Dynamic rule-ordering optimization for high-speed firewall filtering

Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security, ASIACCS '06

Volumn 2006, Issue , 2006, Pages 332-342

  Named, Hazem ^a   Al Shaer, Ehab ^a  

^a DEPAUL UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DATA STRUCTURES; HIGH SPEED NETWORKS; INTERNET PROTOCOLS; OPTIMIZATION; PACKET NETWORKS; TELECOMMUNICATION TRAFFIC;

FIREWALL FILTERING; FIREWALL POLICY; OPTIMIZATION ALGORITHMS; PACKET FILTERING; TRAFFIC MATCHING;

COMPUTER SYSTEM FIREWALLS;

EID: 34247345394     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1128817.1128867     Document Type: Conference Paper

References (29)

1. E. Al-Shaer and H. Hamed. Modeling and management of firewall policies. IEEE Transactions on Network and Service Management, 1(1), April 2004.
2. D. Bertsimas and J. Tsitsiklis. Introduction to Linear Optimization. Athena Scientific, 1997.
3. D. Chapman and E. Zwicky. Building Internet Firewalls. Orielly & Associates Inc., second edition edition, 2000.
4. E. Cohen and C. Lund. Packet classification in large TSPs: Design and evaluation of decision tree classifiers. ACM SIGMETRICS Performance Evaluation Review, 33(1):73-84, 2005.
5. A. Feldmann and S. Muthukrishnan. Tradeoffs for packet classification. In IEEE INFOCOM'00, March 2000.
6. R. Graham, E. Lawler, J. Lenstra, and A. Kan. Optimizing and applixation in deterministic seuquencing and scheduling: A surevey. Annals of Discrete Mathematics, 5, 1979.
7. P. Gupta and N. McKeown. Algorithms for packet classification. IEEE Network, 15(2):24-32, 2001.
8. P. Gupta and N. McKeown. Packet classification using hierarchical intelligent cuttings. In Interconnects VII, August 1999.
9. P. Gupta, B. Prabhakar, and S. Boyd. Near optimal routing lookups with bounded worst case performance. In IEEE INFOCOM'00, 2000.
10. H. Hamed and E. Al-Shaer. Adaptive statistical optimization techniques for firewall packet filtering. Technical Report TR-05-012, DePaul University, 2005.
11. D. Kuuth. Fundamental Algorithms, volume 1 of The Art of Computer Programming. Addison-Wesley, Reading, Massachusetts, third edition.
12. K. Lan and J. Heidemann. On the correlation of internet flow characteristics. Technical Report ISI-TR-574, USC/ISI, 2003.
13. E. Lawler. Sequencing jobs to minimize total weighted completion time subject to precedence constraints. Annals of Discrete Mathematics, 2, 1978.
14. J. Lenstra and A. Kan. Complexity of scheduling under precendence constraints. Operations Research, 26(1), 1978.
15. A. J. McAulay and P. Francis. Fast routing table lookup using CAMs. In IEEE INFOCOM'93, March 1093.
16. Passive Measurement and Analysis Project, National Laboratory for Applied Network Research. Auckland-VIII Traces. http://pma.nlanr.net./Special/auck8. html, December 2003.
17. J. Qian, S. Hinrichs, and K. Nahrstedt. ACLA: A framework for access control list- (ACL) analysis and optimization. In TFTP Communications and Multimedia Security, 2001.
18. R. Rivest. On self-organizing sequenctial search heuristics. Communications of the ACM, 19(2), 1976.
19. th International IPCO Conference, 1996.
20. V. Srinivasan, Subhash Suri, and George Varghese. Packet classification using tuple space search. In Computer ACM SIGCOMM Communication Review, pages 135-146, October 1999.
21. Cisco Syslonis. Optimizing ACLs. User Guide for ACL Manager 1.4, CiscoWorks2000, 2002.
22. Cisco Systems. Netflow services solutions guide, October 2004.
23. D. Taylor and J. Turner. Scalable packet classification using distributed crossproducting of field labels. In IEEE INFOCOM, 2005.
24. SimJava v2.0. Process based discrete event simulation package for Java. http://www.dcs.ed.ac.uk/home/hase/simjava/, 2002.
25. J. Wallerich, H. Dreger, A. Feldmann, B. Krishnamurthy, and W. Willinger. A methodology for studying persistency aspects of internet flows. SIGCOMM Computer Communication Review, 35(2), 2005.
26. Thomas Y. C. Woo. A modular approach to packet classification: Algorithms and results. In IEEE INFOCOM'00, pages 1213-1222, March 2000.
27. A. Wool. A quantitative study of firewall configuration errors. IEEE Computer, 37(6):62-67, 2004.
28. L. Zhang. Virtual clock: a new traffic control algorithm for packet switching networks. In The ACM symposium on Communications Architectures and Protocols, 1990.
29. G. Zipf. Human Behaviour and the Principle of Least-Effort. Addison-Wesley, 1949.