Firewall Packet Filtering Optimization using Statistical Traffic Awareness Test

Transcription

1 Firewall Packet Filtering Optimization uing Statitical Traffic Awarene Tet Zouheir Trabel Liren Zhang and Safaa Zeidan Faculty of Information Technology UAE Univerity Al-Ain, UAE {trabel lzhang, Abtract. In thi paper, we preent a mechanim that utilize network traffic behavior and packet filtering tatitic to improve firewall performance. The propoed mechanim allow optimizing the filtering rule order and their correponding field order upon certain threhold qualification following the divergence of the traffic behavior. The current and previou traffic window tatitic are ued to check the ytem tability uing Chi-Square Tet. The achieved gain in proceing time compared to related mechanim i due to minimizing the overhead correponding to the frequency of updating the ecurity policy rule/field tructure. Keyword: Packet Claification, Rule Order, Rule-field Order, Sytem Stability, Chi-quare Tet. 1 Introduction In thi paper, we propoe a mechanim to optimize firewall early acceptance path a well a early rejection path. Baed on traffic tatitic, a deciion i made regarding whether or not there i a need to reorder the rule and/or rule-field order. The propoed mechanim i baed on the following three optimization level: 1) Filtering rule are reordered in a decending manner according to their packet matching hitogram. Thi will yield to fater packet filtering time for the next imilar traffic (optimization in the acceptance path). ) Rule-field are reordered in a decending manner according to their packet not matching hitogram. Thi will reduce the time needed for tuple comparion (optimization in the rejection path). 3) The firewall will continue filtering packet uing certain rule and rule-field order under a certain threhold qualification (the ytem tability deciion). Thi will reduce the time needed for the reordering proce and updating the firewall ecurity policy tructure. The three optimization level will minimize the total packet filtering time and therefore the firewall performance will be improved ignificantly. The paper i organized a follow: Section dicue the related work. Section 3 preent the mathematical model of the propoed mechanim. Section 4 evaluate the adfa, p. 1, 011. Springer-Verlag Berlin Heidelberg 011

2 firewall performance againt the propoed mechanim. Finally, Section 5 conclude the paper. Related Work The mot early reearch work on firewall focu on the improvement of packet earching time uing variou mechanim including hardware-baed olution [6, 7], pecialized data tructure [8, 9, 5, 10, 11, 1], and heuritic [5]. Reearch work in [17, 3, 4, 13 and 14] focu on the tatitical filtering cheme to improve the average packet filtering time. The tructure of earching by taking into account the packet flow dynamic i introduced in [3, 14, 15, 16]. The idea of firewall optimization through early packet rejection wa introduced in [1,, 3, 1and 18]. In [1] early packet rejection i done through rule- field ordering. In [] early packet rejection i done through multilevel filtering proce including field and interection filtering module. In [3] a new approach named FVSC i propoed to optimize the rejection path. PBER technique in [18] i conidered a a generalization of FVSC [3] it find hort cut for both accepted and rejected packet. In [1] a binary earch on prefix length algorithm i applied to every policy filtering field along with the property of playing the earch tree node while maintaining the min-node at high level for early packet rejection. The mot relative to thi paper i reearch work dealing with rule reordering which fall into two categorie: Rule reordering including dependency a in[16, 3,] thee reearch work give an approximation of the optimal rule order. Dijoint Rule reordering a in [4, 5]. Up to our knowledge all reearch work done in the field of firewall optimization through rule reordering, emphai on the importance of rule field reordering in early packet rejection. In [1] we were the firt to propoe the idea of rule-field reordering and focu on it major effect in reducing the overall packet proceing time. 3 PROPOSED WORK In thi paper, we ue the Firewall Deciion Tree Tool (FDT) decribed in [6]. FDT tool releae the dependency relation between rule. A a reult, the filtering rule can be reordered according to their matching frequencie. The mathematical model in thi paper i baed on rule and rule-field hitogram propoed in [1]. A mechanim named Dynamic Rule and Rule-Field Ordering (DR- RFO) i propoed in [1]. In which the reordering proce i carried out at the end of each network traffic window. Thu, in thi paper we propoe a mechanim named Dynamic Rule and Rule-Field Ordering with Deciion Tet (DR-RFOD) to organize the reordering proce according to the ytem tability tet. Since the propoed work in thi paper ue the rule and rule-field hitogram, we will decribe them in more detail in the following ection. Then we will dicu the deciion regarding the rule/rule-field reordering procee.

3 3.1 Mathematical model Hitogram of rule matching probability and field not matching probability. Conidering that packet matching tet in firewall i baed on a ecurity policy with N rule, excluding the default Deny rule. Each rule conit of a maximum number of M field, excluding the action field. A N M matrix vector F( repreent the ecurity policy, that i: 1) F(1,1)... F(1,... F(1, M1) F( F( 1)... F(... F( Mi ) N) F( N,1)... F( N,... F( N, M N ) (1) Where iϵ{1,,,n} and j ϵ{1,,,m i } are the indice for rule and field repectively. Let a w, ( l and b w, ( l repreent the tatu of the l th packet matching and not matching an active field F( in rule, repectively. Where w (w ϵ{1,,,w}), ( ϵ{1,,,s}) and l(l ϵ{1,,,l}) are the window, egment and packet indice, repectively. During the proce, when the l th packet matche the field F( in the rule, the tate value of a w, ( l i incremented by 1, while b w, ( l remain no change. That i: aw, l aw, l1 1 bw, l bw, l1 By contrat, when the l th packet doe not match the field F(in the rule, the tate of b w, ( l i incremented by 1, while a w, ( l remain no change. That i: () aw, l aw, l1 bw, l bw, l1 1 (3) Note that if the l th packet i not teted for the field F( in the rule, the tate value of a w, ( l and b w, ( l remain no change. That i: a b w, w, l l a b w, w, Let C w, (=a w, (M i ) and D w, (=b w, ( preent the number of packet in the th egment matching rule i=1,,,n and not matching field F( j=1,,,mi contained in on egment ba repectively. Therefore, the probability of packet matching rule on egment bai can be defined a: P r l1 l1 w, C ( for 1 i N (4) C (, (5) L w

4 Likewie, the probability of packet not matching field F( j=1,,,mi in the rule on egment bai can be defined a: Pr D w, Dw, (1,1) L Dw, (1, j1 L Dw, (1, k) 1 k Dw, ( 1) Mi1 Dw, ( i 1, k) k1 Dw, M i 1 j1 Dw, ( i 1, k) Dw, k) k1 k1 for i 1, j 1 for i 1, j M1 for i N, j 1 for i N, j Mi (6) More explanation can be found in [1]. At the end of each window there will be an average probability for each rule and field which give u a further indication of the importance of that rule or field, that i: Pr Pr Where P r R w ( ) ( F j ) ) ( C ( i )) S Pr w, i ) w = 1 S for 1 i N (7) S Pr =1 i ) = w ( D ( j )) w, ( and P r F w F( in in the w th window, repectively. S for 1 i N,1 j Mi (8) ( are the average probabilitie for and Reordering Deciion. A-Statitical rule reordering deciion. Aume that the firewall conit of N filtering Rule with certain order in the previou window (w-1) th. We want to know if thi order will be changed or not in the w th window. Firt let u introduce ome notation to be ued in Table 1. Table 1. Previou and current ituation for policy filtering Rule. State(k) R 1 R R N Total Previou(w-1) n (w-1), 1 E (w-1),1 Current(w) n w,1 E w,1 n (w-1), E (w-1), n w, E w, n (w-1),n E (w-1),n n w,n E w,n Total C 1 C C N T Let n (w-1),i and n w,i (oberved value) are the number of matched packet by Rule in the (w-1) th and w th window, repectively. To know if there i a ignificant T (w-1) T w

5 difference between the oberved and expected value we ue the Chi-quare tet to tet the equality of two multinomial ditribution. That i: w N ( nk, i - Εk, i ) ( Rule ( N)) (9) E k( w1) i1 k, i where E k,i i the expected number of packet to be matched by in the current or previou window. That i: Tk Ci Ek, i for k w,( w 1)} (10) T If p_value ( ( Rule ( N)),dF)<α The ytem i not table and there i a need to reorder the ecurity policy rule according to hitogram of packet matching on window bai in decending order. The new rule ditribution will be computed uing the following equation, where 1 ( P _ value ) : P r ( ) w Pr ( ) w (1 ) P r ( ) w1 (11) Otherwie, if p_value ( ( Rule ( N)),dF)>α The ytem i table, no need to reorder the rule. The ame previou rule order will be ued for the next window and the rule hitogram will be renewed uing the above equation. The probability of the current window i given more weight. By doing thi the behavior of the traffic in the previou window will not be ignored and will have relatively le effect than the traffic behavior in the current window. A a reult the new computed average probabilitie would allow producing a better optimized rule ordering for the next window traffic. Thi procedure will be followed for each rule field. B)Statitical policy rule-field reordering deciion. Here, we dicu whether to decide to reorder the policy rule field or not uing the number of packet non-matching field F( in rule Where i ϵ{1,,,n}, j ϵ{1,,,m i }. So the ame concept of chi-quare ued in the previou ection will be applied for field of each rule in the ecurity policy a hown in table. That i: Where m k, j w Mi ( mk, j - Εk, j ) ( F( ) (1) E k( w1) j1 k, j (oberved) i the number of non-matched packet by F( in, k refer to the current or previou ituation. E k,j i the expected number of packet non matching F( in in the current or previou window. That i: TkC j Ek, j for k w,( w1)} (13) T

6 Table. Previou and current ituation for policy filtering Field for Rule R i. State(k) F 1 F F Mi Total Previou(w-1) m (w-1), 1 E (w-1),1 Current(w) m w,1 E w,1 m (w-1), E (w-1), m w, E w, m (w-1),mi E (w-1),mi m w,mi E w,mi Total C 1 C C Mi T ( F( ) i If p_value ( ),df)<α There i a need to reorder the field in according to hitogram of packet non matching F( in on window bai in decending order. The new F( ditribution in will be computed uing the following equation, where 1 ( P _ value ). P r F Pr F (1 ) Pr F w w w1 T (w-1) (14) Otherwie, if p_value ( χ ( F( j )) i ),df)>α no need to reorder the field in. Rule and rule-field reordering procee are independent of each other. Depending on ( Rule ( N)) and ( F( ) tet, the ytem may change the rule order without changing the field order and vice vera or changing only ome rule field order. The following algorithm how the main operation of the tatitical module. In Algorithm 1 the buildup of the candidate rule lit that are independent and equivalent to the original ecurity policy uing FDT tool take place a well a getting the initial rule and rule-field probabilitie to tart with after training the ytem S 0 egment. Algorithm i reponible for packet filtering proce uing function tuple_comparaion(l). Then it compute rule and rule-field tatitic (Line 1-13) and calculate the correponding egment probabilitie (Line 14-15). Line (18-19) compute the average rule and rule-field probability on window bai. ( F( ) and ( Rule ( N)) are computed in (Line 5-38). Alo, the reordering proce for rule-field and rule i done in a decending manner according to current average probability baed on if tatement in line 30 and 37. The current rulefield and rule average probability are computed in (Line 9 and 36). In (Line 38-4) the previou tate variable are updated to be ued in the next traffic window. Algorithm 1: Startup Phae 1: <SP> FDT(Policy Rule) : 0 1 3:l 0 1 4:repeat 5: iniialize(a 0,b 0) 6: whilel 0<=L 0 do 7: l 0 get_pak(f 0) 8: tuple_comparaion(l w) 9: l 0 l : end while 11: no_mat_r lat_field(a) 1: no_nonmat_f r r_field(b) T w

7 13: pr prob_rule (no_mat_r ) 14: pfield r prob_field(no_nonmat_f r) 15: : until 0=S 0 17: avgpr 0 avg(um(pr 0) 0=1:S0) 18: avgpfield r0 avg(um(pfield r0) 0=1:S0) 19: previou_r 0 um(no_mat_r 0) 0=1:S0 0: previou_rfield r0 um(no_nonmat_f r0) 0=1:S0 1: previou_avgpr 0 avgpr 0 : previou_avgpfield r0 avgpfield r0 Algorithm : Sytem Stability 1:w 1 : 1 3:repeat 4: l 1 5: repeat 6: iniialize(a,b) 7: whilel<=ldo 8: l w get_pak(f w) 9: tuple_comparaion(l w) 10: l l+1 11: end while 1: no_mat_r lat_field(a) 13: no_nonmat_f r r_field(b) 14: pr prob_rule (no_mat_r ) 15: pfield r prob_field(no_nonmat_f r) 16: +1 17: until=s 18: avgpr avg(um(pr ) =1:S ) 19: avgpfield r avg(um(pfield r) =1:S ) 0: //*current tate*// 1: current_r um(no_mat_r ) =1:S : current_rfield r um(no_nonmat_f r) =1:S 3: current_avgpr avgpr 4: current_avgpfield r avgpfield r 5://*Rule-Field tability tet*// 6: foreachr ϵ R 7: p_value r chi_quare(previou_rfield r, current_rfield r) 8: δ r 1- p_value r 9: current_avgpfield r (1- δ r)* current_avgpfield r + δ r * previou_avgpfield r 30: ifp_value r<α 31: Rule r reorder(rule r, current_avgpfield r) 3: end if 33: end for 34://*Rule tability tet*// 35: p_value R chi_quare(previou_r, current_r) 36: current_avgpr (1- δ r)* current_avgpr + δ r * previou_ avgpr 37: ifp_value R< α reorder(r, current_avgpr) 38: end if

8 Rule Order 39: /*update the previou tate*/ 40: previou_r current_r 41: previou_rfield r current_rfield r 4: previou_avgpr current_avgpr 43: previou_avgpfield r current_avgpfield r 44: w w +1 45:untilw=W 4 Evaluation 4.1 DR-RFOD v DR-RFO In order to evaluate the performance of the propoed mechanim, an algorithm that dynamically change the order of the rule and rule-field according to ytem tability ha been implemented uing MATLAB programming environment. Thi experiment i done uing 0 filtering rule and 00 traffic window each of 1000 packet. Thee number are ued jut to make it eay to trace the rule and field ordering poition proce uing both DR-RFO and DR-RFOD mechanim. DR-RFOD v DR-RFO according to rule reordering proce. The algorithm in DR-RFO and DR-RFOD mechanim tart optimizing the rule poition after treating the econd window. In DR-RFO mechanim poition of the rule are updated dynamically after treating each window. On the other hand, in DR- RFOD mechanim poition of the rule are updated dynamically according to eq. (9) and eq. (11) after ytem tability tet. Fig.1 compare the evolution in R1 a an example uing DR-RFO and DR-RFOD mechanim. The horizontal contant line in the figure how the correponding window for DR-RFOD mechanim where the ytem wa table according to eq. (9) and no rule reordering proce i done Rule 1 DRFO DRFOD Window No. Fig. 1. Evolution in R1 uing DR-RFO and DR-RFOD.

9 CumulativeExeTime() Field Order DR-RFOD v DR-RFO according to rule-field reordering proce. The ame concept ued in rule reordering proce will be ued in rule-field reordering proce. In DR-RFO mechanim poition of the rule-field are updated dynamically after treating each window. On the other hand, in DR-RFOD mechanim poition of the rule-field are updated dynamically according to eq. (1) and eq. (14) after ytem tability tet. Fig. compare the evolution for field Source-IP in R1 a an example uing DR-RFO and DR-RFOD mechanim. 9 8 Field Source-IP in R1 DRFO DRFOD Window No. Fig.. Evolution in Field Source-Port in R1 uing DR-RFO and DR-RFOD. Fig. 3 how the cumulative proceing time for DR-RFO and DR-RFOD for different value of α. For α=0.005, the gain for uing DR-RFOD for 00 traffic window i (), while for α=0.05 the gain i18.855() DRFD for different alfa v DRF DRF DRFD Alfa=0.5 DRFD Alfa=0.05 DRFD Alfa= Window No. Fig. 3. Cumulative proceing time for DR-RFOD v DR-RFO for different α value.

10 ExeTime() 4. The effect of error preciion (α) on DR-RFOD mechanim Thi experiment tudie the effect of different α value in the cumulative execution time and the number of rule/rule-field reordering proce. Fig.4 give an idea about the execution time needed for each of the 00 window for different α value Execution time for different Alfa Alfa=0.5 Alfa=0.05 Alfa= Window No. Fig. 4. Execution time for DR-RFOD for different α value. Table 3 compare different value of α and their correponding number of rule/rule-field reordering proce. When α decreae: 1) The frequency of the reordering proce i alo decreaed thi i becaue for a given computed χ, decreaing the value of α will increae χ α ending with χ α >computed χ and therefore no need for reordering. ) The cumulative execution time increae. Thi i becaue in fact when we decide not to reorder we might keep the ytem running with a non-efficient configuration (order) for longer time and therefore it might take longer execution time than when we reorder often epecially if the cot of re-ordering i mall and thi depend on the number of rule and rule-field in the ecurity policy. Table 3. The effect of different alfa in reordering frequency and cumulative proceing time α No. Reordering Rule/Field Cumulative Proceing Time ()DR-RFOD R RF Total ()

11 5 Concluion In thi paper, we have propoed a mechanim to improve firewall packet filtering time through optimizing the order of ecurity policy filtering rule and rule-field. The propoed mechanim i baed on reordering rule and rule-field according to packet matching and non-matching hitogram, repectively. The current and previou traffic window tatitic are ued to check the ytem tability uing Chi-Square Tet. If the ytem tability tet indicate that the firewall i table the ame current rule and/or rule-field order are ued for filtering the next traffic window. Otherwie, an update of the rule and/or rule-field order tructure i required for filtering the next traffic window. The propoed mechanim give better cumulative execution time compared to DR-RFO mechanim. Alo, the effect of α on the cumulative proceing time and on the frequency of the reordering proce ha been dicued. In future work, we intend to invetigate the effect of dynamically changing the traffic window ize, and improve the propoed mathematical model to take into conideration ecurity policy with dependent rule. 6 Acknowledgment The author acknowledge the upport of NRF Foundation and Emirate Foundation through reearche grant 1T03 and 009/161, repectively. 7 Reference 1. Z. Trabel L. Zhang and S. Zeidan. Packet Flow Hitogram to Improve Firewall Efficiency. In ICICS, December 011. Z. Trabel S. zeidan. Multilevel Early Packet Filtering Technique baed on Traffic Statitic and Splay Tree for Firewall Performance Improvement. In ICC, June K. Lan and J. Heidemann. On the correlation of internet flow characteritic. Technical Report ISI-TR-574, USC/ISI, A. El-Atawy, T. Samak, E. Al-Shaer and H.Li. Uing online traffic tatitical matching for optimizing packet filtering performance. IEEE INFOCOM 07, page , P. Gupta and N. McKeown. Algorithm for packet claification. IEEE Network, 15():4 3, F. Baboecu and G. Varghee. Scalable packet claification. In ACM SIGCOMM 01, A. J. McAulay and P. Franci. Fat routing table lookup uing CAM. In IEEE INFOCOM 93, March V. Srinivaan, Subhah Sur and George Varghee. Packet claification uing tuple pace earch. In Computer ACM SIGCOMM Communication Review, page , October A. Feldmann and S. Muthukrihnan. Tradeoff for packet claification. In IEEE INFOCOM 00, March P. Gupta and N. McKeown. Packet claification uing hierarchical intelligent cutting. In Interconnect VII, Augut 1999.

12 11. E. Cohen and C. Lund. Packet claification in large ip: deign and evaluation of deciion tree claifier. In SIGMETRICS 05:Proceeding of the 005 ACM SIGMETRIC international conferenceon Meaurement and modeling of computer ytem, page 73 84, New York, NY, USA, 005. ACM Pre. 1. Thoma Y. C. Woo. A modular approach to packet claification: Algorithm and reult. In IEEE INFOCOM 00, page 113 1, March P. Gupta, B. Prabhakar, and S. Boyd. Near optimal routing lookup with bounded wort cae performance. In IEEE INFOCOM 00, L. Kencl and C. Schwarzer. Traffic-adaptive packet filtering of denial of ervice attack. In WOWMOM 06: The 006 International Sympoium on on World of Wirele, Mobile and Multimedia Network, page , Wahington, DC, USA, S. Acharya, M. Abliz, B. Mill and T.F. Znat Optwall: a hierarchical traffic-aware firewall, Proceeding of 14th Annual Network & Ditributed Sytem Security Sympoium (NDSS), San Diego, US, February H. Hamed and E. Al-hear: Dynamic Rule-ordering optimization for High-peed Firewall Filtering. In ASIACC 06, March 1-4, 006, Tuipe Taiwam. 17. H. Hamed, A. El-Atawy, and E. Al-Shaer. On Dynamic Optimization of Packet Matching in High-Speed Firewall, IEEE JOURNAL ON SELECTED AREAS IN COMMUNICATIONS, VOL. 4, NO. 10, OCTOBER E. Al-Shear, A. El-Atawy, T. Tran: Adaptive Early Packet filtering for Defending firewall againt DoS Attack. In Proceeding of IEEE INFOCOM, pp. 1-9, M. Waldvogel, G. Varghee, J. Turner, B. Plattner. Scalable High Speed IP Routing Lookup. In Proceeding of the ACM SIGCOMM (SIGCOMM 97), pp. 5-36, D. Sleator, R. Tarjan. Self Adjuting Binary Search Tree. Journal of the ACM, 3(3), pp , N. Nej A. Bouhououla: Dynamic Scheme for Packet Claification Uing Splay tree, Information Aurance and Security, pp. 1-9, H. Hamed, A. El-Atawy, and E. Al-Shaer. Adaptive tatitical optimization technique for firewall packet filtering. In IEEE INFOCOM 06, April I. Motherole and M. Reed. Optimizing Rule Order for a Packet Filtering Firewall. In SAR- SSI, W. Wang, H. Chen, J. Chen and B. Liu. Firewall rule Ordering baed on tatitical Model. In International Conference on Computer Enginnering and Technology, W. Wang, R. J W. Chen, B. Chen and Z. Li. Firewall Rule Sorting Baeb on Markov Model. In proceding of the International Sympoium on Data Privacy and E-Comerce, A. Liu and M.Gouda. Complete redundancy detection in firewall. In proceding of 19 th Annual IFIP Conference on Data and Application Security, Augut 005.