FPC: A New Approach to Firewall Policies Compression

• 来源期刊: 清华大学学报自然科学版（英文版）
• 年，卷（期）: 2019,（1）
• 页码范围: 65-76
• 页数: 12页
• 语种: 英文
• DOI: 10.26599/TST.2018.9010003

摘要

Firewalls are crucial elements that enhance network security by examining the field values of every packet and deciding whether to accept or discard a packet according to the firewall policies.With the development of networks,the number of rules in firewalls has rapidly increased,consequently degrading network performance.In addition,because most real-life firewalls have been plagued with policy conflicts,malicious traffics can be allowed or legitimate traffics can be blocked.Moreover,because of the complexity of the firewall policies,it is very important to reduce the number of rules in a firewall while keeping the rule semantics unchanged and the target firewall rules conflict-free.In this study,we make three major contributions.First,we present a new approach in which a geometric model,multidimensional rectilinear polygon,is constructed for the firewall rules compression problem.Second,we propose a new scheme,Firewall Policies Compression (FPC),to compress the multidimensional firewall rules based on this geometric model.Third,we conducted extensive experiments to evaluate the performance of the proposed method.The experimental results demonstrate that the FPC method outperforms the existing approaches,in terms of compression ratio and efficiency while maintaining conflict-free firewall rules.