[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-119613-en":3,"doc-seo-119613-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},119613,1099514068365,"Aurelia","https://ap-avatar.wpscdn.com/avatar/10000253d8d9f28188e?_k=1776742907772140068",8,"Research & Report","Using Machine Learning to Validate Firewall Business Rule Justifications","Energy utilities rely on firewalls within operation technology (OT) networks to control authorized remote access, yet firewall configurations can contain thousands of rules. Auditors and non-technical stakeholders need clear business-language justifications that accurately match each firewall rule’s intent. This paper investigates how machine learning can verify whether firewall business justifications are consistent, complete, and appropriately phrased. A case study using industry data applies a Random Forest model with Label Powerset and Random Oversampling to detect multiple inconsistency types in rule justifications.","Proceedings of the 59th Hawaii International Conference on System Sciences | 2026  \nUsing Machine Learning to Validate Firewall Business Rule Justifications  \nKegan Dunn Texas A&M University  [brianndunn@tamu.edu](brianndunn@tamu.edu)  \nKhandaker Akramul Haque Texas A&M University  [akramwired@tamu.edu](akramwired@tamu.edu)  \nAndy Maehl Texas A& University  [andymaehl@tamu.edu](andymaehl@tamu.edu)  \nPatrick Wlazlo Vistra Corp.  \n [patrick.wlazlo@vistracorp.com](patrick.wlazlo@vistracorp.com)  \nAna Goulart Texas A&M University  [goulart@tamu.edu](goulart@tamu.edu)  \nKatherine Davis Texas A& University  [katedavis@tamu.edu](katedavis@tamu.edu)  \nAbstract  \nMany independent power grid operators use firewalls to segment their networks, ensuring that only authorized users can remotely access/operate these critical systems. These firewalls are configured with rules to block unwanted traffic, and there may be thousands of rules in a firewall. In order for an auditor or a corporate employee to easily understand what the rule does and its purpose, these rules need to have a business justification. In this paper, we investigate how machine learning models can be used to verify whether the firewalls’ business justifications accurately reflect their corresponding firewall rules and include appropriate business language. Our case study uses industry data and Random Forest machine learning model combined with Label Powerset Random Oversampling that can identify different types of inconsistencies in a firewall rule justification.  \nKeywords: auditing for cybersecurity, firewall rule auditing, firewall business justification, machine learning  \n1. Introduction  \nCritical infrastructure systems, such as energy/water utilities, are controlled through operation technology (OT) networks. It is impossible to operate them manually. They have thousands of instruments that are remotely monitored and controlled.  \nWhile in the past they relied on proprietary technologies, many of them use off-the-shelf equipment, operating systems such as Microsoft Windows, and diverse software applications. These applications send messages over the Internet Protocol (IP) . Over the decades, as the IP protocol stack has made  \nits way into operational technology (OT) devices, it has been increasingly more difficult to ensure the Information Technology (IT) and OT environments remain separate. The difficulty in isolating OT control system networks from the Internet brings the issue of cybersecurity. A cyber threat can have serious consequences on the physical system, from loss of data to service interruption, or even endangering safety, the environment, or people’s lives.  \nCybersecurity requirements for OT systems are availability, integrity and confidentiality. Availability is the most critical as OT systems operate continuously and outages are intolerable. To ensure these cybersecurity requirements are met, OT systems are subject to regulations and must show compliance to them. For example, in the United States, energy utilities must follow the North American Energy Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) regulations. Energy utilities are regularly audited by NERC CIP officials to make sure their communication network meets their requirements, such as having a secure perimeter, as in CIP-005 .  \nFirewalls are commonly used as a security perimeter to establish a boundary between a plant’s control network and external networks. A firewall is a“middlebox”(Ndonda and Sadre (2018)) that is placed at the boundaries of networks to prevent data packets that are not supposed to be sent or received by devices in that network. These firewalls are configured with rules to prevent unwanted types of traffic. Moreover, industry firewalls typically provide application-layer filtering to prevent unauthorized remote access and sessions.  \nThe motivation for this paper is to investigate the accuracy and clarity of firewall rule justifications, so that a","cbCaiaxasCFF1SnN","https://ap.wps.com/l/cbCaiaxasCFF1SnN","pdf",3845511,1,10,"English","en",105,"# Introduction\n## Case Study - Power Generation Utility","[{\"question\":\"Why are firewall business rule justifications important for OT systems?\",\"answer\":\"They help auditors and non-operators understand what a firewall rule does and why it is needed. Clear business language improves transparency for compliance and review.\"},{\"question\":\"How does the proposed approach validate firewall rule justifications?\",\"answer\":\"It uses machine learning to check whether justifications accurately reflect the corresponding firewall rules and use appropriate business language.\"},{\"question\":\"What data and modeling technique are used in the case study?\",\"answer\":\"The case study uses industry data and a Random Forest model combined with Label Powerset and Random Oversampling to identify different inconsistency types.\"}]","Using Machine Learning to Validate Firewall Business Rule Justifications | PDF",1785725307,25,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"using-machine-learning-to-validate-firewall-business-rule-justifications","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/using-machine-learning-to-validate-firewall-business-rule-justifications/119613/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-03",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why are firewall business rule justifications important for OT systems?","Question",{"text":75,"@type":76},"They help auditors and non-operators understand what a firewall rule does and why it is needed. Clear business language improves transparency for compliance and review.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does the proposed approach validate firewall rule justifications?",{"text":80,"@type":76},"It uses machine learning to check whether justifications accurately reflect the corresponding firewall rules and use appropriate business language.",{"name":82,"@type":73,"acceptedAnswer":83},"What data and modeling technique are used in the case study?",{"text":84,"@type":76},"The case study uses industry data and a Random Forest model combined with Label Powerset and Random Oversampling to identify different inconsistency types.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,134],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":21,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":21,"slug":133},"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]