Adaptive Statistical Optimization Techniques for Firewall Packet Filtering
Adaptive Statistical Optimization Techniques for Firewall Packet Filtering
复制标题
防火墙包过滤的自适应统计优化技术
DOI：
--
复制
发表时间：
2006
期刊：
影响因子：
--
通讯作者：
E. Al
中科院分区：
文献类型：
--
作者：
H. Hamed;A. El;E. Al
数据包过滤对于防火墙、IPSec 网关、DiffServ 和 QoS 路由器等许多网络设备的性能起着至关重要的作用。人们提出了大量的研究来优化数据包过滤器。然而，大多数相关工作都使用确定性技术，并且在其优化方案中没有利用流量特征。此外，大多数数据包分类器没有具体考虑优化数据包拒绝，这对于防火墙等许多过滤设备很重要。我们在本文中的贡献是双重的。首先，我们提出了一种新颖的算法，可以最大限度地早期拒绝不需要的流，而不会显着影响其他流。其次，我们提出了一种新的数据包过滤优化技术，该技术使用自适应统计搜索树来利用重要的流量特征并最小化平均数据包匹配时间。所提出的技术通过执行简单的计算来优化搜索数据结构，及时适应交通状况的变化。我们的技术实际上很有吸引力，因为它们展示了易于实现和易于部署的算法。我们使用互联网跟踪进行的广泛评估研究表明，所提出的技术可以在合理的内存空间要求下显着缩短数据包过滤时间。
Packet filtering plays a critical role in the performance of many network devices such as firewalls, IPSec gateways, DiffServ and QoS routers. A tremendous amount of research was proposed to optimize packet filters. However, most of the related works use deterministic techniques and do not exploit the traffic characteristics in their optimization schemes. In addition, most packet classifiers give no specific consideration for optimizing packet rejection, which is important for many filtering devices like firewalls. Our contribution in this paper is twofold. First, we present a novel algorithm for maximizing early rejection of unwanted flows without impacting other flows significantly. Second, we present a new packet filtering optimization technique that uses adaptive statistical search trees to utilize important traffic characteristics and minimize the average packet matching time. The proposed techniques timely adapt to changes in the traffic conditions by performing simple calculations for optimizing the search data structure. Our techniques are practically attractive because they exhibit simple-to-implement and easy-to-deploy algorithms. Our extensive evaluation study using Internet traces shows that the proposed techniques can significantly minimize the packet filtering time with reasonable memory space requirements.