Bradford Scholars -how to deposit your paper Overview Copyright check• Check if your publisher allows submission to a repository.• Use the Sherpa RoMEO database if you are not sure about your publisher's position or email openaccess@bradford.ac.uk.

To solve the problem of ambiguous attribute selection in existing decision tree classification algorithms, a decision tree construction method based on information entropy, PCMIgr, is proposed. PCMIgr is a heuristic method based on greedy strategy. At each decision tree node, when it is necessary to select classification attributes for division, the attribute with the highest information gain ratio is selected. The main innovation of this method is that the attribute selection in the traditional classification method based on decision tree is optimized, and the classification efficiency of the constructed decision tree is improved compared with that before optimization. At the same time, the decision tree ensures that each leaf node is only associated with one rule, which avoids the common problem of "rule replication" in the process of traditional decision tree construction, and effectively saves memory and calculation time. The experimental results show that the application of this method to the construction of classification decision tree can further improve the efficiency of packet classification method based on decision tree, and can be applied to high-speed real-time packet classification.

No abstract

Firewalls are crucial elements that enhance network security by examining the field values of every packet and deciding whether to accept or discard a packet according to the firewall policies. With the development of networks, the number of rules in firewalls has rapidly increased, consequently degrading network performance. In addition, because most real-life firewalls have been plagued with policy conflicts, malicious traffics can be allowed or legitimate traffics can be blocked. Moreover, because of the complexity of the firewall policies, it is very important to reduce the number of rules in a firewall while keeping the rule semantics unchanged and the target firewall rules conflict-free. In this study, we make three major contributions. First, we present a new approach in which a geometric model, multidimensional rectilinear polygon, is constructed for the firewall rules compression problem. Second, we propose a new scheme, Firewall Policies Compression (FPC), to compress the multidimensional firewall rules based on this geometric model. Third, we conducted extensive experiments to evaluate the performance of the proposed method. The experimental results demonstrate that the FPC method outperforms the existing approaches, in terms of compression ratio and efficiency while maintaining conflict-free firewall rules.

Packet classification is the core technology of network layer and an important means to ensure the security of network system. With the rapid development of network technology, higher requirements are put forward for the speed of network packet classification. This paper improves the traditional single thread package classification framework, A new parallelization method for fast packet classification (MpFPC) based on distributed computing is proposed, the method adopts the packet classification idea based on decision tree, but compared with the traditional algorithm, a rule mapping preprocessing process is added before constructing the classification decision tree, which effectively removes the rule redundancy and conflict, so as to avoid the rule replication problem of the traditional decision-tree-based method. In addition, the method can group the rules and data packets at the same time, which improves the packet classification efficiency. Experimental results show that MpFPC method has high classification efficiency and has obvious speed advantage compared with Uscuts method with time complexity of O(klogn). In addition, the test results also show that the classification speed of MpFPC will increase with the increasing number of computing nodes, which provides a new possible way to meet the classification wire-speed requirement.