Dynamic Ordering of Firewall Rules Using a Novel Swapping Window-based Paradigm

Abstract

Designing and implementing efficient firewall strategies in the age of the Internet of Things (IoT) is far from trivial. This is because, as time proceeds, an increasing number of devices will be connected, accessed and controlled on the Internet. Additionally, an ever-increasingly amount of sensitive information will be stored on various networks. A good and effi- cient firewall strategy will attempt to secure this information, and to also manage the large amount of inevitable network traffic that these devices create. The goal of this paper is to propose a framework for designing optimized firewalls for the IoT. This paper deals with two fundamental challenges/problems encountered in such firewalls. The first problem is associated with the so-called “Rule Matching” (RM) time problem. In this regard, we propose a simple condition for performing the swapping of the firewall’s rules, and by satisfying this condition, we can guarantee that apart from preserving the firewall’s consistency and integrity, we can also ensure a greedy reduction in the matching time. It turns out that though our proposed novel solution is relatively simple, it can be perceived to be a generalization of the algorithm proposed by Fulp [1]. However, as opposed to Fulp’s solution, our swapping condition considers rules that are not necessarily consecutive. It rather invokes a novel concept that we refer to as the “swapping window”. The second contribution of our paper is a novel “batch”- based traffic estimator that provides network statistics to the firewall placement optimizer. The traffic estimator is a subtle but modified batch-based embodiment of the Stochastic Learning Weak Estimator (SLWE) proposed by Oommen and Rueda [2]. The paper contains the formal properties of this estimator. Further, by performing a rigorous suite of experiments, we demonstrate that both algorithms are capable of optimizing the constraints imposed for obtaining an efficient firewall