Hybrid Tree-Rule Firewall for High Speed Data Transmission

Abstract

Traditional firewalls employ listed rules in both configuration and process phases to regulate network traffic. However, configuring a firewall with listed rules may create rule conflicts, and slows down the firewall. To overcome this problem, we have proposed a Tree-rule firewall in our previous study. Although the Tree-rule firewall guarantees no conflicts within its rule set and operates faster than traditional firewalls, keeping track of the state of network connections using hashing functions incurs extra computational overhead. In order to reduce this overhead, we propose a hybrid Tree-rule firewall in this paper. This hybrid scheme takes advantages of both Tree-rule firewalls and traditional listed-rule firewalls. The GUIs of our Tree-rule firewalls are utilized to provide a means for users to create conflict-free firewall rules, which are organized in a tree structure and called 'tree rules'. These tree rules are later converted into listed rules that share the merit of being conflict-free. Finally, in decision making, the listed rules are used to verify against packet header information. The rules which have matched with most packets are moved up to the top positions by the core firewall. The mechanism applied in this hybrid scheme can significantly improve the functional speed of a firewall.

On optimizing firewall performance in dynamic networks by invoking a novel swapping window–based paradigm

“…Chomsiri et al 22 suggest to combine list-based search together with tree-based search for enhancing the firewall performance by taking advantages of both approaches. Even though a tree-based representation of a firewall rule is generally more efficient than a list-based representation, it induces extra computational overhead due to the necessity of maintaining the state of the network connections.…”

FFF: Fast Firewall Framework to Enhance Rule Verifying over High-speed Networks

“…Therefore, rewall researchers have improved the speed of rule verication by revising the rule storage structure in a sequential manner to a tree structure, called the modern rewall. As a result, the speed of rule verication has 1,2,3 The authors are with Department of Computer Science, Faculty of Informatics, Mahasarakham University, Mahasarakham, Thailand 44000, E-mail: suchart.k@msu.ac.th, panida.s@msu.ac.th and potchara.p@gmail.com been increased from O(n) to O(log 2 (n)) as described in [4], [5], [6], [7] and [8]. However, nowadays, the volume of data communication is tremendous, and the vast majority of these communications are characterized by real-time or fast response communications.…”