Fast Algorithm for Detecting Firewall Filters Conflicts

Xin Lu

2008-01-01

Abstract:To solve the problem that current algorithms for detecting firewall filters conflicts had poor performance,this paper proposed a fast algorithm called FRCD for detecting conflicts.FRCD constructed two binary trees for every dimension.Experiments verify its good performance.

What problem does this paper attempt to address?

An Algorithm for Detecting Firewall Filters Conflicts

LI Xin,JI Zhen-zhou,LIU Wei-chen,HU Ming-zeng

DOI: https://doi.org/10.3969/j.issn.1007-5321.2006.04.022

2006-01-01

Abstract:To improve the efficiency and scalability of conflict detection for multi-dimensional classifiers,a new algorithm,based on grid of trie(GoT) algorithm,was proposed.The new algorithm uses Patricia trie,constricts the length of Internet protocol(IP) prefix in order to use Hash technology,and improves the performance of the algorithm by adding ingress and egress of firewall for each filter.
A fast and scalable conflict detection algorithm for packet classifiers

Xin Li,Zhenzhou Ji,Mingzeng Hu

DOI: https://doi.org/10.1007/11576235_34

2005-01-01

Abstract:Packet filters are rules for classifying packets based on their header fields. A filter conflict occurs when two or more filters overlap, creating an ambiguity in packet classification. There has been prior works on conflict detection for multi-dimensional classifiers, but their efficiency and scalability are not good. A new algorithm is proposed, which uses hashing-based PATRICIA trie. The new algorithm can fast detect conflicts in classifiers and have high scalability. The technology of processing transport-level ports can bring more security than existed algorithms.
FROD: an Efficient Framework for Optimizing Decision Trees in Packet Classification

Longlong Zhu,Jiashuo Yu,Jiayi Cai,Jinfeng Pan,Zhigao Li,Zhengyan Zhou,Dong Zhang,Chunming Wu

DOI: https://doi.org/10.1109/iwqos54832.2022.9812915

2022-01-01

Abstract:To perform efficient packet classification, decision tree-based methods conduct decision trees via hand-tuned heuristics. Then the performance testing and optimization are executed to ensure an excellent searching speed and space overhead. Specifically, when the performance is below expectation, existing solutions attempt to optimize the algorithms, such as conducting more sophisticated heuristics. However, reconstruction or adjustment for algorithms produces an intolerable time overhead due to the long optimization period, caused by uncertain performance benefits and high pre-processing time. In this paper, we propose FROD, an efficient framework for optimizing the decision trees directly in packet classification. FROD raises a meticulous evaluation to accurately appraise decision trees constructed by different heuristics. It then seeks out the bottleneck components via a lightweight heuristic. After that, FROD searches the optimal division for inferior components considering structural constraints and characteristics of traffic distribution. Evaluation on ClassBench shows that FROD benefits existing decision tree-based solutions in classification time by 41% and memory footprint by 19% on average, and reduces classification time by up to 64%.
Modified Fair Random Early Detection Queuing Algorithm

平玲娣,郭行波,潘雪增,陈晓峰

DOI: https://doi.org/10.3785/j.issn.1008-973x.2007.12.008

2007-01-01

Abstract:An improved algorithm named modified fair random early detection(MFRED) was presented to treat with the problem that fair random early detection(FRED) algorithm rises many misidentifications with adaptive flows in congested network.In MFRED,strike counter rises fast when identification condition is met,and falls slowly when packets leave.A mechanism for misidentification correcting was added without markedly increase in computing complexity.Simulation showed that compared with FRED,MFRED identifies non-adaptive flows and balances the bandwidth allocation effectively while misidentifications are greatly reduced.
Fast Continuous Collision Detection Using Deforming Non-Penetration Filters.

Min Tang,Dinesh Manocha,Ruofeng Tong

DOI: https://doi.org/10.1145/1730804.1730806

2010-01-01

Abstract:We present a novel culling algorithm that uses deforming non-penetration filters to improve the performance of continuous collision detection (CCD) algorithms. The underlying idea is to use a simple and effective filter that reduces both the number of false positives and the elementary tests between the primitives. This filter is derived from the coplanarity condition and can be easily combined with other methods used to accelerate CCD. We have implemented the algorithm and tested its performance on many non-rigid simulations. In practice, we can reduce the number of false positives significantly and improve the overall performance of CCD algorithms by 1.5--8.2x.
Automatic Conflict Analysis and Resolution of Traffic Filtering Policy for Firewall and Security Gateway

S. Pesic,A. Baiocchi,Livia Trazza,Simone Ferraresi

DOI: https://doi.org/10.1109/ICC.2007.220

2007-06-24

Abstract:Firewalls and Security Gateways are core elements in network security infrastructure. As networks and services become more complex, managing access-list rules becomes an error-prone task. Conflicts in a policy can cause holes in security, and can often be hard to find while performing only visual or manual inspection. First, we have defined a methodology to systematically classify the severity of rule conflicts; secondly, we have proposed two different solutions to automatically resolve conflicts in a firewall. For one of them we found an algebraic proof of the existence of the solution and the convergence of the algorithm, and then we have made a software implementation to test it.

Computer Science
Test Packets Choice Algorithm Aiming at Filter Conflicts

Xin Lu

2011-01-01

Computer Science

Abstract:Because of firewall filter conflicts,filters may not be in accordance with administrators' meaning so that this leads to security vulnerabilities.Therefore we need correctness test to solve this problem.Most of the current test packets choice algorithms choose packets at random or from the apex of filters in the correctness test.However these methods neglect the areas that contain conflicting filters and hence cannot detect all error produced by filter conflicts.This paper presented a test packets choice algorithm aiming at filter conflicts to address this problem.The algorithm treats two filters as the basic processed object and computes their area that contains conflicting filters.We not only choose test packets from the apex of filters but from the areas that contain conflicting filters as well.Compared to current test packets choice algorithms,the algorithm proposed by this paper can detect all error produced by filter conflicts with adding only a little packets.This paper proves the algorithm and experiments verify its good performance.
Fast Continuous Collision Culling with Deforming Noncollinear Filters

Peng Du,Min Tang,Ruofeng Tong

DOI: https://doi.org/10.1002/cav.1439

IF: 1.01

2012-01-01

Computer Animation and Virtual Worlds

Abstract:ABSTRACTWe present a novel culling algorithm that uses deforming noncollinear filters to improve the performance of continuous collision detection (CCD) algorithms. The underlying idea is to use simple and effective filters, deforming noncollinear filters (NCFs), that reduce the number of false positives between the primitives. These filters are derived from the collinear conditions and can be easily combined with other culling methods. We have tested its performance on several benchmarks. Comparing with previous methods, we can reduce the number of false positives significantly and improve the overall performance of CCD algorithms, especially for simulations with large time steps. Copyright © 2012 John Wiley & Sons, Ltd.
Algorithm for Fast Detecting Firewall Rule Configuration Mistakes

WANG Weiping,CHEN Wenhui,ZHU Weiwei,CHEN Huaping

DOI: https://doi.org/10.3969/j.issn.1000-3428.2007.11.049

2007-01-01

Abstract:As enterprises’ network security barrier,firewalls play a very important role.Since enterprises configurate firewalls according to its need;the rule table will be included.However,problems may occur during configuration.On one hand,the administrator himself may make some mistakes during initial configuration.On the other hand,possibility of conflicts among different rules increases with rule numbers in the table growing.This paper analyzes possible mistakes in the configuration process.It introduces several familiar types of mistakes in configuration,puts forward the algorithm which can find mistakes.The paper improves the algorithm according to the characteristics of the firewall rule table,which increases efficiency of detecting configuration mistakes.
Algorithm for detecting firewall policy inconsistency

WANG Wei-Ping,CHEN Wen-Hui,LI Zhe-Peng,CHEN Hua-Ping

DOI: https://doi.org/10.3969/j.issn.1002-1175.2007.03.017

2007-01-01

Abstract:As a traditional technique of information security,firewall has played a very important role.Security administrators frequently have to compare firewall policies looking for inconsistence,while it is not a smooth process to choose a platform for the comparison.To realize the comparison between firewalls' policies,this paper provides FPT(firewall policy tree) model,and the construction algorithm which can turn a firewall policy into a policy tree,as well as the comparison algorithm,and finally presents the procedures of comparing firewalls' policies.Combination of the two algorithms can be used to perform a comparison between firewalls' policies.By doing this,the paper can obtain the set of data packages on which different firewalls have made inconsistent filter decisions,so as to find out the inconsistency in firewalls' policies.
Firewall Policy Conflict Detection and Conflict Rules Visualization

孙立琴,潘理

DOI: https://doi.org/10.3969/j.issn.1009-8054.2012.05.048

2012-01-01

Abstract:In order to detect all conflicts existing in firewall policy and visualize the relationships between rules and the reasons that generate conflicts, the rule segmentation is adopted to detect conflicts, and grids visualization method to visualize the relationships between rules and the reasons that generates conflicts. Conflict detection contains three functional parts, including segmentation of firewall policy, analysis on the segmentation result and extraction of the conflict domain. Thus the administrator could clearly know the anomaly cause, enhance the understanding, inspect the firewall policies, and avoid the introduction of new conflicts while modifying existing conflicts. And the experiment indicates the feasibility and effectiveness of this method.
An Improvement For Fast-Flux Service Networks Detection Based On Data Mining Techniques

Ziniu Chen,Jian Wang,Yujian Zhou,Chunping Li

DOI: https://doi.org/10.1007/978-3-642-21881-1_47

2011-01-01

Abstract:Fast-flux is a kind of DNS technique used by botnets to hide the actual location of malicious servers. It is considered as an emerging threat for information security. In this paper, we propose an approach to detect the fast-flux service network ( FFSN) using data mining techniques. Furthermore, we use the resampling technique to solve imbalanced classification problem with respect to FFSNs detection. Experiment results in the real datasets show that our approach improves the detective precision and effectiveness compared with existing researches.
Dynamic Update of Firewall Policy Based on MFDT

Wenhui Chen,Weiping Wang,Zhepeng Li,Huaping Chen

DOI: https://doi.org/10.1109/iccias.2006.295436

2006-01-01

Abstract:To improve the filtering speed of firewall, researchers have proposed many expression tools for firewall policy. However, these tools share a limitation: not compatible with dynamic updating of firewall policy. Therefore, this paper suggests marked firewall decision trees (MFDT) model. MFDT can handle not only the package filtering but also dynamically response to the updating of original policies. First of all, it is given the definition of MFDT. For three situation of policy change: adding, modifying and deleting of rules, corresponding updating algorithms of MFDT are given. In the end, MFDT's integrality and complexity are proved
Comparison Model and Algorithm for Distributed Firewall Policy

Weiping Wang,Wenhui Chen,Zhepeng Li,Huaping Chen

DOI: https://doi.org/10.1007/978-3-540-37275-2_67

2006-01-01

Abstract:As a traditional technique of information security, distributed firewall has taken very important position, while problems remain. Correct configuration of distributed firewall policies and keeping individual firewall filter decisions compatible to each other are quite inconvenient for administrators. To realize the comparison between firewalls’ policies, this paper provide FPT(firewall policy tree) model, and the construction algorithm which can turn a firewall policy into a policy tree, as well as the comparison algorithm. Combination of the two algorithms can be used to perform a comparison between distributed firewalls’ policies. By doing this, the paper can obtain the set of data packages on which different firewalls have made inconsistent filter decision, and find out the inconsistency in distributed firewall policies. Besides, this model could be extended to package classification systems for policies comparison.
Dynamic Allocation and Hash Table Based Match Algorithms for Firewall Rules

DUAN Haixin,WU Jianping,LI Xing

DOI: https://doi.org/10.3321/j.issn:1000-0054.2001.01.025

2001-01-01

Abstract:Throughput and management issues arise when firewalls are applied in large transit networks. The manual configuration of large numbers of firewalls distributed in many access points can not provide open and dynamic environment and the large number of filtering rules decreases each firewall's throughput. Management can be improved using algorithms to automatically allocate global filtering rules to individual firewalls and to dynamically configure all of the firewalls according to the results of intrusion detection systems and search engines. The throughput of individual firewalls can be improved using a hash table based rule matching algorithm, which reduces the time complexity from O(N) to O(1) for transit networks, and therefore, increases the firewall throughput.
A very fast algorithm for detecting community structures in complex networks

Xutao Wang,Guanrong Chen,Hongtao Lu

DOI: https://doi.org/10.1016/j.physa.2007.05.013

2007-01-01

Abstract:In this paper, a new algorithm is proposed, which uses only local information to analyze community structures in complex networks. The algorithm is based on a table that describes a network and a virtual cache similar to the cache in the computer structure. When being tested on some typical computer-generated and real-world networks, this algorithm demonstrates excellent detection results and very fast processing performance, much faster than the existing comparable algorithms of the same kind.
CFADefense: A Security Solution to Detect and Mitigate Crossfire Attacks in Software-Defined IoT-Edge Infrastructure

Wajid Rafique,Xin He,Zifan Liu,Yuhu Sun,Wanchun Dou

DOI: https://doi.org/10.1109/HPCC/SmartCity/DSS.2019.00080

2019-01-01

Abstract:Managing the Internet of Things (IoT) infrastructure has become a critical challenge due to an enormous increase in the connected devices and the lack of available security solutions. Software-Defined Networking (SDN) has been extensively involved in network infrastructure management. Moreover, numerous recent studies demonstrate the use of SDN for managing IoT networks. In SDN, policy consistency and security of the data plane is maintained through Waypoint Enforcement (WPE) which ensures that the traffic traverses policy nodes/switches to implement high-level network requirements. Previous studies on SDN primarily secure SDN infrastructure against traditional Distributed Denial of Service (DDoS) attacks. However, we investigate Crossfire Attack (CFA), which is a novel DDoS attack capable of interrupting communication of data plane switches using low-rate legitimate traffic. CFA has the potential to isolate policy switch from the rest of the data plane devices which introduces many security anomalies and routing inconsistencies. We first demonstrate how CFA is lethal on policy switch attacks and then present the design and implementation of a novel CFA countermeasure called CFADefense, which employs link selection, attack detection, and malicious flows interception modules. CFADefense has been developed as an application at the application layer of the open-source Floodlight controller. Our evaluation demonstrates that CFADefense accurately detects and efficiently mitigates CFA and poses minimal overhead on the controller in dealing with this attack.
Dual Cuckoo Filter with a Low False Positive Rate for Deep Packet Inspection

Yixuan Zhang,Meiting Xue,Huan Zhang,Shubiao Liu,Bei Zhao

DOI: https://doi.org/10.1587/transfun.2022eap1062

2023-01-01

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences

Abstract:Network traffic control and classification have become increasingly dependent on deep packet inspection (DPI) approaches, which are the most precise techniques for intrusion detection and prevention. However, the increasing traffic volumes and link speed exert considerable pressure on DPI techniques to process packets with high performance in restricted available memory. To overcome this problem, we proposed dual cuckoo filter (DCF) as a data structure based on cuckoo filter (CF). The CF can be extended to the parallel mode called parallel Cuckoo Filter (PCF). The proposed data structure employs an extra hash function to obtain two potential indices of entries. The DCF magnifies the superiority of the CF with no additional memory. Moreover, it can be extended to the parallel mode, resulting in a data structure referred to as parallel Dual Cuckoo filter (PDCF). The implementation results show that using the DCF and PDCF as identification tools in a DPI system results in time improvements of up to 2% and 30% over the CF and PCF, respectively.
ForestFirewalls: Getting Firewall Configuration Right in Critical Networks (Technical Report)

Dinesha Ranathunga,Matthew Roughan,Paul Tune,Phil Kernick,Nick Falkner

DOI: https://doi.org/10.48550/arXiv.1902.05689

2019-02-15

Abstract:Firewall configuration is critical, yet often conducted manually with inevitable errors, leaving networks vulnerable to cyber attack [40]. The impact of misconfigured firewalls can be catastrophic in Supervisory Control and Data Acquisition (SCADA) networks. These networks control the distributed assets of industrial systems such as power generation and water distribution systems. Automation can make designing firewall configurations less tedious and their deployment more reliable. In this paper, we propose ForestFirewalls, a high-level approach to configuring SCADA firewalls. Our goals are three-fold. We aim to: first, decouple implementation details from security policy design by abstracting the former; second, simplify policy design; and third, provide automated checks, pre and post-deployment, to guarantee configuration accuracy. We achieve these goals by automating the implementation of a policy to a network and by auto-validating each stage of the configuration process. We test our approach on a real SCADA network to demonstrate its effectiveness.

Cryptography and Security
Detection and Defense of SYN Flood Attacks Based on Dual Stack Network Firewall

Ding Pengfule,Tian Zhihong,Zhang Hongli,Wang Yong,Zhang Liang,Guo Sanchuan

DOI: https://doi.org/10.1109/dsc.2016.108

2016-01-01

Abstract:The extensive use of Internet technology has brought great convenience to modern society, however, more and more severe problems regarding to network security have also emerged at the same time. Especially the DDoS attacks, represented by SYN Flood, pose massive threats to the network security. This paper discusses an algorithm which could detect SYN Flood attack quickly under large scale network: the adaptive threshold algorithm. Then we propose "Slow detection, Fast recovery" mechanism on basis of adaptive threshold algorithm. Finally, we implement the attack detection and defense algorithms in dual-stack firewall, and test the validity and performance respectively. The results indicate that the methods of detecting and defending SYN Flood proposed by this paper can improve the system efficiency substantially when firewall is attacked, while consuming only a small amount of extra memory.

Fast Algorithm for Detecting Firewall Filters Conflicts

An Algorithm for Detecting Firewall Filters Conflicts

A fast and scalable conflict detection algorithm for packet classifiers

FROD: an Efficient Framework for Optimizing Decision Trees in Packet Classification

Modified Fair Random Early Detection Queuing Algorithm

Fast Continuous Collision Detection Using Deforming Non-Penetration Filters.

Automatic Conflict Analysis and Resolution of Traffic Filtering Policy for Firewall and Security Gateway

Test Packets Choice Algorithm Aiming at Filter Conflicts

Fast Continuous Collision Culling with Deforming Noncollinear Filters

Algorithm for Fast Detecting Firewall Rule Configuration Mistakes

Algorithm for detecting firewall policy inconsistency

Firewall Policy Conflict Detection and Conflict Rules Visualization

An Improvement For Fast-Flux Service Networks Detection Based On Data Mining Techniques

Dynamic Update of Firewall Policy Based on MFDT

Comparison Model and Algorithm for Distributed Firewall Policy

Dynamic Allocation and Hash Table Based Match Algorithms for Firewall Rules

A very fast algorithm for detecting community structures in complex networks

CFADefense: A Security Solution to Detect and Mitigate Crossfire Attacks in Software-Defined IoT-Edge Infrastructure

Dual Cuckoo Filter with a Low False Positive Rate for Deep Packet Inspection

ForestFirewalls: Getting Firewall Configuration Right in Critical Networks (Technical Report)

Detection and Defense of SYN Flood Attacks Based on Dual Stack Network Firewall