2026-09-19T16:13:59Zhttps://wakespace.lib.wfu.edu/server/oai/request

oai:null:10339/149172026-09-18T13:43:24Zcom_10339_14934col_10339_38132

Tapdiya, Ashish 2008-12-19T17:52:46Z 2010-06-18T19:00:03Z 2008-12-19T17:52:46Z 2010-06-18T19:00:03Z 2008-12-19T17:52:46Z https://wakespace.lib.wfu.edu/handle/10339/14917 Firewalls enforce a security policy by inspecting packets arriving or departing a network. This is accomplished by sequentially comparing the policy rules with the header of an arriving packet until the first match is found. This process becomes time consuming as policies become larger and more complex. For example, a firewall connecting two high speed networks is responsible for processing heavy network load and can easily become a bottleneck. Therefore determining the appropriate action for arriving packets must be done as quickly as possible. The process of packet header matching can be improved if more popular rules appear earlier in the policy. Unfortunately, a simple sorting algorithm is not possible, since the relative order of certain rules must be maintained in order to preserve the original policy intent. Using directed acyclical graphs to represent the firewall policy, this thesis shows that determining the best order of firewall rules is equivalent to job-shop scheduling, a known NP-Hard problem. The sorting techniques are novel in that they consider sub-graphs of rules (inter-related by precedence constraints) and compare the advantage of placing and merging the nodes that comprise them. For policy management, a shadow detection algorithm is presented to detect anomalies. en_US Wake Forest University Computer Science Network Security Network Firewalls Policy Optimization Policy Management Firewall Policy Optimization and Management Thesis Release the entire work for access only to the Wake Forest University system for one year from the date below. After one year, release the entire work for access worldwide. Dr. David J. John Dr. Errin W. Fulp Dr. Todd C. Torgersen Computer Science open.access