Dynamic Ordering of Firewall Rules Using a Novel Swapping Window-based Paradigm

Mohan, Ratish; Yazidi, Anis; Feng, Bin; Oommen, B. John

doi:10.1145/3017971.3017975

Cited by 9 publications

(4 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As shown in Fig. 7, the proposed method decreases the latency by about 11% compared to Tanaka et al [13], SGM [10], and Hikage et al [12]. This 11% reduction of classification latency is large improvement.…”

Section: Methodsmentioning

confidence: 73%

See 1 more Smart Citation

Simulated Annealing Method for Relaxed Optimal Rule Ordering

Harada

Tanaka

Mikawa

2020

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

Recent years have witnessed a rapid increase in cyberattacks through unauthorized accesses and DDoS attacks. Since packet classification is a fundamental technique to prevent such illegal communications, it has gained considerable attention. Packet classification is achieved with a linear search on a classification rule list that represents the packet classification policy. As such, a large number of rules can result in serious communication latency. To decrease this latency, the problem is formalized as optimal rule ordering (ORO). In most cases, this problem aims to find the order of rules that minimizes latency while satisfying the dependency relation of the rules, where rules r i and r j are dependent if there is a packet that matches both r i and r j and their actions applied to packets are different. However, there is a case in which although the ordering violates the dependency relation, the ordering satisfies the packet classification policy. Since such an ordering can decrease the latency compared to an ordering under the constraint of the dependency relation, we have introduced a new model, called relaxed optimal rule ordering (RORO). In general, it is difficult to determine whether an ordering satisfies the classification policy, even when it violates the dependency relation, because this problem contains unsatisfiability. However, using a zero-suppressed binary decision diagram (ZDD), we can determine it in a reasonable amount of time. In this paper, we present a simulated annealing method for RORO which interchanges rules by determining whether rules r i and r j can be interchanged in terms of policy violation using the ZDD. The experimental results show that our method decreases latency more than other heuristics.

show abstract

Section: Methodsmentioning

confidence: 73%

“…We say that ordering σ satisfies the dependency relation if, for any dependent rules r i and r j (i < j), r i is placed ahead of r j in σ. Most researchers define a constraint for ORO such that an ordering must satisfy the overlap relation [2], [7]- [12].…”

Section: Definition 3: (Roro)mentioning

confidence: 99%

Simulated Annealing Method for Relaxed Optimal Rule Ordering

Harada

Tanaka

Mikawa

2020

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

show abstract

“…The SLWE has found numerous successful applications in the literature. Applications of the SLWE include adaptive classifiers for spam filtering [36], adaptive file encoding with nonstationary distributions [26], intrusion detection in computer networks [30], tracking shifts of languages in online discussions [29], learning user preferences under concept-shift [22,33], fault-tolerant routing in Ad-hoc networks [21], digital content forensics for detecting illicit images [8], detection and tracking of malicious nodes in both Ad-hoc networks [24], vehicular mobile WiMAX networks [18], and optimizing firewall matching time via dynamic rule ordering [19]-to mention a few.…”

Section: Introductionmentioning

confidence: 99%

Parameter estimation in abruptly changing dynamic environments using stochastic learning weak estimator

Hammer

Yazidi

2018

Appl Intell

Self Cite

View full text Add to dashboard Cite

Many real-life dynamical systems change abruptly followed by almost stationary periods. In this paper, we consider streams of data with such abrupt behavior and investigate the problem of tracking their statistical properties in an online manner.We devise a tracking procedure where an estimator that is suitable for a stationary environment is combined together with an event detection method such that the estimator rapidly can jump to a more suitable value if an event is detected. Combining an estimation procedure with detection procedure is commonly known idea in the literature. However, our contribution lies in building the detection procedure based on the difference between the stationary estimator and a Stochastic Learning Weak Estimator (SLWE). The SLWE estimator is known to be the state-of-the art approach to tracking properties of non-stationary environments and thus should be a better choice to detect changes in abruptly changing environments than the far more common sliding window based approaches. To the best of our knowledge, the event detection procedure suggested by Ross et al. (2012) [25] is the only procedure in the literature taking advantage of the powerful tracking properties of the SLWE estimator. The procedure in [25] is however quite complex and not well founded theoretically compared to the procedures in this paper. In this paper, we focus on estimation procedure for the binomial and multinomial distributions, but our approach can be easily generalized to cover other distributions as well.Extensive simulation results based on both synthetic and real-life data related to news classification demonstrate that our estimation procedure is easy to tune and performs well.

show abstract

“…The SLWE has found numerous successful applications in the literature. Applications of the SLWE include adaptive classifiers for spam filtering [27], adaptive file encoding with nonstationary distributions [20], intrusion detection in computer networks [24], tracking shifts of languages in online discussions [23], learning user preferences under conceptshift [16], [26], fault-tolerant routing in Ad-hoc networks [15], digital content forensics for detecting illicit images [8], 1 Hugo Lewi Hammer and Anis Yazidi are with Department of Computer Science at Oslo and Akershus University College of Applied Sciences, Pilestredet 35, N-0166 Oslo, Norway {hugo.hammer,anis.yazidi}@hioa.no detection and tracking of malicious nodes in both Ad-hoc networks [18], vehicular mobile WiMAX networks [13], and optimizing firewall matching time via dynamic rule ordering [14]-to mention a few.…”

Section: Introductionmentioning

confidence: 99%

Efficient Tracking of Statistical Properties of Data Streams with Rapid Changes

Hammer

Yazidi

2018

2018 26th Mediterranean Conference on Control and Automation (MED)

Self Cite

View full text Add to dashboard Cite

Many real-life dynamical systems change rapidly followed by almost stationary periods. In this paper, we consider streams of data with such rapidly changing behavior and investigate the problem of tracking their statistical properties in an online manner.The streaming estimator is accompanied with a second estimator, suitable to adjust to rapid changes in the data stream. When a statistically significant difference is observed between the two estimators, the current estimate jumps to a more suitable value. Such a tracking procedure have previously been suggested in the literature. However, our contribution lies in building the estimation procedure based on the difference between the stationary estimator and a Stochastic Learning Weak Estimator (SLWE). The SLWE estimator is known to be the state-of-the art approach to tracking properties of nonstationary environments and thus should be a better choice to detect changes in rapidly changing environments than the far more common sliding window based approaches.Extensive simulation results demonstrate that our estimation procedure is easy to tune and performs very well. Further, the suggested estimator outperforms the popular and state-of-theart estimator ADWIM2 with a clear margin.

show abstract

Dynamic Ordering of Firewall Rules Using a Novel Swapping Window-based Paradigm

Cited by 9 publications

References 11 publications

Simulated Annealing Method for Relaxed Optimal Rule Ordering

Simulated Annealing Method for Relaxed Optimal Rule Ordering

Parameter estimation in abruptly changing dynamic environments using stochastic learning weak estimator

Efficient Tracking of Statistical Properties of Data Streams with Rapid Changes

Contact Info

Product

Resources

About