Traffic-aware firewall optimization strategies

Subrata Acharya, Jia Wang, Zihui Ge, Taieb F. Znati, Albert Greenberg

Research output: Chapter in Book/Report/Conference proceedingConference contribution

34 Citations (Scopus)

Abstract

The overall performance of a firewall is crucial in enforcing and administrating security, especially when the network is under attack. The continuous growth of the Internet, coupled with the increasing sophistication of the attacks, is placing stringent demands on firewall performance. In this paper, we describe a traffic-aware optimization framework to improve the operational cost of firewalls. Based on this framework, we design a set of tools that inspect and analyze both multidimensional firewall rules and traffic logs and construct the optimal equivalent firewall rules based on the observed traffic characteristics. To the best of our knowledge, this work is the first to use traffic characteristics in firewall optimization. Furthermore, we develop a novel adaptation mechanism that dynamically detects anomalous traffic behavior and adaptively alters the firewall rules to avoid serious performance degradation due to the traffic anomaly. To evaluate the performance of our approaches, we collected a large set of firewall rules and traffic logs at tens of enterprise networks managed by a Tier-1 service provider. Our evaluation results find these approaches very effective. In particular, we achieve more than 10 fold performance improvement by using the proposed traffic-aware firewall optimization.

Original languageEnglish
Title of host publication2006 IEEE International Conference on Communications, ICC 2006
Pages2225-2230
Number of pages6
DOIs
Publication statusPublished - 2006
Externally publishedYes
Event2006 IEEE International Conference on Communications, ICC 2006 - Istanbul, Turkey
Duration: Jul 11 2006Jul 15 2006

Publication series

NameIEEE International Conference on Communications
Volume5
ISSN (Print)0536-1486

Other

Other2006 IEEE International Conference on Communications, ICC 2006
Country/TerritoryTurkey
CityIstanbul
Period7/11/067/15/06

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Electrical and Electronic Engineering

Fingerprint

Dive into the research topics of 'Traffic-aware firewall optimization strategies'. Together they form a unique fingerprint.

Cite this