# Enforcing Optimal ACL Policies Using K-Partite Graph in Hybrid SDN
## 4 Proposed Solution
### Decision Tree Traversing for Multiple ACL Policies
If ACL rules are installed at the ingress port of the switch, then a fewer number of rules are needed. When policies are implemented at proper places, then a fewer number of rules are required. * **End-to-End Delay Computation:** End-to-End delay defines the total time consumed for a data packet to be reached across a network from the source node to the destination node. End-to-End Delay = Number of switches + Transmission of N number of packets \(-\) (Transmission delay + Processing + Queuing). * **Successful Packet Delivery (SPD) ratio:** This implies the total number of packets received at destination nodes according to the specific policy to the total number of packets generated from the source nodes by considering different policy implementation schemes, i.e., near the source, near the destination, etc. We assume that there are a different number of policies and switches that vary from time to time. The approach adopted in [6] is an existing approach. It is necessary for the network administrator to implement policies on new interfaces according to specification. For this purpose, firstly, the network administrator will translate the network policy to corresponding network rules. Secondly, this policy will be configured on switches using ACL commands. This task requires a lot of time to implement policies properly on respective interfaces. We considered three different schemes for policy implementation; the first is policy implementation near the source nodes, the second way is to implement policy near the destination nodes, and the third one is to find some optimum policy placements. We perform each experiment about 30 times by varying different parameters like number of nodes, number of switches and number of policies, etc. We evaluated network traffic for several network topology combinations and reported the trends among these patterns in the form of results. Network traffic varies form 1 Mbps to 10 Mbps on the demand of network users. ### Graph Computation Time

In our proposed scheme, graph computation plays an important role. We need to use several graphs to find an optimization for ACL rules placement. We represent the network topology in the form of a graph that is transferred to a decision tree. After this step, we traverse this tree by using network topology for a specific policy to generate a K-partite graph. Then, the shortest path is computed for this K-partite graph to find a set of interfaces. In the existing technique, most of the work is done manually, while our approach performs all the operations of policy optimizing automatically. #### 5.1.1 Graph Computation Time by Varying Number of Switches

Figure 17 shows graph computation time for the existing and proposed techniques. In the existing technique, for each policy, a separate tree is traversed to install each policy in which allowed and not allowed options of policy tuple are traversed to restrict the network traffic according to ACL policy. In the proposed techniques, multiple policies are traversed using a single decision tree that saves the network operator's time for policy design and placement as well as time for policy computation. We performed these experiments in two phases; in the first phase, we vary the number of switches from 1 to 10 with a difference of precisely one switch while in second phase number of switches are varied from 5 to 50 where the difference number of switches is 5. The graph in Figure 17a shows the variation of switches according to the first phase. Results indicate that the computation time differs in small values, i.e., 0.1, 0.2, 0.3, etc. With the increase in the number of switches computation time increases. The graph in Figure 17b represents the execution time for 50 ACL policies and by varying number of switches in the network form 5 to 50. The graph curve indicates that in the proposed technique, less time is required to implement the same number of policies in hybrid SDN.