An Algorithm for Web Firewall Packet Scheduling Based on Delay Prediction

Transcription

1 An Algorthm for Web Frewall Pacet Schedulng Based on Delay Predcton Shchang XUAN, Kage AN, Wu YANG* Informaton Securty Research Center, Harbn Engneerng Unversty, Harbn, Helongjang, 5000, Chna Abstract As a nd of frewall worng at the applcaton layer, web frewall has been wdely adopted for ts complete functonalty. Due to worng prncple of web frewall the tedous process wth pacets reduces ts throughout. Web frewall s throughput s much lower than pacet flterng frewall. An algorthm based on access hstory s presented n ths paper, whch s used to estmate delay lmts of hgh frequency URL sessons. Its feasblty s verfed through experment. To tae advantage of the upper statstcal results, the output queue uses applcaton layer sesson feedbac to schedule pacets to mprove sesson delay. Fnally, the paper compares the average delay of the algorthm wth delay estmaton and no delay guarantee. The results show that the algorthm wth URL hstory approach can reduce the occurrence of long delay n less traffc, and t can effectvely reduce hgh frequency URL sesson delays n large flows. Fnally, the correctness of the method s verfed by experments. Keywords-web frewall; bloom delay predcton; delay dstrbuton I. INTRODUCTION In recent years, wth the rapd development of Internet, web applcatons have become the man carrer busness system by ts unque effcency, usablty and tmelness whch mae a lot of nsttutons transfer ther busness to web applcaton layer. E-commerce, e-government, onlne banng and socal networng mae web applcatons become an ndspensable part of peoples lfe. They are the man channel of access to nformaton. However, wth the rapd development of web applcatons, the securty stuaton s not optmstc, securty rss of web applcaton layer s more and more serous. Accordng to the system networ securty assocaton SANS statstcs, 60% of cyber attacs occurred n the web applcaton layer. Web frewall s the best soluton to protect web applcaton []. However, due to web frewall worng at applcaton layer, and faces wth larger web flows, ts complex pacet processng mechansm causes large delay of sesson. Ths wll mae users surfng on the Internet feel the slow networ. Serous when, t also can cause networ congeston. So how to avod the occurrence of the above stuaton, t has become a hot topc. Web sesson delay s assocated wth a TCP connecton. Web applcatons based on TCP protocol, use the relable data transmsson channels TCP provdes. Strct web sesson delay s defned as the data transmsson delay between the begnnngs to the ends. Because web data transmsson delay s much larger than TCP connecton establshment and dsconnecton, we can mae the delay between connecton establshment and dsconnecton as web sesson delay. In order to mprove web sesson delay, web frewall modules need to cooperate wth each other. As an mportant modules of web frewall, pacet schedulng mechansm must be researched. The artcle analyzes the web sesson delay and then puts forward the pacet schedulng algorthm based on tme delay estmaton. The paper manly ncludes web frewall pacet schedulng algorthm based on tme delay predcton of analyss, the prncple of algorthm and the analyss of result of the experment. The remander of ths paper s organzed as follows. Related Wors explans the research drectons of assocated wor and elucdates the nnovaton of the present wor. Algorthm Analyss, the prncple of the algorthm s proposed. Expermental Evaluaton, the experment s carred out to verfy the algorthm. Conclusons summarzes and analyss the algorthm. II. RELATED WORK The part of networ pacets from the source to the endto-end delay can be optmzed ncludng queung delay and processng delay. In queung delay, at present, there are two nds of common schedulng mechansms of buffer management: Round-Robn (RR) algorthms and Earlest Deadlne Frst (EDF) algorthm. Round-Robn algorthms are the smplest schedulng algorthms. The scheduler retreves a tas from a tas queue every tme through pollng the tas queue, whch can guarantee the equalty of the equty between the queues [2]. When appled to store-and-forward model, we can regard tas as pacet, the tas queue can be regarded as the output buffer, and the scheduler can be regarded as pacet forwardng thread. Ths model can guarantee the farness between queues. Earlest Deadlne Frst s a schedulng algorthm accordng to max queung delay pacet requests. It adopts greedy algorthm and maes pacet s prorty n buffer change wth pacet deadlne and pacet count. The closer of pacet deadlne, the hgher ts prorty, whch shows the Shortest-Job-Frst [3]. In ths study, the frewall processng delay s ncluded n the processng delay. In ths paper, we use the nowledge of queung theory, and many scholars have put forward the concept of queung theory [4-7]. In [8-8], many of the researchers focused on DOI 0.503/ IJSSST.a ISSN: x onlne, prnt

2 the development of frewall technology and performance optmzaton. Based on the above research, analyzes the pacet processng n web frewall and extracts the sesson delay by tang use of the sesson tme nterval between connecton and dsconnecton. An effectve adaptve pacet schedulng algorthm based on sesson delay predcton s put forward by research on pacet queue theory. III. ALGORITHM ANALYSIS Ths chapter analyzes the pacet processng n web frewall and extracts the sesson delay by tang use of the sesson tme nterval between connecton and dsconnecton. An effectve adaptve pacet schedulng algorthm based on sesson delay predcton s put forward by research on pacet queue theory. The algorthm combnes the extracted URL of the web frewall n HTTP layer [9] and weghts of send buffer schedulng to reduce the delay nfluence of web frewall s complex processng wth hgh frequency URL. A. Delay Predcton Prncple Accordng to pacet transmsson process n the networ, pacet delay between source to end s as follows: () Transmsson Delay: Tme consumed durng the source send data n the local ln. It s proportonal to the pacet sze and nversely proportonal to the local ln rate. Suppose there s a pacet, ts sze s L, and the ln rate s R, then the transmsson of the pacet wll be t trans L R. (2) Propagaton Delay: Tme consumed from sender to recever n the ln, whch s assocated wth transmsson medum and length of ln, has nothng to do wth pacet sze and pacet processng delay of devce. (3) Queung Delay: Durng data transmsson, the ln bandwdth s lmted to the sender. When the transmsson speed s greater than the ln bandwdth or conflcton occurs, the source can t send data n the ln tmely, whch can lead pacets accumulaton n the queue of sender and queung delay s comng. For the store-and-forward equpment, the pacet should wat for upper processng n the nput buffer durng the processng of pacet transmsson. The pacets wll accumulate n nput buffer when upper processng speed s less than the traffc arrval rate. Pacets wll get servce untl front pacets are processed. The tme pacet wats n the nput buffer s queung delay and queung delay also exsts n output buffer. So, queung delay s composed of nput and output queung delay for store-and forward queung model [20]. (4) Processng Delay: Ths part s manly caused by the router, nclude search path and the pacet access process. When there s a frewall n transmsson path, t s also affected by the frewall. For each web sesson, the whole sesson delay s composed of several networ pacet delay. They are closed related wth each other. Accordng to the classc queung theory model, the pacet arrval rate s n conformty wth the Posson dstrbuton. The average servce tme of pacet s t, so pacet queung delay n the queue s approxmate Posson dstrbuton. Consderng the characterstcs, web sesson delay conssts of two parts, the fxed tme delay and approxmate Posson dstrbute delay. Accordng to the nature of Posson dstrbuton, superposton of two ndependent Posson dstrbutons s a Posson dstrbute. Here s the proof: Suppose dstrbuton of pacet p and pacet p2 are { N( t), t 0 and { N2( t), t 0, and ther strength are and 2. Then ther superposton wll be follow: P Nt2 Nt , P N t N t N t N t P N t N t N t N t P N t N t N t N t P N t N t N t N t t2 t exp t2 t! 0 2t2 t exp 2t2! t 2 t2 t exp 2t2 t 0! C 2 t2 t exp 2t2 t! 0 2t2 t exp 2t2 t! Accordng to the composton of web sesson delay, ts dstrbuton s the sesson superposton of several pacet delay dstrbuton. So, web sesson delay dstrbuton should be smlar to the Posson dstrbuton. Fgure s delay dstrbuton hstogram of 000 tmes on the same page access. () DOI 0.503/ IJSSST.a ISSN: x onlne, prnt

3 Fgure. Web sesson delay dstrbuton Table shows the delay probabltes of dfferent scopes. Accordng to the data of table 2, web sesson delay and Posson dstrbuton model has hgher fttng degree. A large number of web sesson delay dstrbuton can be as a Posson dstrbuton. TABLE. WEB SESSION DELAY CUMULATIVE PROBABILITY delay lmt probablty delay lmt probablty Table 2 standard Posson dstrbuton can be descrbed as follow: x e PX ( x) 0! (2) TABLE 2. STANDARD POISSON DISTRIBUTION X Based on the above facts, f gven a certan amount of web sesson dstrbuton of a random samples. We can conclude the maxmum tme-delay n the near future accordng to a set of expectng probablty value p. B. Tme Delay Predcton Method Accordng to the prncple of analyss, f you can get recent web sesson delay, max sesson delay can be effectvely predcted. And measures can be too to process the sesson s pacet preferentally, ensures sesson tme delay. To avod the nterference of other factors on the sesson tme delay, the algorthm taes [clent IP, URL] as the ey value to dstngush web sessons. Frst: Countng amount of [clent IP, URL] n web frewall and the TCP quad nformaton assocated wth current sesson. Tme delay of current sesson can be calculated accordng to start and end of the sesson. Second: Searchng the URL sesson cache to fnd whether there s the same tem as current sesson. If found, correspondng sesson delay nformaton n the cache should be updated. The current cache entry access tme recently should be updated, ts average delay should be calculated and nterval of tme delay should be calculated accordng to mn delay and max delay. Otherwse, the oldest URL tem n cache should be replaced by current sesson s URL. Thrd: Unconcern sesson cache can be constructed wth the quad of URL tem n URL cache, whch wll notfy the bottom don t send ts pacets to the upper. Ths can reduce the networ congeston phenomenon caused by the upper bottlenec. At the same tme, weght of send buffer related wth URL sesson should ncrease to reduce queung delay of the unconcern sesson. Descrpton of how to update delay buffer wth URL sesson nformaton s as follow: Algorthm URL sesson delay update Input: recent sesson nformaton (url, TCP quad, sesson) Output: URL cache updated Begn The fnshed URL sesson U url, p Searchng n URL cache accordng to [url, p] two-tuples of URL sesson If found If URL cache s full Delete the oldest URL tem and nsert nformaton of Else U Insert nformaton of Update max delay U d max, mn delay d mn, average delay d and recent updatng avg tme t update of the URL tem. Else Fnd the mn t update and replace t by t update of U At the same tme, update ts max delay d, max mn delay d mn, average d avg and t update of URL tem DOI 0.503/ IJSSST.a ISSN: x onlne, prnt

4 Accordng to the nature of Posson dstrbuton, tems can be dvded nto N sectons wth max delay d max, mn delay dmn and average d avg. The -th secton correspondng to Posson dstrbuton s parameter. To ensure a relatvely low error and that tme delay of sesson s n a range related wth early statstcal delay nterval, delay bounds probablty p s too here. The large p, the large delay bound. For a processng HTTP sesson, f ts sesson delay s larger than hstorcal delay, the flow should be mared as a forwardng flow. When subsequent pacets of the flow are placed n the output queue, ncreasng the weght of correspondng output queue can ensure the sesson be forward preferentally, so as to ensure the tme delay of the sesson. Algorthm s descrbed as follows: Algorthm 2 updatng weghts of output queues nput:pacet belongs to useless sesson output:prorty q of queue, length l of queue Begn If the pacet belongs to useless sesson Increase weght of output queue, let q q Increase length of output queue l, let l l Else Increase length of output queue l, let l l Algorthm and 2 mae up the man part of URL tme delay predcton and the part can descrbed by algorthm 3. Algorthm 3 URL tem updatng and weghts of queue management Input: pacet contans HTTP layer content output: weght q of output queue Begn f(fnd_sesson(pacet)){ flow = fnd_flow(pacet); f(sessons tme larger than max delay){ flow.pr = true; else{ f(sesson_end(pacet)){ update-url-cache(flow); else{ f(sesson_end(pacet)){ flow = fnd_flow(pacet); node = buld node(flow); f(!cache_full()){ nsert_cache(node); else{ replace(oldest_node, node); f(the pacets flow.pr s true){ let q ++; In algorthm 3, f sesson delay s greater than the maxmum lmt, the flow of the sesson wll be mared as forwardng flow. Pacets of forwardng flow won t be delvered to applcaton layer, but wll be put n output buffer drectly. Durng update-url-cache, the mnmum, maxmum and average of URL tem wll be updated. The set of hstorcal sesson delays can be dvded by step t wth ts mnmum and maxmum. Then the recent maxmum delay bounds can be found by search table 2 wth gven probablty p. On condton that there s a sesson [ , whose mnmum delay s 76 mllseconds, maxmum delay s 396 mllseconds and average delay s 2 mllseconds. The set of sesson delay can be dvded nto 20 sectons wth step 6 mllseconds. Suppose that expected probt p=0.98. Accordng to table 2, sesson delay bounds s 72 mllseconds. C. Pacet Schedulng Based on Delay Predcton Wth the sesson delay bounds calculated n last secton, f sesson s delay s greater than maxmum delay of ts tem, the sesson should be forward by web frewall. Accordng to the prncple of frewall pacet schedulng, FIFO queue schedulng s a famlar method. To mprove delay of sesson that s greater than maxmum delay bounds, weght of pacet send buffer can ncrease. Then pacet n the relevant buffer can be forward preferentally and sesson delay can be mproved. In ths algorthm, every send buffer has a weght q, they are q, q 2,..., q. The basc composton unt of sesson s pacet rather than byte, so weght represents maxmum number be servced, that s lmt of number pacets should be sent all at once. Algorthm 4 pacet schedulng based on feedbac of sesson Input: count of pacets l, l 2, l 3 weght of queues q, q 2, q 3... output: amount of remnant pacets n output buffer l, l, l,..., and weght of output 2 3 buffer q, q 2, q 3 PSOS( l q, ) DOI 0.503/ IJSSST.a ISSN: x onlne, prnt

5 Begn set = ; whle( < ){ If l > 0{ If l > q { Send q pacets n th queue; let l = Else{ Send let set l - q ; l pacets n th queue; l = 0; q = ; let = + ; At the start, every queue has weght, whch presents the queues have the same prorty. When the schedulng thread serves queues, t wll consume a pacet of tme. Its ntal state s smlar to RR algorthms. However, weghts of queue s a dynamc change value wth sesson of applcaton layer. When there s a sesson wth hgher prorty, the weght of relatve output buffer should ncrease. The buffer can get more servces of schedulng thread later and queue delay of the sesson can reduce, sesson delay can reduce. IV. THE EXPERIMENT RESULT ANALYSIS The experment s performed n local networ to smulate prncple of web frewall and two models are used about output buffer. Throughput changes and pacet loss rate changes are contrasted wth the two models. The networ envronment of experment are as follows: Parameters of devces n ths experment are as table 3. TABLE 3. PARAMETER CONFIGURATIONS OF DEVICES Type of devce Memory sze bandwdth IP address Clent 3.33GB 00Mbps Clent GB 00Mbps Frewall 52MB 000Mps Apache server 6GB 000Mps swtch None 000Mps None In ths experment, the clents test congeston state of web frewall wth a stress test tool for http server, http_load. The software s a tool for web frewall and has character of parallel runnng. It s used to test the maxmum throughput and concurrency of web server. The system of clent s Wndows and the verson of http_load s 2.0. The tool can be used to test concurrent capabltes of server and control the flow. For example: http_load parallel 5 s 60 url.txt As above, url.txt stores testable url address, that s the path of document. 5 threads wll be created n ths command and they wll run 60 seconds for gettng documents n the fle unnterruptedly. The test s carred out n local networ and delay dstrbutons about delay predcton algorthm and others are contrasted. At the same tme, the algorthm s effect can be reflected by loss pacet rate changes. Fgure 2. Topology of networ The bandwdth of apache server s 000Mbps, and t s used to store web document. The clents test the apache server wth apache stress test tool. From the above fgure, t s obvous that the traffcs of clent flow through swtch, web frewall to apache server. Then the server return documents to clent through web frewall and swtch. Fgure 3. Average delay changes DOI 0.503/ IJSSST.a ISSN: x onlne, prnt

6 REFERENCES Fgure 4. Loss rate changes Fgure 3 shows that no matter URL sesson delay predcton algorthm or other algorthms s used, ther sesson delay ncreases wth count of threads ncreases. However, the former ncreases flatly and the latter steeply. The growth trend of URL delay predcton s much slower than latter when frewall s conjunctve(fgure 4). The fgures profs that URL sesson delay predcton can effectvely guarantee the sesson tme delay and reduce frewall s nfluence on the sesson tme delay especally when load s bgger. V. CONCLUSION Ths study analyzed the process of web sesson and pacet transmsson, proposed sesson delay predcton algorthm based on delay statstcs by usng the characterstcs of pacet transmsson and the propertes of Posson dstrbuton. By smulaton n local networ, ts correctness s verfed. The artcle mproved WRR algorthm when schedulng pacets n output queues. The pacet schedulng algorthm updates queue weght by nformaton of applcaton sesson that s tmeout. Usng the method, pacets wthout obvous prorty and sessons wth excessve delay can be forwarded preferentally. Fnally, the correctness of the method was verfed. The experment results show that URL statstcal method can reduce phenomenon of URL wth large delay and sesson tme delay can be guaranteed effectvely when load ncreases. ACKNOWLEDGMENTS Ths wor was funded by the Fundamental Research Funds for the Central Unverstes (HEUCF60605). The authors would le to than the edtors and anonymous revewers for ther valuable comments and feedbac, whch greatly mproved the qualty of ths paper. [] SANS Insttute, Top Cyber Securty Rss-Executve Summary, Avalable on [2] C. C. Chude-Olsah, U. A. Chude-Oonwo, K. A. Baar and G. Sulong, Fuzzy-based dynamc dstrbuted queue schedulng for pacet swtched networs, Journal of Computer Scence and Technology, vol.28, pp , 203. [3] A. Ioannou and M. G. Katevens, Ppelned heap (prorty queue) management for advanced schedulng n hgh-speed networs, IEEE/ACM Transactons on Networng, vol.5, pp , [4] L. Klenroc, Queueng systems, volume I: theory, 975. [5] R. Jan, The art of computer systems performance analyss: technques for expermental desgn, measurement, smulaton, and modelng, John Wley & Sons, 990. [6] H. Taag, Queueng Analyss, Vol. : Vacaton and Prorty Systems, NorthHolland, Amsterdam, 200. [7] D. Gross, Fundamentals of queueng theory, John Wley & Sons, [8] A. Mayer, A. Wool and E. Zsnd, Fang: A frewall analyss engne, Securty and Prvacy, 2000 S&P 2000 Proceedngs 2000 IEEE Symposum on, [9] J. Qan, S. Hnrchs and K. Nahrstedt, ACLA: A framewor for access control lst (ACL) analyss and optmzaton, Communcatons and Multmeda Securty Issues of the New Century: Sprnger, pp. 97-2, 200. [0] E. S. Al-Shaer and H. H. Hamed, Modelng and management of frewall polces, IEEE Transactons on Networ and Servce Management, vol., pp.2-0, [] E. Al-Shaer, H. Hamed, R. Boutaba and M. Hasan, Conflct classfcaton and analyss of dstrbuted frewall polces, IEEE journal on Selected Areas n Communcatons, vol. 23, pp , [2] M. G. Gouda and X. Y. Lu, Frewall desgn: Consstency, completeness, and compactness, Dstrbuted Computng Systems, 2004 Proceedngs 24th Internatonal Conference on, pp , [3] M. G. Gouda and A. X. Lu, Structured frewall desgn, Computer Networs, vol. 5, pp , [4] H. H. Hamed, A. El-Atawy and E.Al-Shaer, Adaptve Statstcal Optmzaton Technques for Frewall Pacet Flterng, INFOCOM, vol. 6, pp. -2, [5] L. Yuan, H. Chen, J. Ma, C. N. Chuah, Z. D. Su and P. Mohapatra, Freman: A toolt for frewall modelng and analyss, 2006 IEEE Symposum on Securty and Prvacy, pp. 5-23, [6] A. El-Atawy, T. Sama, E, Al-Shaer and H. L, Usng onlne traffc statstcal matchng for optmzng pacet flterng performance, IEEE INFOCOM th IEEE Internatonal Conference on Computer Communcatons, pp , [7] A. X. Lu and M. G. Gouda, Dverse frewall desgn, IEEE Transactons on Parallel and Dstrbuted Systems, vol. 9, pp , [8] G. Mshergh, L. Yuan, Z. Su, C. N. Chuah and H. Chen, A general framewor for benchmarng frewall optmzaton technques, IEEE Transactons on Networ and Servce Management, vol. 5, pp , [9] R. Feldng, J. Gettys, J. Mogul, H. Frysty, L. Masnter, P. Leach and T. Berners-Lee, Hypertext transfer protocol--http/., 999. [20] V. G. Abhaya, Z. Tar, P. Zeephongseul and A. Y. Zomaya, Performance analyss of EDF schedulng n a mult-prorty preemptve M/G/ queue, IEEE Transactons on Parallel and Dstrbuted Systems, vol. 25, pp , 204. DOI 0.503/ IJSSST.a ISSN: x onlne, prnt