# Enforcing Optimal ACL Policies Using K-Partite Graph in Hybrid SDN
## 4 Proposed Solution
### Decision Tree Traversing for Multiple ACL Policies
#### 5.1.2 Graph Computation Time by Varying Number of Policies

In Figure 18, graph computation time by the varying number of policies is shown. In this graph, the number of policies varies from 10 to 100 while the number of switches is kept constant at size 20. As discussed in Section 5.1.1, due to separate tree traversing for each policy implementation, more time is required. When policies are varying, it means a large number of policies are being installed, so more time is required as indicated in the graph. The resulting graph shows that execution time for the proposed technique and existing technique is fairly less. We present the results using two different graphs; the first graph represents the results when policies are varying with a single value, i.e., 1, 2, 3, and so on. The second graph represents the computation time when policies vary by 10 units i.e., 10, 20, 30, etc. Figure 18a indicates the effects of varying number of policies while the number of switches is constant. In this graph, variation in policies is very small, so maximum computation time is 3.5 s for the existing approach while for the proposed approach it is about 1.3 s. Results indicate 40% increase in computation time when the number of policies are going to increase. In Figure 18b a big change in computation time can be observed. We change the number of policies with a difference value of 10. So, the resulting graph shows a 50-60 percent increase in the time for graph computation. Figure 17: Simulation results of proposed and existing approaches for Graph Computation Time. (a) Computation Time when the Number of switches is varying and the number of policies is constant; (b) Computation Time when Number of switches is varying and number of policies is constant. ### Traffic Optimization

ACL policies implementation strategies play an important role in traffic optimization. If we efficiently implement policy, then we can eliminate not only unnecessary traffic but also CPU processing can be minimized. For example, if policies are implemented near source nodes, then it requires more processing power because each packet generated from the source node must pass through the filter. Similarly, if policies are implemented near designation nodes, then packets have to travel through the network and drop after reaching unauthorized destination nodes. In the second case, more unwanted traffic is generated. We need to minimize unwanted traffic. #### 5.2.1 Traffic Optimization by Varying Number of Policies

In Figure 19, unwanted traffic generated in the existing approach and proposed approach is compared. Network traffic can be optimized by using different policy schemes, i.e., near the source policy implementation scheme, near the destination policy scheme and optimized policy placement. We keep the number of switches constant at 25, the number of nodes is 50 and we change the number of policies as 10, 20, 30, 40, 50 and 60. For these three schemes, the ratio of unwanted traffic is measured for a different number of policies. Figure 19b shows that near the destination policy implementation scheme, we generate more unwanted traffic than other schemes. Because packets traverse from source to reach the destination node and then these packets are dropped. Near the source ACL policy implementation scheme generates less unwanted traffic but requires more processing power and more delay is observed in this case. Optimum policy implementation scheme decreases unwanted traffic and minimizes processing power. Figure 18: Simulation results of proposed and existing approaches for Graph Computation Time. (a) Computation Time when Number of policies is varying, and the number of switches is constant; (b) Computation Time when Number of policies is varying and number of switches is constant.