## 3 Methodology
### Measuring Priority of Anomaly Resolution
#### 3.3.1 Measuring Risk of Anomaly  
In this section, we will define score metrics to measure the potential risk caused by the existence of anomalies in the firewall policy and present a method for quantitatively measuring the potential risk. The potential risk of rule refers to the cause of the anomaly. An anomaly occurs when two rules collide, so to find the potential risk due to the presence of an anomaly, you must measure the potential risk of each rule associated with the anomaly. Thus, we define anomaly risk as the sum of the potential risks of rules associated with an anomaly. The score metrics for each rule include a causal field of anomaly, whether allowed or not, and excessive access. First, the causal field of anomaly was selected as an indicator because the more fields that cause anomalies among policy fields, the more dangerous it can be. As for the measurement method, one point is given to each field that causes an anomaly among the source IP, destination IP, source port, and destination port. Next, whether allow or not was selected as an indicator matters, because it can be said to be potentially more dangerous than when the access control of the rule is \"allow\" compared to \"deny\". As for the measurement method, 1 point is given if the access permission of the rule is \"allow\", and 0 points are given if the access permission is \"deny\". Lastly, excessive access was selected as an indicator because the potential risk is higher for rules that allow access to multiple IPs among the rules classified as anomalies. As for the measurement method, 1 point is given if the source IP, destination IP, source port, and destination port fields have multiple values among rules in which access is allowed or not is \"allow\", and 0 points are given if they have a single value. The measurement scores of anomaly attributes are summarized in Table 9. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**No** & **Source IP** & **Destination IP** & **Source Port** & **Destination Port** & **Action** & **Rule Comment** \\ \hline
1 & 192.168.0 * & 20.198.162 * & 80 & 443 & Allow & Allow for Users \\ \hline
2 & 192.168.0.32 & 20.198.162 * & any & any & Allow & \\ \hline
3 & 192.168.0.2 & 20.198.162 * & any & any & Allow & Allow for Firewall Manager \\ \hline
4 & 10.20.10.1 & Any & any & any & Deny & Deny harmful IPs \\ \hline
5 & Any & Any & 80 & 135, 445 & Deny & Deny NetBIOS port \\ \hline \hline \end{tabular} Note : * ranges from 1 to 255.  
\end{table} 
Table 7: Example of exceptional rules including rule comments. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Classification Criteria** & **Exceptional Allowance Rule** & **Exceptional Denial Rule** \\ \hline Word & “Allow” & “Deny” \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Classification criteria for exceptional rules. **Definition 1**. : \(r_{i}\)_, \(r_{j}\), \(r_{i}\) and \(r_{j}\) are the \(i\)th and \(j\)th rules. \(N(R)\) denotes the number of the firewall policy._  
\[0<i\text{, }j\leq N(R) \tag{1}\]  
**Definition 2**. : \(S_{ij}\)_, The anomaly occurs when \(r_{i}\) and \(r_{j}\) collide. \(S_{ij}\) is the combination of \(r_{i}\) and \(r_{j}\) that causes an anomaly. \(N(S_{ij})\) denotes the number of combinations of \(S_{ij}\)._  
\[S_{ij}=\{(r_{i}\text{, }r_{j})\mid i=1,\cdots,n\text{, }j=1,\cdots,m\},\quad(i \
eq j). \tag{2}\]  
**Definition 3**. : \(T_{k}\)_, \(T_{k}\) is an anomaly type of \(S_{ij}\). The anomaly type is one of shadowing (\(An_{1}\)), correlation (\(An_{2}\)), generalization (\(An_{3}\)), and redundancy (\(An_{4}\)). \(N(T_{k})\) denotes the number of anomalies of type \(k\). \(k\) and N(\(k\)) denote the anomaly type number and the number of types of anomaly, respectively._  
\[T_{k}=\{An_{k}\mid k\in(1,2,3,4)\}. \tag{3}\]  
**Definition 4**. : \(g(r_{i})\) _is a function that measures the anomaly risk of \(r_{i}\).