Firewall packet matching optimization using network traffic behavior and packet matching statistics

In this paper, we present a mechanism that utilizes network traffic behavior and packet matching statistics to optimize dynamically the ordering of the firewall filtering rules. The proposed technique segments the traffic space, calculates the matching rate for each filtering rule and deduces statistics means and variances over a predefined window of segments. The means and variances are used to update the positions of the filtering rules in the security policy. Through experiments using simulated firewall and network traffic generator, the proposed mechanism is shown to be efficient and easy to deploy in practical firewall implementation. This work demonstrates that the use of dynamic rule-ordering improves the filtering processing time and allows firewall administrators to analyze further the network traffic behavior and accordingly adjust the initial order of the filtering rules.