A traffic-aware top-N firewall ruleset approximation algorithm

Authors:
Ho-Yu Lam;Donghan (Jarod) Wang;H. Jonathan Chao
Affiliations:
Polytechnic Institute of New York University, Brooklyn, NY;Polytechnic Institute of New York University, Brooklyn, NY;Polytechnic Institute of New York University, Brooklyn, NY
Venue:
Proceedings of the 6th ACM/IEEE Symposium on Architectures for Networking and Communications Systems
Year:
2010

Citing 6
Cited 0

Dynamic rectangular intersection with priorities

Proceedings of the thirty-fifth annual ACM symposium on Theory of computing
A methodology for studying persistency aspects of internet flows

ACM SIGCOMM Computer Communication Review
Dynamic rule-ordering optimization for high-speed firewall filtering

ASIACCS '06 Proceedings of the 2006 ACM Symposium on Information, computer and communications security
Compressing rectilinear pictures and minimizing access control lists

SODA '07 Proceedings of the eighteenth annual ACM-SIAM symposium on Discrete algorithms
Topological transformation approaches to optimizing TCAM-based packet classification systems

Proceedings of the eleventh international joint conference on Measurement and modeling of computer systems
Multi-Engine Packet Classification Hardware Accelerator

ICCCN '09 Proceedings of the 2009 Proceedings of 18th International Conference on Computer Communications and Networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

Packet classification is widely used in various network security and operation applications. Two of the main challenges are the increasing number of classification rules, amount of traffic and network line speed. In this poster, we investigate an approximation algorithm for selecting the top-N most frequently matched subset of rules from the original ruleset. Through simulations, we show that our approaches the optimal while runs in seconds, allowing online adaptation to changing traffic patterns.