Reducing the size of rule set in a firewall

IEEE International Conference on Communications

Volumn , Issue , 2007, Pages 1274-1279

  Yoon, Myungkeun ^a   Chen, Shigang ^a   Zhang, Zhan ^a  

^a University of Florida   (United States)

Author keywords

Firewall; Network security; Rule management

Indexed keywords

COMPUTATIONAL COMPLEXITY; DATA TRANSFER; ERROR ANALYSIS; NETWORK SECURITY;

AGGRESSIVE REDUCTION ALGORITHMS; RULE MANAGEMENT;

COMPUTER SYSTEM FIREWALLS;

EID: 38549181202     PISSN: 05361486     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICC.2007.215     Document Type: Conference Paper

References (22)

1. A. Rubin, D. Geer, and M. Ranum, "Web Security Sourcebook," Wiley Computer Publishing, 1997.
2. A. Wool, "A quantitative study of firewall configuration, errors," IEEE Computer, vol. 37, no. 6, pp. 62-67, June 2004.
3. A. X. Liu and M. G. Gouda, "Removing Redundancy from Packet Classifiers," Proc. of ACM SIGCOMM, 2004.
4. M. G. Gouda and A. X. Liu, "Firewall Design: Consistency, Completeness and Compactness," Proc. of ICDCS-04, pp. 320-327, March 2004.
5. A. X. Liu and M. G. Gouda, "Diverse Firewall Design," Proc. of IEEE International Conference on Dependable Systems and Networks (DSN-04), pp. 595-604, June 2004.
6. E. S. Al-Shaer and H. H. Hamed, "Discovery of Policy Anomalies in Distributed Firewalls," Proc. of IEEE Infocom 2004, March 2004.
7. P. Gupta and N. McKeown, "Packet Classification on Multiple Fields," Proc. of ACM SIGCOMM, 1999.
8. P. Gupta, "Algorithms for Routing Lookups and Packet Classification," PhD Thesis, Stanford University, 2000.
9. P. Gupta and N. McKeown, "Algorithms for Packet Classification, " IEEE Network, 15(2):, pp. 24-32, March 2001.
10. T. Lakshman and D. Stiliadis, "High-Speed Policy-based Packet Forwarding Using Efficient Multi-dimensional Range Matching," Proc. of ACM SIGCOMM, 1998.
11. Y. Bartal, A. Mayer, K. Nissim, and A. Wool, "Firmato: a novel firewall management toolkit," ACM Transactions On Computer Systems, vol. 22, issue 4, pp. 381-420, November 2004.
12. J. D. Guttman, "Filtering Postures: Local Enforcement for Global Policies," Proc. of IEEE Symposium on Security and Privacy, 1997.
13. A. Mayer, A. Wool, and E. Ziskind, "Fang: A Firewall Analysis Engine," Proc. of IEEE Symposium on Security and Privacy, 2000.
14. A. D. Keromytis and J. Wright, "Transparent Network Security Policy Enforcement," Proc. of USENIX 2000 Annual Technical Conference, pp. 215-226, June 2000.
15. A. Hari, S. Suri, and G. Parulkar, "Detecting and Resolving Packet Filter Conflicts," Proc. of IEEE Infocom, March 2000.
16. V.Srinivasan, G.Varghese, S.Suri and M.Waldvogel, "Fast and Scalable Layer Four Switching," Proc. of ACM SIGCOMM, 1998.
17. S.Hazelhurst, A.Attar and R.Sinnappan, "Algorithms for Improving the Dependability of Firewall and Filter Rule Lists," Proc. of International Conference on Dependable Systems and Networks (DSN 2000), 2000.
18. S. Ioannidis, A. D. Keromytis, S. Bellovin, and J. M. Smith, "Implementing a Distributed Firewall," Proc. of ACM Computer and Communications Security (CCS) 2000, pp. 190-199, 2000.
19. R. N. Smith, Y. Chen, and S. Bhattacharya, "Cascade of Distributed and Cooperating Firewalls in a Secure Data Network," IEEE Trans. On Knowledge and Data Engineering, Vol. 15, No. 5, 2003.
20. J. Wack, K. Cutler, and J. Pole, "Guidelines on Firewalls and Firewall Policy," National Institute of Standards and Technology, January 2002.
21. A. Wool, "The use and usability of direction-based filtering in firewalls," Computers & Security, 23(6), pp. 459-468, 2004.
22. E. W. Fulp, "Optimization of Network Firewall Policies Using Ordered Sets and Directed Acyclical Graphs," Proc. of IEEE Internet Management Conference, 2005.