Network-based URL filtering (NUF) is one of the most widely used tools for detecting and stopping malicious and unwanted web traffic, like preventing children from sex. However, currently the conventional techniques still suffer from high bandwidth consumption due to millions of URL analysis requests to the network servers per day. In this paper, a model of NUF using a novel multi-level counting bloom filter (MLCBF) is proposed to address this issue. In the gateways of NUF, MLCBF is used to cache the analysis results from the network server to accelerate web traffic, alleviate the server load, and reduce bandwidth consumption of the entire NUF service. Analysis and trace-based experiments are employed to explore the properties of MLCBF and evaluate its performance in NUF. The results show that the proposed scheme typically eliminates at least 90% of memory requirements as compared to a general hashing table solution.

Stateful stream process engines in high availability clusters (HACs) track a large number of concurrent flow states and replicate them to backups to provide reliable functionality. Under high traffic loads, existing solutions in such HACs are expensive owing to precise stateful replication. This work presents two novel methods to address this issue: randomization on replication representation and a replication scheme designed for when system becomes overloaded. A hashing structure called Multilevel Counting Bloom Filter (MLCBF) is proposed as a low resource-consuming solution of stateful replication. Its performance and tradeoffs are then evaluated based on theoretic analysis and extensive trace-based tests. Trace-based simulation reveals that MLCBF reduces network and memory requirements of replication typically by over 90 percent for URL categorization. Most importantly, MLCBF is quite as simple and practical for implementation and maintenance. Moreover, an adaptive scheme called dynamic lazy insertion is designed to prevent replication from overloading system continuously and optimize the throughput of HAC. Testbed evaluation demonstrates its feasibility and effectiveness in an overloaded HAC.

To provide the reliable connectivity between two endpoints over the Internet, a firewall cluster for stateful high availability removes the single-point failure by replicating and maintaining TCP connection states to a backup firewall node, at the expense of the costs of network and system resources. In this paper, through trace-based simulations on a prototype implementation, we evaluate the overheads of different state replication methods with a tunable time-triggering parameter. Our evaluation results show that the overheads of precise replication are very high, especially for short flows. We find that a compact data structure employing randomization, a small delay on the replication operations, and host-level aggregation yield significant overhead reductions. Typically, the policy of delayed replication reducing 50% and 74.4% of bandwidth costs only excludes 1.9% and 3.4% of the protection on the pass-through traffic, respectively. These schemes and policies are efficient for alleviating peak system load, reducing the replication bandwidth consumption and still protecting the majority of Internet traffic bytes.

Stateful tracking is a popular technique in firewall filtering and state replication is used to provide reliable connectivity. This paper proposes a new approach for improving existing state replication protocols which ensure state consistency amongst the nodes of a stateful HA cluster. Our goal is to develop a new scheme which reduces the update overhead in the face of both low and high connection loads in order to maximize the capacity and scalability of a high availability cluster. A new representation called flow digest is proposed. Also the ways to use flow digest structures to update state changes, recover the connections after a failover, and solve the state inconsistency are presented. The main advantage of the proposed method is to reduce the bandwidth consumption on state replication. The simulation results show that the proposed scheme reduces the number of update messages and, more importantly, eliminates typically at least 86% of bandwidth consumption compared to current solutions.

This paper proposes a scalable and high available (HA) architecture for implementing cost effective security switches. In this architecture, each "security switch" consists of a traditional layer-2 switch and a "security switch engine (SSE)" which provides packet content inspection service. These two components are connected via a Gigabit Ethernet link. A mechanism is proposed to interconnect a group of "security switches" to provide the HA feature. A system of four security switches is implemented and the experimental results show that the HA function works successfully even only one SSE is active. The SSE is implemented with full intrusion prevention function on a standard high performance Industrial PC with the performance of 1.2Gbps for UDP packets and 400Mbps for TCP flows. Therefore the proposed security switch architecture can be realized in a very cost effective mechanism to provide Intranet protection.