# Misconfiguration in Firewalls and Network Access Controls: Literature Review
## 4 Challenges and Research Trends  
### Stateless vs. Stateful  
The author [PERSON] was one of the first to go into this topic in depth back in the early 2000's when filtering firewalls were the norm. His work seems to be the catalyst for all of the tools that came later. Decades later, modern papers still reference his work and use the same definitions for misconfigurations, even if they are working with stateful firewalls or an IDS such as Snort. It is more difficult to find a paper that does not reference [PERSON] than it is to find one that does. The main reason for this is the fact that the foundation of anomaly detection remains the same whether the tool is stateful or stateless. Adding connection states to rules does not impact the overall definitions of each misconfiguration, it only affects the complexity of checking for them by the program or algorithm. At a base level, the misconfiguration definitions for stateless and stateful are the same because of this fact.  
Surprisingly, there is still work being done in the area of firewall misconfiguration and correction on stateless firewalls. Just to list a few, References [5; 7; 12; 40; 56; 63] all discuss detection of misconfigurations on stateless firewalls. Despite firewalls advancing to be more complex than in the days of simple filtering, the research done into stateless firewalls has not stopped. The only real changes to each new paper is the approach taken to the problem. Most of the earlier papers took simple approaches. The project by [10] that eventually lead into \"Firewall Policy Advisor\" describes a technique used to detect misconfigurations. These early papers essentially replicated the manual process a human would take evaluating these rules one by one. The papers during this time took a similar approach to [PERSON]'s tool and built up from it. The more modern papers take different approaches. Papers such as [32; 35] use algorithms that take entirely different approaches with efficiency in mind. While stateless firewall anomaly detection has waned in popularity, you can still find relatively new papers that still test on stateless firewalls. It would seem that stateless firewalls are still being tested on in order to keep the problem more simple so they can focus on creating faster algorithms.  
Stateful firewall misconfiguration checking as stated before does not have any substantial differences, even using the same definitions without adding more types of misconfigurations. Some of the papers that check stateful firewalls include [26; 27; 29; 41; 59]. The first paper listed is an extension of \"Firewall Policy Advisor\", the tool that essentially started the work in this field. The paper's main focus is updating the existing tool to work on stateful firewalls. As for the rest of the papers, they have something in common. The majority of the stateless firewall papers are on openflow SDN firewalls. Several even focus on the challenges of dealing with inter-component misconfigurations inside of an SDN. Since SDNs are not physically connected, the authors work on the methods of finding routes through the SDN and the rules on each component inside the network. The biggest contribution of these papers is how they tackle this issue in a completely different environment. Some of these tools even tackle the issue of inter-component anomalies. Part of this problem included mapping out the network by finding all hosts and potential routes to those hosts. This is important because some papers discuss the potential of bypassing a firewall in the event that there are multiple routes to a host.