一种性能优化的防火墙规则匹配算法

摘要

This paper designed a firewall rule matching algorithm based on the idea of divide-and-conquer. In accordance with the protocol type, it divided the rules set into multiple sub-sets. Then, accordance with the relationship between two rules, each sub-set was divided into two groups : disordered group and sequence group. Furthermore, this paper designed hash function to match rules in disorded group, while it proposed indexing algorithm to match rules in the sequence group. The analysis shows that the efficiency of this algorithm is much better than similar algorithms, and it greatly improves the performance of the firewall.%设计了一种防火墙规则匹配算法,该算法基于分治思想将规则集按照协议类型分割为多个子集,并根据规则之间的关系,将各子集分为无序组和有序组,通过设计哈希函数和索引算法对两组规则进行分别匹配.分析表明,该算法的效率远优于同类算法,大大提高了防火墙的工作性能.