Adaptive Conflict-Free Optimization of Rule Sets for Network Security Packet Filtering Devices

Andrea Baiocchi,Daniele Goretti,Gianluca Maiolini,Annachiara Mingo

doi:10.1155/2015/872326

Andrea Baiocchi, Daniele Goretti + Show 2 more

Open Access

https://doi.org/10.1155/2015/872326

Copy DOI

Abstract

Packet filtering and processing rules management in firewalls and security gateways has become commonplace in increasingly complex networks. On one side there is a need to maintain the logic of high level policies, which requires administrators to implement and update a large amount of filtering rules while keeping them conflict-free, that is, avoiding security inconsistencies. On the other side, traffic adaptive optimization of large rule lists is useful for general purpose computers used as filtering devices, without specific designed hardware, to face growing link speeds and to harden filtering devices against DoS and DDoS attacks. Our work joins the two issues in an innovative way and defines a traffic adaptive algorithm to find conflict-free optimized rule sets, by relying on information gathered with traffic logs. The proposed approach suits current technology architectures and exploits available features, like traffic log databases, to minimize the impact of ACO development on the packet filtering devices. We demonstrate the benefit entailed by the proposed algorithm through measurements on a test bed made up of real-life, commercial packet filtering devices.

Highlights

A key challenge of secure systems is the management of security policies, from high level ones down to the platform specific implementation
The growth of communication links speed brings forward a need for improved performance of packet filtering devices, such as firewalls and secure Virtual Private Networks (S-VPN) gateways
We show that Adaptive Conflict-Free Optimization (ACO) is effective in detecting and reacting to Denial of Service (DoS)/DDoS attacks by relieving CPU load and protecting legitimate traffic

Summary

Introduction

A key challenge of secure systems is the management of security policies, from high level ones down to the platform specific implementation. The growth of communication links speed brings forward a need for improved performance of packet filtering devices, such as firewalls and secure Virtual Private Networks (S-VPN) gateways. To improve performance while maintaining consistency, network security policies should be tailored according to the network traffic. The process of inspecting incoming packets and looking up the policy rule set for a match often results in CPU overload and packet delay or even loss. As a matter of fact, rule lists do not exceed few hundreds active rules in well-maintained, operational packet filtering devices. Packets that match high rank rules require a small computation time compared to those that require scanning the whole rule set. Having packets matching high rank rules is not so unlikely; for example, typically undesired or unpredicted traffic is essentially dealt with by the “deny all” rule

Objectives

Results

Conclusion