detection compared to complete detection is about 90% of the time saved in a complex policy.<\/jats:p>","DOI":"10.3390\/sym14122668","type":"journal-article","created":{"date-parts":[[2022,12,19]],"date-time":"2022-12-19T06:58:29Z","timestamp":1671433109000},"page":"2668","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["Firewall Anomaly Detection Based on Double Decision Tree"],"prefix":"10.3390","volume":"14","author":[{"given":"Zhiming","family":"Lin","sequence":"first","affiliation":[{"name":"College of Computer and Cyber Security, Fujian Normal University, Fuzhou 350100, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhiqiang","family":"Yao","sequence":"additional","affiliation":[{"name":"College of Computer and Cyber Security, Fujian Normal University, Fuzhou 350100, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2022,12,16]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1417","DOI":"10.1109\/TNET.2019.2920718","article-title":"Tuplemerge: Fast software packet processing for online packet classification","volume":"27","author":"Daly","year":"2019","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"1699","DOI":"10.1109\/TIFS.2017.2668602","article-title":"Firewall fingerprinting and denial of firewalling attacks","volume":"12","author":"Liu","year":"2017","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"9","DOI":"10.1016\/S1353-4858(20)30079-9","article-title":"The 2020 Data Breach Investigations Report\u2014A CSO\u2019s perspective","volume":"2020","author":"Jartelius","year":"2020","journal-title":"Netw. Secur."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Clincy, V., and Shahriar, H. (2018, January 23\u201327). Web Application Firewall: Network Security Models and Configuration. Proceedings of the 2018 IEEE 42nd Annual Computer Software and Applications Conference (COMPSAC), Tokyo, Japan.","DOI":"10.1109\/COMPSAC.2018.00144"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1080\/13614576.2019.1611468","article-title":"Distributed denial of service attacks: A threat or challenge","volume":"24","author":"Bhandari","year":"2019","journal-title":"New Rev. Inf. Netw."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"57","DOI":"10.1007\/s00779-019-01308-y","article-title":"Cultural communication in double-layer coupling social network based on association rules in big data","volume":"24","author":"Xu","year":"2020","journal-title":"Pers. Ubiquitous Comput."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Hande, Y., and Muddana, A. (2021). A Survey on Intrusion Detection System for Software Defined Networks (SDN). Research Anthology on Artificial Intelligence Applications in Security, IGI Global.","DOI":"10.4018\/978-1-7998-7705-9.ch023"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"2069","DOI":"10.1109\/JSAC.2005.854119","article-title":"Conflict classification and analysis of distributed firewall policies","volume":"23","author":"Hamed","year":"2005","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"318","DOI":"10.1109\/TDSC.2012.20","article-title":"Detecting and resolving firewall policy anomalies","volume":"9","author":"Hu","year":"2012","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"181","DOI":"10.1016\/j.jocs.2017.09.003","article-title":"FARE: FDD-based firewall anomalies resolution tool","volume":"23","author":"Bouhoula","year":"2017","journal-title":"J. Comput. Sci."},{"key":"ref_11","first-page":"949","article-title":"A Novel Mechanism for Anomaly Removal of Firewall Filtering Rules","volume":"21","author":"Chao","year":"2020","journal-title":"J. Internet Technol."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"103087","DOI":"10.1016\/j.micpro.2020.103087","article-title":"Application of evolutionary algorithm in performance optimization of embedded network firewall","volume":"76","author":"Lu","year":"2020","journal-title":"Microprocess. Microsyst."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"293","DOI":"10.1177\/1748301818791503","article-title":"Cyber anomaly detection: Using tabulated vectors and embedded analytics for efficient data mining","volume":"12","author":"Gutierrez","year":"2018","journal-title":"J. Algorithms Comput. Technol."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Yin, Y., Tateiwa, Y., Wang, Y., Zhang, G., Takahashi, N., and Zhang, C. (2019, January 10\u201312). An Analysis Method for IPv6 Firewall Policy. Proceedings of the 2019 IEEE 21st International Conference on High Performance Computing and Communications; IEEE 17th International Conference on Smart City; IEEE 5th International Conference on Data Science and Systems (HPCC\/SmartCity\/DSS), Zhangjiajie, China.","DOI":"10.1109\/HPCC\/SmartCity\/DSS.2019.00241"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"1729","DOI":"10.1109\/TNSM.2021.3130290","article-title":"Continuous Verification of Network Security Compliance","volume":"19","author":"Lorenz","year":"2021","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Kim, H., Ko, S., Kim, D.S., and Kim, H.K. (2017, January 2). Firewall Ruleset Visualization Analysis Tool Based on Segmentation. Proceedings of the 2017 IEEE Symposium on Visualization for Cyber Security (VizSec), Phoenix, AZ, USA.","DOI":"10.1109\/VIZSEC.2017.8062196"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"71737","DOI":"10.1109\/ACCESS.2021.3077146","article-title":"HSViz: Hierarchy Simplified Visualizations for Firewall Policy Analysis","volume":"9","author":"Lee","year":"2021","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"2891","DOI":"10.1007\/s11277-017-4330-0","article-title":"The analysis of firewall policy through machine learning and data mining","volume":"96","author":"Ucar","year":"2017","journal-title":"Wirel. Pers. Commun."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"497","DOI":"10.1007\/s11277-015-3128-1","article-title":"A dynamic rule creation based anomaly detection method for identifying security breaches in log records","volume":"94","author":"Breier","year":"2017","journal-title":"Wirel. Pers. Commun."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Vartouni, A.M., Kashi, S.S., and Teshnehlab, M. (March, January 28). An anomaly detection method to detect web attacks using Stacked Auto-Encoder. Proceedings of the 2018 6th Iranian Joint Congress on Fuzzy and Intelligent Systems, CFIS, Kerman, Iran.","DOI":"10.1109\/CFIS.2018.8336654"},{"key":"ref_21","unstructured":"Funk, R., Epp, N., and Cappo, C. (2018). Anomaly-based Web Application Firewall using HTTP-specific features and One-Class SVM. Rev. Eletr\u00f4nica Argent.-Bras. Tecnol. Inf. Comun."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"352","DOI":"10.1049\/iet-ifs.2018.5404","article-title":"Leveraging deep neural networks for anomaly-based web application firewall","volume":"13","author":"Teshnehlab","year":"2019","journal-title":"IET Inf. Secur."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"339","DOI":"10.1109\/TR.2021.3089511","article-title":"A Firewall Policy Anomaly Detection Framework for Reliable Network Security","volume":"71","author":"Togay","year":"2022","journal-title":"IEEE Trans. Reliab."},{"key":"ref_24","first-page":"22","article-title":"An Optimized Firewall Anomaly Resolution","volume":"10","author":"Valenza","year":"2020","journal-title":"J. Internet Serv. Inf. Secur."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/14\/12\/2668\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:42:38Z","timestamp":1760146958000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/14\/12\/2668"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,16]]},"references-count":24,"journal-issue":{"issue":"12","published-online":{"date-parts":[[2022,12]]}},"alternative-id":["sym14122668"],"URL":"https:\/\/doi.org\/10.3390\/sym14122668","relation":{},"ISSN":["2073-8994"],"issn-type":[{"value":"2073-8994","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12,16]]}}}