Linear-tree rule structure for firewall optimization

Given a list of filtering rules with individual hitting probabilities, it is known that the average processing time of a linear-search based firewall can be minimized by searching rules in some appropriate order. This paper proposes a new yet simple technique called the linear-tree structure. It utilizes an advanced feature of modern firewalls, the “goto”like statement, to transform the given rule list into a rule set that is functionally equivalent to the original but organized in a more efficient structure. We show it is possible to achieve much more improvement than previous, rulereordering based studies. To demonstrate this, we study by both simulation experiment and test with real firewall. KEY WORDS firewall, packet filter, firewall optimization, linear search, packet filtering, network security

• Type: Conference
• Year: 2007
• Where: CIIT
• Authors: Liang Zhao, A. Shimae, Hiroshi Nagamochi
• Keywords: Average Processing Time, CIIT 2007, Communications, Individual Hitting Probabilities, Linear-search Based firewall