# AI-Based Approach to Firewall Rule Refinement on High-Performance Computing Service Network
###### Abstract  
High-performance computing (HPC) relies heavily on network security, particularly when supercomputing services are provided via public networks. As supercomputer operators, we introduced several security devices, such as anti-DDoS, intrusion prevention systems (IPSs), firewalls, and web application firewalls, to ensure the secure use of supercomputing resources. Potential threats are identified based on predefined security policies and added to the firewall rules for access control after detecting abnormal behavior through anti-DDoS, IPS, and system access logs. After analyzing the status change patterns for rule policies added owing to human errors among these added firewall log events, 289,320 data points were extracted over a period of four years. Security experts and operators must go through a strict verification process to rectify policies that were added incorrectly owing to human error, which adds to their workload. To address this challenge, our research applies various machine- and deep-learning algorithms to autonomously determine the normalcy of detection without requiring administrative intervention. Machine-learning algorithms, including naive Bayes, K-nearest neighbor (KNN), OneR, a decision tree called J48, support vector machine (SVM), logistic regression, and the implemented neural network (NN) model with the cross-entropy loss function, were tested. The results indicate that the KNN and NN models exhibited an accuracy of 97%. Additional training and feature refinement led to even better improvements, increasing the accuracy to 98%, a 1% increase. By leveraging the capabilities of machine-learning and deep-learning technologies, we have provided the basis for a more robust, efficient, and autonomous network security infrastructure for supercomputing services. network security; machine learning; deep learning; firewall; rule management; high-performance computing service network +
Footnote †: journal: Medical  
5,000,000 instances. The KNN classifier outperformed the other classifiers. Support vector machine (SVM) was used to classify the firewall logs in [8]. Various activation functions, including linear, polynomial, sigmoid, and radial-basis functions (RBFs) were used for the SVM classification. Among these, the SVM with the sigmoid function and a training dataset of 65,532 instances showed the best performance. Several neural network (NN) models have been applied to develop basic classification models for deep learning-based classification, as seen in [9; 10; 11]. In the previously mentioned studies, machine-learning algorithms were used to classify DROP or PASS actions from firewall event logs. However, the trained dataset was exclusively generated using firewall log-generation tools and did not originate from a real service environment. The existing issues in these studies were addressed as follows:  
* The gathered firewall event logs contain vast amounts of data, which vary with the status of cyberattacks. To extract the required data for analysis from this raw data, a database specifically tailored for research must be created. A suitable database that conforms to the specific properties of the collected logs must be constructed to efficiently store and process big data. This database should be designed to handle the high-speed processing demands inherent in big-data analysis. * When abnormal events are detected, they are classified as attacks based on set thresholds and added to block policies. However, human errors, such as administrator mistakes, can lead to policy mishaps. Proactively identifying and correcting misclassifications by monitoring and analyzing traffic data during firewall event changes improves the cyber security response. * The machine-learning analysis of firewall logs is limited because the firewall has only a five-tuple policy rule. To enhance the accuracy in real service networks, additional methods or artificial intelligence (AI)-based models must be explored. Improved models provide automated threat detection and response capabilities to administrators.