Using Online Traffic Statistical Matching for Optimizing Packet Filtering Performance

Abstract

Packet classification plays a critical role in many of the current networking technologies, and efficient yet lightweight packet classification techniques are highly crucial for their successful deployment. Most of the current packet classification techniques exploit the characteristics of classification policies, without considering the traffic behavior in optimizing their search data structures. In this paper, we present novel techniques that utilize traffic characteristics coupled with careful analysis of the policy to obtain adaptive methods that can accommodate varying traffic statistics while maintaining a high throughput. The first technique uses segmentation of the traffic space to achieve disjoint subsets of traffic properties and build bounded depth Huffman trees using the statistics collected for these segments. The second technique simplifies the structure maintenance by keeping the segments ordered in a most-recently-used (MRU) list instead of a tree. The techniques are evaluated and their performance are compared. Moreover, attacks targeting the firewall performance are discussed and corresponding protection schemes are presented.

Statistical dynamic splay tree filters towards multilevel firewall packet filtering enhancement

“…To overcome this optimization problem, research works (Gupta et al, 2000;Hamed et al, 2006aHamed et al, , 2006bEl-Atawy et al, 2007;Al-Shear et al, 2009) proposed approaches that used statistical structures in optimizing the average packet filtering time. In (Gupta et al, 2000), alphabetic tree was used to reduce the lookup time by only searching packet destination IP addresses against entries in the routing c o m p u t e r s & s e c u r i t y 5 3 ( 2 0 1 5 ) 1 0 9 e1 3 1 table.…”

“…However the statistical trees were not able to scale well with the number of fields in the IDSs. To solve this problem, the authors in (El-Atawy et al, 2007) proposed a technique that is based on statistics collected from policy segments in order to build Huffman trees that dynamically adapt to the traffic statistics.…”

“…This is because unwanted traffic may traverse a long path before being rejected by the default rule. It has been proven in (Hamed et al, 2006a(Hamed et al, , 2006bEl-Atawy et al, 2007;Trabelsi et al, 2013aTrabelsi et al, , 2013b that rejection of such unwanted traffic as early as possible would considerably increase the firewall performance. Thus, BSPL with splaying property can be adapted to ensure early packet rejection through splaying min-node to root / left.…”

Attacking Pattern Matching Algorithms Based on the Gap between Average-Case and Worst-Case Complexity

“…For example, an NIDS evasion method [6] was proposed through algorithmic complexity attacking the rule matching algorithm, making inspection times 1.5 million times slower. In [7], the skewness in network traffic distribution was utilized to yield effective attacks. Recently, attacks based on algorithmic complexity were proposed for Snort [8], [9] and regular expression matching systems [10].…”

Information Theoretic Approach for Characterizing Spam Botnets Based on Traffic Properties

“…The clear difference in skewness measure of various traffic and field values between spam and benign traffic is used as fingerprinting for spambots. The skewness distribution of Internet traffic was exploited to enhance filtering in [5], [4].…”