Using Machine Learning to Validate Firewall Business Rule Justifications

Many independent power grid operators use firewalls to segment their networks, ensuring that only authorized users can remotely access/operate these critical systems. These firewalls are configured with thousands of rules in a firewall. In order for an auditor or a corporate employee to easily understand what the rule does and its purpose, these rules need to have a business justification. In this paper, we investigate how machine learning models can be used to verify whether the firewalls' business justifications accurately reflect their corresponding firewall rules and include appropriate business language. Our case study uses industry data and Random Forest machine learning model combined with Label Powerset Random Oversampling that can identify different types of inconsistencies in a firewall rule justification.