Firewall Compressor: An Algorithm for Minimizing Firewall Policies
Firewall Compressor: An Algorithm for Minimizing Firewall Policies
复制标题
DOI：
10.1109/infocom.2008.44
复制
发表时间：
2008-04
期刊：
影响因子：
--
通讯作者：
A. Liu;E. Torng;C. Meiners
中科院分区：
文献类型：
--
作者：
A. Liu;E. Torng;C. Meiners
防火墙是放置在专用网络和外部互联网之间的安全卫士，用于监视所有传入和传出的数据包。防火墙的功能是检查每个数据包，并根据防火墙的策略决定是否接受或丢弃它。该策略被指定为一系列（可能相互冲突的）规则。当数据包到达防火墙时，防火墙会搜索该数据包匹配的第一条规则，并执行该规则的决策。随着基于互联网的应用和恶意攻击的爆炸式增长，防火墙中的规则数量迅速增加，从而降低了网络性能和吞吐量。在本文中，我们提出了 Firewall Compressor，这是一个可以显着减少防火墙中规则数量的框架，同时保持防火墙的语义不变。我们在本文中做出了三项主要贡献。首先，我们提出使用动态规划技术来压缩一维防火墙的最佳解决方案。其次，我们提出了一种压缩多维防火墙的系统方法。最后，我们进行了广泛的实验来评估防火墙压缩机。在有效性方面，Firewall Compressor 对现实规则集的平均压缩率为 52.3%。在效率方面，即使对于具有数千条规则的大型防火墙，Firewall Compressor 也可以在几秒钟内运行。此外，本文提出的算法和技术并不限于防火墙。相反，它们可以应用于其他基于规则的系统，例如互联网路由器上的数据包过滤器。
A firewall is a security guard placed between a private network and the outside Internet that monitors all incoming and outgoing packets. The function of a firewall is to examine every packet and decide whether to accept or discard it based upon the firewall's policy. This policy is specified as a sequence of (possibly conflicting) rules. When a packet comes to a firewall, the firewall searches for the first rule that the packet matches, and executes the decision of that rule. With the explosive growth of Internet-based applications and malicious attacks, the number of rules in firewalls have been increasing rapidly, which consequently degrades network performance and throughput. In this paper, we propose Firewall Compressor, a framework that can significantly reduce the number of rules in a firewall while keeping the semantics of the firewall unchanged. We make three major contributions in this paper. First, we propose an optimal solution using dynamic programming techniques for compressing one-dimensional firewalls. Second, we present a systematic approach to compressing multi-dimensional firewalls. Last, we conducted extensive experiments to evaluate Firewall Compressor. In terms of effectiveness, Firewall Compressor achieves an average compression ratio of 52.3% on real- life rule sets. In terms of efficiency, Firewall Compressor runs in seconds even for a large firewall with thousands of rules. Moreover, the algorithms and techniques proposed in this paper are not limited to firewalls. Rather, they can be applied to other rule-based systems such as packet filters on Internet routers.