Geodesic
A new approach for detecting and resolving anomalies in security policy of the external firewall module of the floodlight SDN controller
Modelirovanie i analiz informacionnyh sistem, Tome 25 (2018) no. 3, pp. 251-256.

Voir la notice de l'article provenant de la source Math-Net.Ru

In this paper, the authors analyze the developed PreFirewall network application for the Floodlight software defined network (SDN) controller. This application filters rules, which are added into the firewall module of the Floodlight SDN controller in order to prevent the occurrence of anomalies among them. The rule filtering method is based on determining whether the addition of a new rule will not cause any anomalies with already added ones. If an anomaly was detected while adding the new rule, PreFirewall application should be able to resolve it and must report the detection of the anomaly. The developed network application PreFirewall passed a number of tests. As a result of the stress testing, it was found that the time of adding a new rule, when using PreFirewall, substantially increases with increase in the number of previously processed rules. Analysis of the network application PreFirewall showed that while adding a rule (the most frequent operation), in the worst case it is necessary to compare it with all existing rules, which are stored as a two-dimensional array. Thus, the operation of adding a new rule is the most time-consuming and has the greatest impact on the performance of the network application, which leads to an increase in response time. A possible way to of solving this problem is to select a data structure used to store the rules, in which the operation of adding a new rule would be simple. After analyzing the structure of the policy rules for the Floodlight SDN controller, the authors noted that a tree is the most adequate data structure for its storage. It provides optimization of memory used for storing the rules and, more important, it allows to achieve the constant complexity of the operation of adding a new rule and, consequently, solving the performance problem of the network application PreFirewall. The article is published in the authors’ wording.
Keywords: firewall, Floodlight, hash table, network controller, policy tree, PreFirewall, rules anomalies resolving, SDN, software-defined network. 
@article{MAIS_2018_25_3_a0,
     author = {S. V. Morzhov and M. A. Nikitinskiy},
     title = {A new approach for detecting and resolving anomalies in security policy of the external firewall module of the floodlight {SDN} controller},
     journal = {Modelirovanie i analiz informacionnyh sistem},
     pages = {251--256},
     publisher = {mathdoc},
     volume = {25},
     number = {3},
     year = {2018},
     language = {en},
     url = {http://geodesic.mathdoc.fr/item/MAIS_2018_25_3_a0/}
}
TY  - JOUR
AU  - S. V. Morzhov
AU  - M. A. Nikitinskiy
TI  - A new approach for detecting and resolving anomalies in security policy of the external firewall module of the floodlight SDN controller
JO  - Modelirovanie i analiz informacionnyh sistem
PY  - 2018
SP  - 251
EP  - 256
VL  - 25
IS  - 3
PB  - mathdoc
UR  - http://geodesic.mathdoc.fr/item/MAIS_2018_25_3_a0/
LA  - en
ID  - MAIS_2018_25_3_a0
ER  - 
%0 Journal Article
%A S. V. Morzhov
%A M. A. Nikitinskiy
%T A new approach for detecting and resolving anomalies in security policy of the external firewall module of the floodlight SDN controller
%J Modelirovanie i analiz informacionnyh sistem
%D 2018
%P 251-256
%V 25
%N 3
%I mathdoc
%U http://geodesic.mathdoc.fr/item/MAIS_2018_25_3_a0/
%G en
%F MAIS_2018_25_3_a0
S. V. Morzhov; M. A. Nikitinskiy. A new approach for detecting and resolving anomalies in security policy of the external firewall module of the floodlight SDN controller. Modelirovanie i analiz informacionnyh sistem, Tome 25 (2018) no. 3, pp. 251-256. http://geodesic.mathdoc.fr/item/MAIS_2018_25_3_a0/

[1] Floodlight SDN OpenFlow Controller, https://github.com/floodlight/floodlight

[2] Morzhov S., Alekseev I., Nikitinskiy M., “Firewall application for Floodlight SDN controller”, International Siberian Conference on Control and Communications (SIBCON) (12–14 May, 2016, Moscow, Russia), 1–5

[3] OpenFlow Switch Specification, Version 1.4.0, http://networkstatic.net/wp-content/uploads/2013/10/openflow-spec-v1.4.0.pdf

[4] Cormen T., Leiserson C., Rivest R., Stein C., Introduction to Algorithms, 3rd., Massachusetts Institute of Technology Press, 2009 | MR