Towards Optimal Firewall Rule Ordering Utilizing Directed Acyclical Graphs

Abstract

Abstract-Firewalls enforce a security policy by inspecting packets arriving or departing a network. This is often accomplished by sequentially comparing the policy rules with the header of an arriving packet until the first match is found. This process becomes time consuming as policies become larger and more complex. Therefore determining the appropriate action for arriving packets must be done as quickly as possible.The process of packet header matching can be improved if more popular rules appear earlier in the policy. Unfortunately, a simple sorting algorithm is not possible since the relative order of certain rules must be maintained in order to preserve the original policy intent. Utilizing Directed Acyclical Graphs (DAGs) to represent firewall policy, this paper will introduce a novel rule sorting technique. The technique is capable of considering sub-graphs of rules (inter-related by precedence constraints) and compare the advantage of placing and merging the rules that comprise them. Experimental results using a variety of policies will show that the proposed algorithm is able to find the optimal order in 98% of the example policies, which is substantially higher than other methods.

Fast and scalable method for resolving anomalies in firewall policies

“…Results presented here are most closely associated with the techniques developed in [10]. However, there are important differences between their and our methods.…”

“…In this section, we focus our literature study on related research that is close to our work in the areas of firewall rule conflict detection and optimization analysis [1], [4], [6], [8] and [10].…”

Optimization of packet filter with maintenance of rule dependencies

“…Tapdiya and Fulp used a directed acyclic graph (DAG) reflecting the rule dependencies of a rule set and rearranged the rules so as to reduce the cost of rule comparisons [5]. Their method takes a further O(n 3 ) time to reorder the rules associated with the DAG.…”

Dynamic Ordering of Firewall Rules Using a Novel Swapping Window-based Paradigm

“…The authors of [12] presented a heuristic algorithm for optimized policy RR that is able to re-order a policy containing precedence relationships (or a sub-graph in the DAG) in such a way that the policy integrity is maintained. A short synopsis of the most important aspects of this algorithm is given below.…”