## 3 Methodology
### Measuring Priority of Anomaly Resolution
#### 3.3.2 Measuring the Solvability of an Anomaly  
Firewall policies are systemically related to each other, and an anomaly occurs when two or more rules collide [21]. To solve the anomaly, the relationship between two or more rules must be identified and changed so as not to create a side effect. The more firewall rules \begin{table}
\begin{tabular}{c c c c} \hline
**Elements of Anomaly** & **Subject** & **Attribute** & **Score** \\ \hline \multirow{6}{*}{Causal field of anomaly} & \multirow{2}{*}{Source IP} & Non-causal field & 0 \\ \cline{3-4}  & & Causal field & 1 \\ \cline{3-4}  & & Non-causal field & 0 \\ \cline{3-4}  & & Causal field & 1 \\ \cline{3-4}  & & Causal field & 0 \\ \cline{3-4}  & & Causal field & 1 \\ \cline{3-4}  & & Causal field & 1 \\ \hline \multirow{2}{*}{Causal field of anomaly} & \multirow{2}{*}{Source port} & Non-causal field & 0 \\ \cline{3-4}  & & Causal field & 1 \\ \cline{3-4}  & & Destination port & Non-causal field & 0 \\ \cline{3-4}  & & Causal field & 1 \\ \hline \multirow{2}{*}{Whether allow or not} & \multirow{2}{*}{A rule action} & Deny & 0 \\ \cline{3-4}  & & Allow & 1 \\ \hline \multirow{2}{*}{Excessive access} & \multirow{2}{*}{A field in a rule whose action is allow} & Single & 0 \\ \cline{3-4}  & & Multiple & 1 \\ \hline \end{tabular}
\end{table} 
Table 9: Measurement score of anomaly attributes. there are, the more difficult it is to understand the relationship, and the difficulty of solving it varies depending on the type of anomaly. In this section, considering the complexity of the rule and the type of anomaly, we measure the possibility of solving the anomaly and set the priority among the anomalies. Rule complexity is calculated through the number of firewall rules, the number of objects, and the number of firewall interfaces defined by [PERSON] (2010) [PERSON] (2010). However, in this study, since the relationship between rules is checked, it is not related to the object, and since the policy within a single firewall is detected, the interface is also irrelevant. Therefore, in this study, we check how connected one rule is with the overall firewall policy. In addition, \(Complexity(r_{i})\) is sought by checking how many different types of anomalies a single rule has. \[Complexity(r_{i})=\frac{N(k)}{N(R)}\times\sum_{j=1}^{m}N(S_{ij}). \tag{7}\]  
The difficulty of solving the anomaly according to the type of anomaly is as follows. First, in the case of the redundancy anomaly \((An_{4})\), it can be easily solved because the overlapping rules, unused rules, and processing results are the same. In the case of shadowing anomaly \((An_{1})\) and generalization anomaly \((An_{3})\), since all the conditions in one rule are included in the other rule, we only need to check two rules and solve one of them, so the difficulty of solving can be considered normal. In the case of correlation anomaly \((An_{2})\), since it is an inclusive relationship for each different condition, in order to solve this anomaly, it is necessary to identify the conditions corresponding to the inclusion relationship, so it is very hard to solve. Definition 7: \(Df(T_{k})\), \(Df(T_{k})\) is the difficulty score of the solution according to the type \(k\) of anomaly. \[Df(T_{4})\;<\;Df(T_{1})\;=\;Df(T_{3})\;<\;Df(T_{2}). \tag{8}\]  
The measurement score of anomaly resolution difficulty is summarized in Table 10.  
\(Difficulty(r_{i})\) is the difficulty score \(Df(T_{k})\) in all anomaly types associated with \(r_{i}\) multiplied by the number of that type. \[Difficulty(r_{i})\;=\sum_{k=1}^{4}Df(T_{k})\times N(T_{k}). \tag{9}\]  
\(Solvability(r_{i})\) is a scale to measure the possibility of solving an anomaly when an anomaly occurs. As the value of both \(Complexity(r_{i})\) and \(Difficulty(r_{i})\) increases, the possibility of solving the anomaly decreases, so \(Solvability(r_{i})\) is a reverse of the multiplication of \(Complexity(r_{i})\) and \(Difficulty(r_{i})\).