Firewall Compressor: An Algorithm for Minimizing Firewall Policies

Abstract

Abstract-A firewall is a security guard placed between a private network and the outside Internet that monitors all incoming and outgoing packets. The function of a firewall is to examine every packet and decide whether to accept or discard it based upon the firewall's policy. This policy is specified as a sequence of (possibly conflicting) rules. When a packet comes to a firewall, the firewall searches for the first rule that the packet matches, and executes the decision of that rule.With the explosive growth of Internet-based applications and malicious attacks, the number of rules in firewalls have been increasing rapidly, which consequently degrades network performance and throughput. In this paper, we propose Firewall Compressor, a framework that can significantly reduce the number of rules in a firewall while keeping the semantics of the firewall unchanged.We make three major contributions in this paper. First, we propose an optimal solution using dynamic programming techniques for compressing one-dimensional firewalls. Second, we present a systematic approach to compressing multi-dimensional firewalls. Last, we conducted extensive experiments to evaluate Firewall Compressor. In terms of effectiveness, Firewall Compressor achieves an average compression ratio of 52.3% on reallife rule sets. In terms of efficiency, Firewall Compressor runs in seconds even for a large firewall with thousands of rules. Moreover, the algorithms and techniques proposed in this paper are not limited to firewalls. Rather, they can be applied to other rule-based systems such as packet filters on Internet routers.

Reducing packet delay through filter merging

“…This problem is reformulated as a scheduling problem where each single field rule is a task and the goal is to obtain a schedule with the minimum number of tasks [17]. This technique was previously used by Suri to compress the number of entries in a routing table [18].…”

“…If the destination node of the edge only has a single incoming edge, then the node can be safely deleted as it cannot be part of a discard path. Firstly, the node is removed from the node list and its memory is deallocated (lines [17][18]. The process repeats until the stack becomes empty.…”

Modeling Modern Network Attacks and Countermeasures Using Attack Graphs

“…Some also compute reachability and determine if firewalls enforce an overall policy. We use BDDs from [16] for efficient rule application which are similar in purpose to Michigan State's Firewall Decision Diagrams (FDDs) [27]- [29].…”

Complete Redundancy Removal for Packet Classifiers in TCAMs

“…Although TCAM Razor achieves higher compression ratio than using redundancy removal alone, our redundancy removal algorithm can handle classifier updates more efficiently because redundancy removal does not rewrite any rule. In [30], Liu et al presented an algorithm for compressing firewall rules. Although the compression algorithm in [30] can be used to compress general packet classifiers, it compresses rules specified in ranges, not in prefixes.…”

“…In [30], Liu et al presented an algorithm for compressing firewall rules. Although the compression algorithm in [30] can be used to compress general packet classifiers, it compresses rules specified in ranges, not in prefixes.…”