Automated Framework for Policy Optimization in Firewalls and Security Gateways

Abstract

The challenge to address in multi-firewall and security gateway environment is to implement conflict-free policies, necessary to avoid security inconsistency, and to optimize, at the same time, performances in term of average filtering time, in order to make firewalls stronger against DoS and DDoS attacks. Additionally the approach should be real time, based on the characteristics of network traffic. Our work defines an algorithm to find conflict free optimized device rule sets in real time, by relying on information gathered from traffic analysis. We show results obtained from our test environment demonstrating for computational power savings up to 24% with fully conflict free device policies.

IDS performance enhancement technique based on dynamic traffic awareness histograms

“…In [21], the authors proposed an architecture algorithm to automatically adapt packet inspection devices configuration according to traffic behavior. The algorithm provides adaptive conflict free optimization in the rule list, in which each rule is given a probability rate and cost weight.…”

Dynamic rule and rule‐field optimisation for improving firewall performance and security

“…The non-heuristic general framework for rule-based firewall optimisation proposed in [18] captures the semantics of an access control list in terms of whether each packet is forwarded or denied instead of profiling the rules to determine their importance as in [9]. In [20], the authors propose an architecture algorithm to automatically adapt packet-filtering devices configuration according to the traffic behaviour. The adaptive conflict-free optimisation (ACO) algorithm provides adaptive conflict free optimisation in the security policy, in which each rule is given a probability rate and cost weight.…”