# Mathematical Performance Evaluation Model for Mobile Network Firewall Based on Queuing

Authors: Shichang Xuan; Dapeng Man; Jiangchuan Zhang; Wu Yang; Miao Yu
Journal: Wireless Communications and Mobile Computing
 (2018)

---

## Abstract

While mobile networks provide many opportunities for people, they face security problems huge enough that a firewall is essential. The firewall in mobile networks offers a secure intranet through which all traffic is handled and processed. Furthermore, due to the limited resources in mobile networks, the firewall execution can impact the quality of communication between the intranet and the Internet. In this paper, a performance evaluation mathematical model for firewall system of mobile networks is developed using queuing theory for a multihierarchy firewall with multiple concurrent services. In addition, the throughput and the package loss rate are employed as performance evaluation indicators, and discrete-event simulated experiments are conducted for further verification. Lastly, experimental results are compared to theoretically obtained values to identify a resource allocation scheme that provides optimal firewall performance and can offer a better quality of service (QoS) in mobile networks.


---

## Body

## 1. Introduction

Due to the rapid development of mobile Internet technologies and the propagation of networks, the mobile Internet is progressively becoming significant part of everyone’s personal and professional lives. Consequently, the security issues of mobile networks tend to attract more attention. Packet-based filtering in traditional firewalls fails to satisfy the security requirements of the end users. Being an essential component of the entire trusted intranet, a traditional firewall suffers from the disadvantages of simple packet filtering and lower-layer processing. Compared to traditional firewalls, new firewalls are capable of comprehensive data analysis at the application layer, which defines higher-level processing and more comprehensive protection.Although new firewalls are able to provide a trusted intranet with better security, they consume large amounts of time for analyzing and processing the network packets because they require higher-level assessments and analysis. Furthermore, heavier traffic may reduce the processing efficiency. It makes the firewall prone to becoming a performance bottleneck for the communication between the intranet and the Internet, consequently reducing the quality of service (QoS) of mobile networks. To overcome this problem, limited system resources (such as number of threads and CPU) must be rationally assigned when developing a firewall. Modifying the assignment of resources may directly affect the overall system performance. In general, when developing systems such as firewall, the corresponding firewall performance test needs to be performed. The throughput of the current system needs to be tested and performance optimization be conducted by software engineers. Further tests should be carried out until the optimal resource allocation scheme is obtained. This method for testing and performance tuning is very time-consuming and complex. However, if a mathematical model is constructed to test the common performance indicators of the firewall, such as throughput and packet loss rate, considerable savings in developer labor costs may be achieved, and the optimal resource allocation system may be derived directly.In this paper, a performance evaluation model for the firewall system of mobile networks is proposed using the queuing theory. Generally, this model can be divided into two phases. Phase one involves handling the traffic at the lower layers, including examinations at the network layer and the transmission layer. Phase two involves handling the upper-layer applications, consisting of HTTP, IMAP, and DNS. Each phase involves concurrent processing with multiservice stations. A discrete-event simulated experiment is conducted to validate the model.The rest of the paper is organized as follows: Section2 reviews the current state of related research and designates the innovations proposed in this paper. Section 3 discusses the mathematical modeling of a firewall system for mobile networks. Section 4 describes the simulated experiments performed using the developed model and analyzes the results of conducted experiments. Finally, Section 5 summarizes the results and conclusions.


## 2. Related Work

With the increasing complexity of mobile network security issues, many researchers have been studying and analyzing firewall equipment. As the methods and means of network attacks continue to increase [1], the functions of firewall systems are being enhanced and extended gradually, for example, intrusion detection, DDoS attack detection, and user-behavior detection [2, 3]. Moreover, a number of researchers have conducted network security analysis. Peng et al. mainly performed analysis with respect to user behaviors [4–6]. Chen et al. provided a survey of security problems in mobile networks [7]. A resource optimization approach in mobile networks was proposed in [8] under imperfect prediction.The queuing theory, which has significant potential in terms of its application to the mathematical modeling of network equipment, may be useful for analyzing the performance of such equipment [9]. Some researchers have conducted modeling and analyzing of systems such as firewalls based on this theory, and they have made certain relatively advanced achievements in the study of network equipment performance. Herrmann constructed a vacation model for network service analysis, where batch arrival is used rather than the common Poisson flow [10]. Furthermore, in some studies, large-scale cloud services [11] have been modeled into a complex processing system with finite queues [12–14]. Salah et al. made considerable achievements by proposing a service system with a finite queue and single window, where packets arrive in a Poisson flow pattern and the service time follows a negative exponential distribution [15, 16]. Salah [17] found that the differences between the applicability of the Erlang distribution modeling and that of a Markov chain modeling have been compared. Zapechnikov et al. conducted an in-depth study based on Salah’s work. They proposed a two-phase service system, where Phase 1 was based on a Markov chain model and Phase 2 employed a hyper-Erlang distribution model [18]. Some researchers have also investigated cloud-service-based firewall systems [19, 20].Several recent studies have only compared modeling methods, while some have merely discussed the handling process of a single-service window or conducted simple hierarchical modeling [21]. However, neither can describe the firewall workflow nor depict its handling process in detail. With the advances in science and technology, the widespread use of multicore processors and the increased availability of resources in terms of equipment, it is becoming difficult for the above-mentioned methods to fully exploit hardware performance. In this paper, an in-depth examination is conducted with respect to these issues. Further, based on firewall handling and processing characteristics, a two-phase multiservice station [22] and multiprotocol firewall model with multiple concurrent applications is proposed, which is further employed to analyze the overall system performance [23].


## 3. Model Analysis

Using an Erlang queuing model, this paper proposes a two-phase multiservice station and multiprotocol firewall model with multiple concurrent applications. This model may be hierarchically divided into two phases. When a packet enters the system, it will first be processed on the basis of the rules at the network layer and the transmission layer and then handled by the DNS, FTP, and HTTP protocols. The process flow varies slightly with the characteristics of various protocols. The hierarchy of the firewall model is shown in Figure1.Figure 1
Hierarchy of the firewall model.The related parameters with respect to the model are defined as follows.λ denotes the arrival rate of packets that arrive at the firewall. In Phase 1, KL represents the phase 1 buffer, NL denotes the number of service windows for Phase 1, rL is the number of rules for Phase 1, and μL is the processing rate of each rule. Phase 2 is divided into three main parts, namely, DNS, FTP, and HTTP. Here, qD, qF, and qH denote the proportions of DNS, FTP, and HTTP traffic, respectively. In the DNS handling part, KD denotes the buffer, ND represents the number of service windows, rD represents the number of rules, and μD is the handling rate of each rule. The FTP handling component consists of FTP command handling operations and FTP data transmission handling operations. In terms of the FTP command handling part, KF1 denotes its buffer, NF1 represents its number of service windows, rF1 is the number of rules, and μF1 represents the handling rate of each rule. The FTP data transmission handling part may be divided into multiple transmissions. For example, n concurrent FTP data transmission handling operations are shown in Figure 2, where the traffic proportion is qF-i. Further, KF2-i represents the buffer for data transmission handling, NF2-i denotes the number of service windows for data transmission handling, rF2-i is the number of rules for data transmission handling, and μF2-1 denotes the handling rate of each rule. The HTTP part consists of HTTP-request line handling, HTTP-header handling, and HTTP-body handling. Here, qH-i denotes the traffic proportion of each HTTP application; KH1, KH2, and KH3-i denote the buffers for HTTP line handling, header handling, and body handling for each application, respectively; NH1, NH2, and NH3-i represent the number of service windows for HTTP-request line handling, header handling, and body handling for each application, respectively; rH1, rH2, and rH3-i denote the number of rules for HTTP line handling, header handling, and body handling for each application, respectively; and μH1, μH2, and μH3-i denote the handling rate of each rule for HTTP line handling, header handling, and body handling for each application, respectively.Figure 2
Submodule structure.The firewall model proposed in this paper refines a number of essential upper-layer handling processes in which the traffic flow proportion or number of applications may be easily modified. In addition, this model comprises the commonly used handling processes for DNS, FTP, and HTTP, each of which may be extended as an individual template for other upper-layer application protocols.


### 3.1. Low-Level Analysis

As shown in Figure1, the entire model consists of multiple single-buffer and multiconcurrent Erlang processes. Hence, the computation of the entire model may be based on cumulative computations of individual submodules. Packets enter the system sequentially, following a Poisson flow pattern; then, they wait in the buffer to be further handled by the concurrent service windows. Each service window comprises multiple subservice stations that correspond to each rule. The handling efficiency of the service windows follows an Erlang distribution. The structure of the submodules is shown in Figure 2.The following key formula may be derived on the basis of the results of the previous work.The distribution density function of the service time may be denoted by(1)ft=NμNμtr-1r-1!e-Nμtt≥0.Further,∂k denotes the probability that k packets arrive at the system during the service time of a packet:(2)∂k=∫0∞λxkk!e-λxfxdx.Hence, the following formula can be obtained:(3)∂k=λkk!Nμrr-1!·Γk+rλ+Nμk+r=λkk!Nμrr-1!·k+r-1!λ+Nμk+r.In addition,Pjk represents the state transition probability, that is, the probability that the number of network packets in the system changes from j to k at any arbitrary moment. The transition of states is correlated with the number of packet arrivals within the service time; hence, the relationship between Pjk and αk may be obtained as follows:(4)p0k=∂k0≤k≤K+N-2∑m=K+N-1∞∂mk=K+N-1j=0pjk=∂k-j+1j-1≤k≤K+N-2∑m=K+N-1∞∂mk=K+N-11≤j≤K+N-1.In terms of the steady-state probability of the system following the instantaneous exit of the packetsπk(0≤k≤K+N-1), the following relationship exists amongst various states:(5)πk=∑j=0K-1πjpjk0≤k≤K+N-1.The following may be derived:(6)πk=π0∂k+∑j=1k+1πj∂k-j+10≤k≤K+N-2.According to the regularity, we can derived(7)π0=11+∑k=1K-1πk/π0.The load offered at the network layer is given by(8)ρ=λ·rNμ.The packet loss rate is denoted by(9)ploss=pK=1-1-p0ρ=p0+ρ-1ρ.And the throughput is expressed by(10)γ=λ1-ploss.


### 3.2. Phase 1 Analysis

As shown in Figure1, it can be learned that Phase 1 hierarchy is consistent with the subhierarchy described above, where the arrival rate of the packets is λ, the buffer size is denoted by KL, the number of service windows is represented by NL, the number of rules is rL, and the service rate of the rules is indicated by μL.By applying the conclusion drawn in the previous section, it can be learned that the probability thatk packets arrive at a queue within the service time of a packet may be expressed by(11)∂k=λkk!NLμLrLrL-1!·k+rL-1!λ+NLμLk+rL.The state transition probability for Phase 1 is given by(12)p0k=∂k0≤k≤KL+NL-2∑m=KL+NL-1∞∂mk=KL+NL-1j=0pjk=∂k-j+1j-1≤k≤KL+NL-2∑m=KL+NL-1∞∂mk=KL+NL-11≤j≤KL+NL-1.The following formula may be obtained:(13)πk=∑j=0KL+NL-1πjpjk0≤k≤KL+NL-1.By performing ratio computation withπ0, we obtain(14)π0=11+∑k=1KL+NL-1πk/π0.Phase 1 packet loss rate is given by(15)ploss-L=1-1π0+λ·rL/NLμL.Phase 1 throughput is given by(16)γL=λ1-ploss-L.


### 3.3. Phase 2 Analysis

Phase 2 analysis is comparatively complex. It involves handling operations implemented by DNS, FTP, and HTTP. Phase 2 throughputs, that is, the overall throughput of the system, are jointly comprised of the throughputs from DNS, FTP, and HTTP.


#### 3.3.1. DNS Handling Analysis

As shown in Figure1, the DNS handling process is based on a single-phase concurrent Erlang model. If applications with similar handling processes exist in the system, the DNS handling process may be used as a template. During the DNS handling operations, the arrival rate of packets equals Phase 1 throughput γL∗qD, the buffer size is denoted by KD, the number of service windows is ND, the number of rules is represented by rD, and the service rate of the rules is indicated by μD.As with Phase 1 handling process, the probability thatk packets arrive at the queue during the service time of a packet may be expressed by(17)∂k=λkk!NDμDrDrD-1!·k+rD-1!λ+NDμDk+rD.The state transition probability for DNS handling operations is given by(18)p0k=∂k0≤k≤KD+ND-2∑m=KD+ND-1∞∂mk=KD+ND-1j=0pjk=∂k-j+1j-1≤k≤KD+ND-2∑m=KD+ND-1∞∂mk=KD+ND-11≤j≤KD+ND-1.The following formula may be obtained:(19)πk=∑j=0KD+ND-1πjpjk0≤k≤KD+ND-1.By performing ratio computation withπ0, the following formula is obtained:(20)π0=11+∑k=1KD+ND-1πk/π0.The packet loss rate for DNS handling operations is given by(21)ploss-D=1-1π0+λ·qD·rD/NDμD.The throughput for DNS handling operations is expressed by(22)γD=λ·qD1-ploss-D.


#### 3.3.2. FTP Handling Analysis

As shown in Figure1, the FTP handling process is based on a two-phase concurrent Erlang model. If applications with similar handling processes exist in the system, the FTP handling process may be used as a template. The FTP handling operations may be divided into two parts. When a packet arrives at the FTP handling process, it will first be processed by the FTP command handling module, followed by the filtering and analysis of the transmitted data.(  1) FTP Command Handling Operations. During the FTP command handling operations, the arrival rate of the packets equals Phase 1 throughput γL∗qF, the buffer size is denoted by KF1, the number of service windows is NF1, the number of rules is represented by rF1, and the service rate of the rules is μF1.The probability thatk packets arrive at a queue within the service time of a packet may be expressed by(23)∂k=λkk!NF1μF1rF1rF1-1!·k+rF1-1!λ+NF1μF1k+rF1.The state transition probability for FTP command handling operations may be expressed by(24)p0k=∂k0≤k≤KF1+NF1-2∑m=KF1+NF1-1∞∂mk=KF1+NF1-1j=0pjk=∂k-j+1j-1≤k≤KF1+NF1-2∑m=KF1+NF1-1∞∂mk=KF1+NF1-11≤j≤KF1+NF1-1.The following formula may be obtained:(25)πk=∑j=0KF1+NF1-1πjpjk0≤k≤KF1+NF1-1.By performing ratio computation withπ0, the following formula is obtained:(26)π0=11+∑k=1KF1+NF1-1πk/π0.The packet loss rate for FTP command handling operations is given by(27)ploss-F1=1-1π0+λ·qF·rF1/NF1μF1.The throughput for FTP command handling operations is denoted by(28)γF1=λ·qF1-ploss-F1.(  2) FTP Data Transmission Handling Operations. In terms of FTP data transmission handling operations, assume that there are n′ concurrent data transmission handling modules, and let i denote the ith data transmission handling module. The packet flow proportion for each data transmission handling module is denoted by qF-i. The arrival rate of packets equals the throughput for FTP command handling operations, γF1∗qF-i, the buffer size is KF2-i, the number of service windows is expressed by NF2-i, the number of rules is rF2-i, and the service rate of the rules is represented by μF2-i.The probability thatk packets arrive at a queue within the service time of a packet may be denoted by(29)∂k=λkk!NF2-iμF2-irF2rF2-i-1!·k+rF2-i-1!λ+NF2-iμF2-ik+rF2-i.The state transition probability for FTP data transmission handling operations is given by(30)p0k=∂k0≤k≤KF2-i+NF2-i-2∑m=KF2-i+NF2-i-1∞∂mk=KF2-i+NF2-i-1j=0pjk=∂k-j+1j-1≤k≤KF2-i+NF2-i-2∑m=KF2-i+NF2-i-1∞∂mk=KF2-i+NF2-i-11≤j≤KF2-i+NF2-i-1.The following formula may be obtained:(31)πk=∑j=0KF2-i+NF2-i-1πjpjk0≤k≤KF2-i+NF2-i-1.By performing ratio computation withπ0, the following formula is obtained:(32)π0=11+∑k=1KF2-i+NF2-i-1πk/π0.The packet loss rate for FTP data transmission handling operations is given by(33)ploss-F2-i=1-1π0+γF1·qF-i·rF2-i/NF2-iμF2-i.The throughput for FTP data transmission handling operations is denoted by(34)γF2-i=γF1·qF-i1-ploss-F2-i.The total throughput for FTP handling operations is expressed by(35)γF=∑i=1nγF2-i.


#### 3.3.3. HTTP Handling Analysis

As shown in Figure1, the HTTP handling process is based on a three-phase concurrent Erlang model. If applications with similar handling processes exist in the system, the HTTP handling process may be used as a template. The HTTP handling operations may be divided into three parts. When a packet arrives at the HTTP handling process, it will first be handled by HTTP-request line handling module; then, it will be processed by HTTP-header handling module, and finally, it will be handled by the HTTP-body handling module and delivered to upper-layer applications.(  1) HTTP-Request Line Handling Operations. In terms of HTTP-request line handling operations, the arrival rate of packets equals the throughput for Phase 1, γL∗qH, the buffer size is KH1, the number of service windows is denoted by NH1, the number of rules is rH1, and the service rate of the rules is expressed by μH1.The probability thatk packets arrive at a queue within the service time of a packet may be denoted by(36)∂k=λkk!NH1μH1rH1rH1-1!·k+rH1-1!λ+NH1μH1k+rH1.The state transition probability for HTTP-request line handling operations is given by(37)p0k=∂k0≤k≤KH1+NH1-2∑m=KH1+NH1-1∞∂mk=KH1+NH1-1j=0pjk=∂k-j+1j-1≤k≤KH1+NH1-2∑m=KH1+NH1-1∞∂mk=KH1+NH1-11≤j≤KH1+NH1-1.The following formula may be obtained:(38)πk=∑j=0KH1+NH1-1πjpjk0≤k≤KH1+NH1-1.By performing ratio computation withπ0, the following formula is obtained:(39)π0=11+∑k=1KH1+NH1-1πk/π0.The packet loss rate for HTTP-request line handling operations is given by(40)ploss-H1=1-1π0+λ·qH·rH1/NH1μH1.The throughput for HTTP-request line handling operations is denoted by(41)γH1=λ·qH1-ploss-H1.(  2) HTTP-Header Handling Operations. With respect to HTTP-header handling operations, the arrival rate of packets equals the throughput for the HTTP-request line handling operations, γH2, the buffer size is KH2, the number of service windows is represented by NH2, the number of rules is rH2, and the service rate of the rules is μH2.The probability thatk packets arrive at a queue within the service time of a packet may be denoted by(42)∂k=λkk!NH2μH2rH2rH2-1!·k+rH2-1!λ+NH2μH2k+rH2.The state transition probability for HTTP-header handling operations may be expressed by(43)p0k=∂k0≤k≤KH2+NH2-2∑m=KH2+NH2-1∞∂mk=KH2+NH2-1j=0pjk=∂k-j+1j-1≤k≤KH2+NH2-2∑m=KH2+NH2-1∞∂mk=KH2+NH2-11≤j≤KH2+NH2-1.The following formula may be obtained:(44)πk=∑j=0KH2+NH2-1πjpjk0≤k≤KH2+NH2-1.By performing ratio computation withπ0, the following formula is obtained:(45)π0=11+∑k=1KH2+NH2-1πk/π0.The packet loss rate for HTTP-header handling operations may be expressed by(46)ploss-H2=1-1π0+γH1·rH2/NH2μH2.The throughput for the HTTP-header handling operations may be expressed by(47)γH2=γH11-ploss-H2.(  3) HTTP-Body Handling Operations. In terms of HTTP-body handling operations, assume that there are n′ concurrent HTTP-body handling modules and let i denote the ith HTTP-body handling module. The packet flow proportion for each HTTP-body handling module is denoted by qH-i. The arrival rate of packets equals the throughput for the HTTP-header handling operations, γH2∗qH-i, the buffer size is KH3-i, the number of service windows is expressed by NH3-i, the number of rules is rH3-i, and the service rate of the rules is represented by μH3-i.The probability thatk packets arrive at a queue within the service time of a packet may be denoted by(48)∂k=λkk!NH3-iμH3-irH3rH3-i-1!·k+rH3-i-1!λ+NH3-iμH3-ik+rH3-i.The state transition probability for HTTP-body handling operations is given by(49)p0k=∂k0≤k≤KH3-i+NH3-i-2∑m=KH3-i+NH3-i-1∞∂mk=KH3-i+NH3-i-1j=0pjk=∂k-j+1j-1≤k≤KH3-i+NH3-i-2∑m=KH3-i+NH3-i-1∞∂mk=KH3-i+NH3-i-11≤j≤KH3-i+NH3-i-1.The following formula may be obtained:(50)πk=∑j=0KH3-i+NH3-i-1πjpjk0≤k≤KH3-i+NH3-i-1.By performing ratio computation withπ0, the following formula is obtained:(51)π0=11+∑k=1KH3-i+NH3-i-1πk/π0.The packet loss rate for HTTP-body handling operations may be denoted by(52)ploss-H3-i=1-1π0+γH2·qH-i·rH3-i/NH3-iμH3-i.The throughput for HTTP-body handling operations may be expressed by(53)γH3-i=γH2·qH-i1-ploss-H3-i.The total throughput for HTTP-body handling operations may be expressed by(54)γH=∑i=1n′γH3-i.The overall traffic handled by the firewall should be the sum of the traffic handled by DNS, FTP, and HTTP. The overall packet loss rate of the firewall is given by(55)ploss=ploss-L+qD·1-ploss-Lploss-D+qF·1-ploss-Lploss-F1+∑i=1nqFi·1-qF·1-ploss-Lploss-F1·ploss-F2-i+qH·1-ploss-Lploss-H1+1-qH·1-ploss-Lploss-H1·ploss-H2+∑i=1n′qHi·1-1-qH·1-ploss-Lploss-H1·ploss-H2·ploss-H3-i.


## 3.1. Low-Level Analysis

As shown in Figure1, the entire model consists of multiple single-buffer and multiconcurrent Erlang processes. Hence, the computation of the entire model may be based on cumulative computations of individual submodules. Packets enter the system sequentially, following a Poisson flow pattern; then, they wait in the buffer to be further handled by the concurrent service windows. Each service window comprises multiple subservice stations that correspond to each rule. The handling efficiency of the service windows follows an Erlang distribution. The structure of the submodules is shown in Figure 2.The following key formula may be derived on the basis of the results of the previous work.The distribution density function of the service time may be denoted by(1)ft=NμNμtr-1r-1!e-Nμtt≥0.Further,∂k denotes the probability that k packets arrive at the system during the service time of a packet:(2)∂k=∫0∞λxkk!e-λxfxdx.Hence, the following formula can be obtained:(3)∂k=λkk!Nμrr-1!·Γk+rλ+Nμk+r=λkk!Nμrr-1!·k+r-1!λ+Nμk+r.In addition,Pjk represents the state transition probability, that is, the probability that the number of network packets in the system changes from j to k at any arbitrary moment. The transition of states is correlated with the number of packet arrivals within the service time; hence, the relationship between Pjk and αk may be obtained as follows:(4)p0k=∂k0≤k≤K+N-2∑m=K+N-1∞∂mk=K+N-1j=0pjk=∂k-j+1j-1≤k≤K+N-2∑m=K+N-1∞∂mk=K+N-11≤j≤K+N-1.In terms of the steady-state probability of the system following the instantaneous exit of the packetsπk(0≤k≤K+N-1), the following relationship exists amongst various states:(5)πk=∑j=0K-1πjpjk0≤k≤K+N-1.The following may be derived:(6)πk=π0∂k+∑j=1k+1πj∂k-j+10≤k≤K+N-2.According to the regularity, we can derived(7)π0=11+∑k=1K-1πk/π0.The load offered at the network layer is given by(8)ρ=λ·rNμ.The packet loss rate is denoted by(9)ploss=pK=1-1-p0ρ=p0+ρ-1ρ.And the throughput is expressed by(10)γ=λ1-ploss.


## 3.2. Phase 1 Analysis

As shown in Figure1, it can be learned that Phase 1 hierarchy is consistent with the subhierarchy described above, where the arrival rate of the packets is λ, the buffer size is denoted by KL, the number of service windows is represented by NL, the number of rules is rL, and the service rate of the rules is indicated by μL.By applying the conclusion drawn in the previous section, it can be learned that the probability thatk packets arrive at a queue within the service time of a packet may be expressed by(11)∂k=λkk!NLμLrLrL-1!·k+rL-1!λ+NLμLk+rL.The state transition probability for Phase 1 is given by(12)p0k=∂k0≤k≤KL+NL-2∑m=KL+NL-1∞∂mk=KL+NL-1j=0pjk=∂k-j+1j-1≤k≤KL+NL-2∑m=KL+NL-1∞∂mk=KL+NL-11≤j≤KL+NL-1.The following formula may be obtained:(13)πk=∑j=0KL+NL-1πjpjk0≤k≤KL+NL-1.By performing ratio computation withπ0, we obtain(14)π0=11+∑k=1KL+NL-1πk/π0.Phase 1 packet loss rate is given by(15)ploss-L=1-1π0+λ·rL/NLμL.Phase 1 throughput is given by(16)γL=λ1-ploss-L.


## 3.3. Phase 2 Analysis

Phase 2 analysis is comparatively complex. It involves handling operations implemented by DNS, FTP, and HTTP. Phase 2 throughputs, that is, the overall throughput of the system, are jointly comprised of the throughputs from DNS, FTP, and HTTP.


### 3.3.1. DNS Handling Analysis

As shown in Figure1, the DNS handling process is based on a single-phase concurrent Erlang model. If applications with similar handling processes exist in the system, the DNS handling process may be used as a template. During the DNS handling operations, the arrival rate of packets equals Phase 1 throughput γL∗qD, the buffer size is denoted by KD, the number of service windows is ND, the number of rules is represented by rD, and the service rate of the rules is indicated by μD.As with Phase 1 handling process, the probability thatk packets arrive at the queue during the service time of a packet may be expressed by(17)∂k=λkk!NDμDrDrD-1!·k+rD-1!λ+NDμDk+rD.The state transition probability for DNS handling operations is given by(18)p0k=∂k0≤k≤KD+ND-2∑m=KD+ND-1∞∂mk=KD+ND-1j=0pjk=∂k-j+1j-1≤k≤KD+ND-2∑m=KD+ND-1∞∂mk=KD+ND-11≤j≤KD+ND-1.The following formula may be obtained:(19)πk=∑j=0KD+ND-1πjpjk0≤k≤KD+ND-1.By performing ratio computation withπ0, the following formula is obtained:(20)π0=11+∑k=1KD+ND-1πk/π0.The packet loss rate for DNS handling operations is given by(21)ploss-D=1-1π0+λ·qD·rD/NDμD.The throughput for DNS handling operations is expressed by(22)γD=λ·qD1-ploss-D.


### 3.3.2. FTP Handling Analysis

As shown in Figure1, the FTP handling process is based on a two-phase concurrent Erlang model. If applications with similar handling processes exist in the system, the FTP handling process may be used as a template. The FTP handling operations may be divided into two parts. When a packet arrives at the FTP handling process, it will first be processed by the FTP command handling module, followed by the filtering and analysis of the transmitted data.(  1) FTP Command Handling Operations. During the FTP command handling operations, the arrival rate of the packets equals Phase 1 throughput γL∗qF, the buffer size is denoted by KF1, the number of service windows is NF1, the number of rules is represented by rF1, and the service rate of the rules is μF1.The probability thatk packets arrive at a queue within the service time of a packet may be expressed by(23)∂k=λkk!NF1μF1rF1rF1-1!·k+rF1-1!λ+NF1μF1k+rF1.The state transition probability for FTP command handling operations may be expressed by(24)p0k=∂k0≤k≤KF1+NF1-2∑m=KF1+NF1-1∞∂mk=KF1+NF1-1j=0pjk=∂k-j+1j-1≤k≤KF1+NF1-2∑m=KF1+NF1-1∞∂mk=KF1+NF1-11≤j≤KF1+NF1-1.The following formula may be obtained:(25)πk=∑j=0KF1+NF1-1πjpjk0≤k≤KF1+NF1-1.By performing ratio computation withπ0, the following formula is obtained:(26)π0=11+∑k=1KF1+NF1-1πk/π0.The packet loss rate for FTP command handling operations is given by(27)ploss-F1=1-1π0+λ·qF·rF1/NF1μF1.The throughput for FTP command handling operations is denoted by(28)γF1=λ·qF1-ploss-F1.(  2) FTP Data Transmission Handling Operations. In terms of FTP data transmission handling operations, assume that there are n′ concurrent data transmission handling modules, and let i denote the ith data transmission handling module. The packet flow proportion for each data transmission handling module is denoted by qF-i. The arrival rate of packets equals the throughput for FTP command handling operations, γF1∗qF-i, the buffer size is KF2-i, the number of service windows is expressed by NF2-i, the number of rules is rF2-i, and the service rate of the rules is represented by μF2-i.The probability thatk packets arrive at a queue within the service time of a packet may be denoted by(29)∂k=λkk!NF2-iμF2-irF2rF2-i-1!·k+rF2-i-1!λ+NF2-iμF2-ik+rF2-i.The state transition probability for FTP data transmission handling operations is given by(30)p0k=∂k0≤k≤KF2-i+NF2-i-2∑m=KF2-i+NF2-i-1∞∂mk=KF2-i+NF2-i-1j=0pjk=∂k-j+1j-1≤k≤KF2-i+NF2-i-2∑m=KF2-i+NF2-i-1∞∂mk=KF2-i+NF2-i-11≤j≤KF2-i+NF2-i-1.The following formula may be obtained:(31)πk=∑j=0KF2-i+NF2-i-1πjpjk0≤k≤KF2-i+NF2-i-1.By performing ratio computation withπ0, the following formula is obtained:(32)π0=11+∑k=1KF2-i+NF2-i-1πk/π0.The packet loss rate for FTP data transmission handling operations is given by(33)ploss-F2-i=1-1π0+γF1·qF-i·rF2-i/NF2-iμF2-i.The throughput for FTP data transmission handling operations is denoted by(34)γF2-i=γF1·qF-i1-ploss-F2-i.The total throughput for FTP handling operations is expressed by(35)γF=∑i=1nγF2-i.


### 3.3.3. HTTP Handling Analysis

As shown in Figure1, the HTTP handling process is based on a three-phase concurrent Erlang model. If applications with similar handling processes exist in the system, the HTTP handling process may be used as a template. The HTTP handling operations may be divided into three parts. When a packet arrives at the HTTP handling process, it will first be handled by HTTP-request line handling module; then, it will be processed by HTTP-header handling module, and finally, it will be handled by the HTTP-body handling module and delivered to upper-layer applications.(  1) HTTP-Request Line Handling Operations. In terms of HTTP-request line handling operations, the arrival rate of packets equals the throughput for Phase 1, γL∗qH, the buffer size is KH1, the number of service windows is denoted by NH1, the number of rules is rH1, and the service rate of the rules is expressed by μH1.The probability thatk packets arrive at a queue within the service time of a packet may be denoted by(36)∂k=λkk!NH1μH1rH1rH1-1!·k+rH1-1!λ+NH1μH1k+rH1.The state transition probability for HTTP-request line handling operations is given by(37)p0k=∂k0≤k≤KH1+NH1-2∑m=KH1+NH1-1∞∂mk=KH1+NH1-1j=0pjk=∂k-j+1j-1≤k≤KH1+NH1-2∑m=KH1+NH1-1∞∂mk=KH1+NH1-11≤j≤KH1+NH1-1.The following formula may be obtained:(38)πk=∑j=0KH1+NH1-1πjpjk0≤k≤KH1+NH1-1.By performing ratio computation withπ0, the following formula is obtained:(39)π0=11+∑k=1KH1+NH1-1πk/π0.The packet loss rate for HTTP-request line handling operations is given by(40)ploss-H1=1-1π0+λ·qH·rH1/NH1μH1.The throughput for HTTP-request line handling operations is denoted by(41)γH1=λ·qH1-ploss-H1.(  2) HTTP-Header Handling Operations. With respect to HTTP-header handling operations, the arrival rate of packets equals the throughput for the HTTP-request line handling operations, γH2, the buffer size is KH2, the number of service windows is represented by NH2, the number of rules is rH2, and the service rate of the rules is μH2.The probability thatk packets arrive at a queue within the service time of a packet may be denoted by(42)∂k=λkk!NH2μH2rH2rH2-1!·k+rH2-1!λ+NH2μH2k+rH2.The state transition probability for HTTP-header handling operations may be expressed by(43)p0k=∂k0≤k≤KH2+NH2-2∑m=KH2+NH2-1∞∂mk=KH2+NH2-1j=0pjk=∂k-j+1j-1≤k≤KH2+NH2-2∑m=KH2+NH2-1∞∂mk=KH2+NH2-11≤j≤KH2+NH2-1.The following formula may be obtained:(44)πk=∑j=0KH2+NH2-1πjpjk0≤k≤KH2+NH2-1.By performing ratio computation withπ0, the following formula is obtained:(45)π0=11+∑k=1KH2+NH2-1πk/π0.The packet loss rate for HTTP-header handling operations may be expressed by(46)ploss-H2=1-1π0+γH1·rH2/NH2μH2.The throughput for the HTTP-header handling operations may be expressed by(47)γH2=γH11-ploss-H2.(  3) HTTP-Body Handling Operations. In terms of HTTP-body handling operations, assume that there are n′ concurrent HTTP-body handling modules and let i denote the ith HTTP-body handling module. The packet flow proportion for each HTTP-body handling module is denoted by qH-i. The arrival rate of packets equals the throughput for the HTTP-header handling operations, γH2∗qH-i, the buffer size is KH3-i, the number of service windows is expressed by NH3-i, the number of rules is rH3-i, and the service rate of the rules is represented by μH3-i.The probability thatk packets arrive at a queue within the service time of a packet may be denoted by(48)∂k=λkk!NH3-iμH3-irH3rH3-i-1!·k+rH3-i-1!λ+NH3-iμH3-ik+rH3-i.The state transition probability for HTTP-body handling operations is given by(49)p0k=∂k0≤k≤KH3-i+NH3-i-2∑m=KH3-i+NH3-i-1∞∂mk=KH3-i+NH3-i-1j=0pjk=∂k-j+1j-1≤k≤KH3-i+NH3-i-2∑m=KH3-i+NH3-i-1∞∂mk=KH3-i+NH3-i-11≤j≤KH3-i+NH3-i-1.The following formula may be obtained:(50)πk=∑j=0KH3-i+NH3-i-1πjpjk0≤k≤KH3-i+NH3-i-1.By performing ratio computation withπ0, the following formula is obtained:(51)π0=11+∑k=1KH3-i+NH3-i-1πk/π0.The packet loss rate for HTTP-body handling operations may be denoted by(52)ploss-H3-i=1-1π0+γH2·qH-i·rH3-i/NH3-iμH3-i.The throughput for HTTP-body handling operations may be expressed by(53)γH3-i=γH2·qH-i1-ploss-H3-i.The total throughput for HTTP-body handling operations may be expressed by(54)γH=∑i=1n′γH3-i.The overall traffic handled by the firewall should be the sum of the traffic handled by DNS, FTP, and HTTP. The overall packet loss rate of the firewall is given by(55)ploss=ploss-L+qD·1-ploss-Lploss-D+qF·1-ploss-Lploss-F1+∑i=1nqFi·1-qF·1-ploss-Lploss-F1·ploss-F2-i+qH·1-ploss-Lploss-H1+1-qH·1-ploss-Lploss-H1·ploss-H2+∑i=1n′qHi·1-1-qH·1-ploss-Lploss-H1·ploss-H2·ploss-H3-i.


## 3.3.1. DNS Handling Analysis

As shown in Figure1, the DNS handling process is based on a single-phase concurrent Erlang model. If applications with similar handling processes exist in the system, the DNS handling process may be used as a template. During the DNS handling operations, the arrival rate of packets equals Phase 1 throughput γL∗qD, the buffer size is denoted by KD, the number of service windows is ND, the number of rules is represented by rD, and the service rate of the rules is indicated by μD.As with Phase 1 handling process, the probability thatk packets arrive at the queue during the service time of a packet may be expressed by(17)∂k=λkk!NDμDrDrD-1!·k+rD-1!λ+NDμDk+rD.The state transition probability for DNS handling operations is given by(18)p0k=∂k0≤k≤KD+ND-2∑m=KD+ND-1∞∂mk=KD+ND-1j=0pjk=∂k-j+1j-1≤k≤KD+ND-2∑m=KD+ND-1∞∂mk=KD+ND-11≤j≤KD+ND-1.The following formula may be obtained:(19)πk=∑j=0KD+ND-1πjpjk0≤k≤KD+ND-1.By performing ratio computation withπ0, the following formula is obtained:(20)π0=11+∑k=1KD+ND-1πk/π0.The packet loss rate for DNS handling operations is given by(21)ploss-D=1-1π0+λ·qD·rD/NDμD.The throughput for DNS handling operations is expressed by(22)γD=λ·qD1-ploss-D.


## 3.3.2. FTP Handling Analysis

As shown in Figure1, the FTP handling process is based on a two-phase concurrent Erlang model. If applications with similar handling processes exist in the system, the FTP handling process may be used as a template. The FTP handling operations may be divided into two parts. When a packet arrives at the FTP handling process, it will first be processed by the FTP command handling module, followed by the filtering and analysis of the transmitted data.(  1) FTP Command Handling Operations. During the FTP command handling operations, the arrival rate of the packets equals Phase 1 throughput γL∗qF, the buffer size is denoted by KF1, the number of service windows is NF1, the number of rules is represented by rF1, and the service rate of the rules is μF1.The probability thatk packets arrive at a queue within the service time of a packet may be expressed by(23)∂k=λkk!NF1μF1rF1rF1-1!·k+rF1-1!λ+NF1μF1k+rF1.The state transition probability for FTP command handling operations may be expressed by(24)p0k=∂k0≤k≤KF1+NF1-2∑m=KF1+NF1-1∞∂mk=KF1+NF1-1j=0pjk=∂k-j+1j-1≤k≤KF1+NF1-2∑m=KF1+NF1-1∞∂mk=KF1+NF1-11≤j≤KF1+NF1-1.The following formula may be obtained:(25)πk=∑j=0KF1+NF1-1πjpjk0≤k≤KF1+NF1-1.By performing ratio computation withπ0, the following formula is obtained:(26)π0=11+∑k=1KF1+NF1-1πk/π0.The packet loss rate for FTP command handling operations is given by(27)ploss-F1=1-1π0+λ·qF·rF1/NF1μF1.The throughput for FTP command handling operations is denoted by(28)γF1=λ·qF1-ploss-F1.(  2) FTP Data Transmission Handling Operations. In terms of FTP data transmission handling operations, assume that there are n′ concurrent data transmission handling modules, and let i denote the ith data transmission handling module. The packet flow proportion for each data transmission handling module is denoted by qF-i. The arrival rate of packets equals the throughput for FTP command handling operations, γF1∗qF-i, the buffer size is KF2-i, the number of service windows is expressed by NF2-i, the number of rules is rF2-i, and the service rate of the rules is represented by μF2-i.The probability thatk packets arrive at a queue within the service time of a packet may be denoted by(29)∂k=λkk!NF2-iμF2-irF2rF2-i-1!·k+rF2-i-1!λ+NF2-iμF2-ik+rF2-i.The state transition probability for FTP data transmission handling operations is given by(30)p0k=∂k0≤k≤KF2-i+NF2-i-2∑m=KF2-i+NF2-i-1∞∂mk=KF2-i+NF2-i-1j=0pjk=∂k-j+1j-1≤k≤KF2-i+NF2-i-2∑m=KF2-i+NF2-i-1∞∂mk=KF2-i+NF2-i-11≤j≤KF2-i+NF2-i-1.The following formula may be obtained:(31)πk=∑j=0KF2-i+NF2-i-1πjpjk0≤k≤KF2-i+NF2-i-1.By performing ratio computation withπ0, the following formula is obtained:(32)π0=11+∑k=1KF2-i+NF2-i-1πk/π0.The packet loss rate for FTP data transmission handling operations is given by(33)ploss-F2-i=1-1π0+γF1·qF-i·rF2-i/NF2-iμF2-i.The throughput for FTP data transmission handling operations is denoted by(34)γF2-i=γF1·qF-i1-ploss-F2-i.The total throughput for FTP handling operations is expressed by(35)γF=∑i=1nγF2-i.


## 3.3.3. HTTP Handling Analysis

As shown in Figure1, the HTTP handling process is based on a three-phase concurrent Erlang model. If applications with similar handling processes exist in the system, the HTTP handling process may be used as a template. The HTTP handling operations may be divided into three parts. When a packet arrives at the HTTP handling process, it will first be handled by HTTP-request line handling module; then, it will be processed by HTTP-header handling module, and finally, it will be handled by the HTTP-body handling module and delivered to upper-layer applications.(  1) HTTP-Request Line Handling Operations. In terms of HTTP-request line handling operations, the arrival rate of packets equals the throughput for Phase 1, γL∗qH, the buffer size is KH1, the number of service windows is denoted by NH1, the number of rules is rH1, and the service rate of the rules is expressed by μH1.The probability thatk packets arrive at a queue within the service time of a packet may be denoted by(36)∂k=λkk!NH1μH1rH1rH1-1!·k+rH1-1!λ+NH1μH1k+rH1.The state transition probability for HTTP-request line handling operations is given by(37)p0k=∂k0≤k≤KH1+NH1-2∑m=KH1+NH1-1∞∂mk=KH1+NH1-1j=0pjk=∂k-j+1j-1≤k≤KH1+NH1-2∑m=KH1+NH1-1∞∂mk=KH1+NH1-11≤j≤KH1+NH1-1.The following formula may be obtained:(38)πk=∑j=0KH1+NH1-1πjpjk0≤k≤KH1+NH1-1.By performing ratio computation withπ0, the following formula is obtained:(39)π0=11+∑k=1KH1+NH1-1πk/π0.The packet loss rate for HTTP-request line handling operations is given by(40)ploss-H1=1-1π0+λ·qH·rH1/NH1μH1.The throughput for HTTP-request line handling operations is denoted by(41)γH1=λ·qH1-ploss-H1.(  2) HTTP-Header Handling Operations. With respect to HTTP-header handling operations, the arrival rate of packets equals the throughput for the HTTP-request line handling operations, γH2, the buffer size is KH2, the number of service windows is represented by NH2, the number of rules is rH2, and the service rate of the rules is μH2.The probability thatk packets arrive at a queue within the service time of a packet may be denoted by(42)∂k=λkk!NH2μH2rH2rH2-1!·k+rH2-1!λ+NH2μH2k+rH2.The state transition probability for HTTP-header handling operations may be expressed by(43)p0k=∂k0≤k≤KH2+NH2-2∑m=KH2+NH2-1∞∂mk=KH2+NH2-1j=0pjk=∂k-j+1j-1≤k≤KH2+NH2-2∑m=KH2+NH2-1∞∂mk=KH2+NH2-11≤j≤KH2+NH2-1.The following formula may be obtained:(44)πk=∑j=0KH2+NH2-1πjpjk0≤k≤KH2+NH2-1.By performing ratio computation withπ0, the following formula is obtained:(45)π0=11+∑k=1KH2+NH2-1πk/π0.The packet loss rate for HTTP-header handling operations may be expressed by(46)ploss-H2=1-1π0+γH1·rH2/NH2μH2.The throughput for the HTTP-header handling operations may be expressed by(47)γH2=γH11-ploss-H2.(  3) HTTP-Body Handling Operations. In terms of HTTP-body handling operations, assume that there are n′ concurrent HTTP-body handling modules and let i denote the ith HTTP-body handling module. The packet flow proportion for each HTTP-body handling module is denoted by qH-i. The arrival rate of packets equals the throughput for the HTTP-header handling operations, γH2∗qH-i, the buffer size is KH3-i, the number of service windows is expressed by NH3-i, the number of rules is rH3-i, and the service rate of the rules is represented by μH3-i.The probability thatk packets arrive at a queue within the service time of a packet may be denoted by(48)∂k=λkk!NH3-iμH3-irH3rH3-i-1!·k+rH3-i-1!λ+NH3-iμH3-ik+rH3-i.The state transition probability for HTTP-body handling operations is given by(49)p0k=∂k0≤k≤KH3-i+NH3-i-2∑m=KH3-i+NH3-i-1∞∂mk=KH3-i+NH3-i-1j=0pjk=∂k-j+1j-1≤k≤KH3-i+NH3-i-2∑m=KH3-i+NH3-i-1∞∂mk=KH3-i+NH3-i-11≤j≤KH3-i+NH3-i-1.The following formula may be obtained:(50)πk=∑j=0KH3-i+NH3-i-1πjpjk0≤k≤KH3-i+NH3-i-1.By performing ratio computation withπ0, the following formula is obtained:(51)π0=11+∑k=1KH3-i+NH3-i-1πk/π0.The packet loss rate for HTTP-body handling operations may be denoted by(52)ploss-H3-i=1-1π0+γH2·qH-i·rH3-i/NH3-iμH3-i.The throughput for HTTP-body handling operations may be expressed by(53)γH3-i=γH2·qH-i1-ploss-H3-i.The total throughput for HTTP-body handling operations may be expressed by(54)γH=∑i=1n′γH3-i.The overall traffic handled by the firewall should be the sum of the traffic handled by DNS, FTP, and HTTP. The overall packet loss rate of the firewall is given by(55)ploss=ploss-L+qD·1-ploss-Lploss-D+qF·1-ploss-Lploss-F1+∑i=1nqFi·1-qF·1-ploss-Lploss-F1·ploss-F2-i+qH·1-ploss-Lploss-H1+1-qH·1-ploss-Lploss-H1·ploss-H2+∑i=1n′qHi·1-1-qH·1-ploss-Lploss-H1·ploss-H2·ploss-H3-i.


## 4. Experiment Evaluation

This section describes a discrete-event simulated experiment conducted with respect to the firewall model described above. The arrival time of packets and processing time of service windows are stochastically generated, where the arrival process is a Poisson process and the service process follows an Erlang distribution.Let the number of total resources be 12, enumerate the combinations of the allocated resources, compute the values of the throughput and packet loss rate under each combination using the theoretical formulae and simulation programs, respectively, and calculate the error between the theoretical and simulated values.The total number of service stations is 12, and the arrival rate of data packetsλ = 80 kpps (kilo packets per second). In Phase 1, the buffer size KL = 100, the number of rules rL = 5, and the handling rate μL = 250 kpps. In Phase 2, the DNS traffic accounts for 20%; FTP traffic, 20%; and HTTP traffic, 60%. In terms of the DNS handling part, the buffer size KD = 100, the number of rules rD = 5, and the handling rate μD = 200 kpps. In the FTP handling part, the FTP command handling buffer size KF1 = 100, the number of rules rF1 = 5, and the handling rate μF1 = 350 kpps. The FTP data transmission handling part may be divided into two data transmission processes, whose traffic proportions are 40% and 60%, respectively. For the first data transmission process, the buffer size KF2-1 = 80, the number of rules rF2-1 = 5, and the handling rate μF2-1 = 150 kpps. For the second transmission process, the buffer size KF2-2 = 90, the number of rules rF2-1 = 5, and the handling rate μF2-1 = 180 kpps. In the HTTP handling part, the buffer size for HTTP-request line handling KH1 = 100, the number of rules rH1 = 5, and the handling rate μH1 = 500 kpps. The buffer size for HTTP-header handling KH2 = 150, the number of rules rH2 = 5, and the handling rate μH2 = 200 kpps. The HTTP-body handling operations consist of two HTTP applications, whose traffic proportions are 40% and 60%, respectively. The buffer sizes are KH3-1 = 100 and KH3-2 = 100, respectively, the number of rules is rH3-1 = 5 and rH3-2 = 5, respectively, and the handling rates are μH3-1 = 80 kpps and μH3-2 = 100 kpps, respectively. The results are presented in Table 1.Table 1
Relationship of resource allocation versus throughput and packet loss rate.
N L N D N F 1 N F 2 - 1 N F 2 - 2 N H 1 N H 2 N H 3 - 1 N H 3 - 2 Theoretical throughput Theoretical packet loss rate Simulated throughput Simulated packet loss rate Err 1 1 1 1 1 1 1 1 4 50.252 0.372 49.525 0.381 0.015 1 1 1 1 1 1 1 2 3 50.777 0.365 49.545 0.381 0.025 1 1 1 1 1 1 1 3 2 50.322 0.371 49.504 0.381 0.017 1 1 1 1 1 1 1 4 1 50.166 0.373 49.297 0.384 0.018 1 1 1 1 1 1 2 1 3 50.273 0.372 49.545 0.381 0.015 1 1 1 1 1 1 2 2 2 50.181 0.373 49.647 0.379 0.011 1 1 1 1 1 1 2 3 1 51.012 0.362 49.421 0.382 0.032 1 1 1 1 1 1 3 1 2 50.456 0.369 49.507 0.381 0.019 1 1 1 1 1 1 3 2 1 50.257 0.372 49.380 0.383 0.018 1 1 1 1 1 1 4 1 1 49.927 0.376 49.496 0.381 0.009 1 1 1 1 1 2 1 1 3 50.483 0.369 49.405 0.382 0.022 1 1 1 1 1 2 1 2 2 50.720 0.366 49.518 0.381 0.024 1 1 1 1 1 2 1 3 1 50.525 0.368 49.289 0.384 0.025 1 1 1 1 1 2 2 1 2 50.519 0.369 49.496 0.381 0.021 1 1 1 1 1 2 2 2 1 50.690 0.366 49.453 0.382 0.025 1 1 1 1 1 2 3 1 1 50.775 0.365 49.425 0.382 0.027 1 1 1 1 1 3 1 1 2 50.291 0.371 49.455 0.382 0.017 1 1 1 1 1 3 1 2 1 50.226 0.372 49.471 0.382 0.015 1 1 1 1 1 3 2 1 1 50.228 0.372 49.112 0.386 0.023 1 1 1 1 1 4 1 1 1 50.665 0.367 49.351 0.383 0.027 1 1 1 1 2 1 1 1 3 50.308 0.371 49.676 0.379 0.013 1 1 1 1 2 1 1 2 2 50.315 0.371 49.469 0.382 0.017 1 1 1 1 2 1 1 3 1 50.211 0.372 49.351 0.383 0.017 1 1 1 1 2 1 2 1 2 50.310 0.371 49.505 0.381 0.016 1 1 1 1 2 1 2 2 1 50.627 0.367 49.433 0.382 0.024 1 1 1 1 2 1 3 1 1 50.212 0.372 49.396 0.383 0.017 1 1 1 1 2 2 1 1 2 50.889 0.364 49.567 0.380 0.027 1 1 1 1 2 2 1 2 1 50.514 0.369 49.484 0.381 0.021 1 1 1 1 2 2 2 1 1 50.446 0.369 49.150 0.386 0.026 1 1 1 1 2 3 1 1 1 50.177 0.373 49.393 0.383 0.016 1 1 1 1 3 1 1 1 2 50.569 0.368 49.578 0.380 0.020 1 1 1 1 3 1 1 2 1 50.724 0.366 49.376 0.383 0.027 1 1 1 1 3 1 2 1 1 50.240 0.372 49.408 0.382 0.017 1 1 1 1 3 2 1 1 1 50.818 0.365 49.380 0.383 0.029 1 1 1 1 4 1 1 1 1 50.548 0.368 49.206 0.385 0.027 1 1 1 2 1 1 1 1 3 50.689 0.366 49.436 0.382 0.025 1 1 1 2 1 1 1 2 2 50.800 0.365 49.524 0.381 0.026 1 1 1 2 1 1 1 3 1 50.616 0.367 49.140 0.386 0.030 1 1 1 2 1 1 2 1 2 50.589 0.368 49.485 0.381 0.022 1 1 1 2 1 1 2 2 1 50.552 0.368 49.057 0.387 0.030 1 1 1 2 1 1 3 1 1 50.585 0.368 49.365 0.383 0.025 1 1 1 2 1 2 1 1 2 50.558 0.368 49.503 0.381 0.021 1 1 1 2 1 2 1 2 1 50.264 0.372 49.157 0.386 0.023 1 1 1 2 1 2 2 1 1 50.307 0.371 49.194 0.385 0.023 1 1 1 2 1 3 1 1 1 49.989 0.375 49.261 0.384 0.015 1 1 1 2 2 1 1 1 2 50.404 0.370 49.533 0.381 0.018 1 1 1 2 2 1 1 2 1 50.710 0.366 49.593 0.380 0.023 1 1 1 2 2 1 2 1 1 50.271 0.372 49.426 0.382 0.017 1 1 1 2 2 2 1 1 1 50.344 0.371 49.333 0.383 0.020 1 1 1 2 3 1 1 1 1 50.468 0.369 49.524 0.381 0.019 1 1 1 3 1 1 1 1 2 50.982 0.363 49.477 0.382 0.030 1 1 1 3 1 1 1 2 1 50.504 0.369 49.180 0.385 0.027 1 1 1 3 1 1 2 1 1 50.608 0.367 49.106 0.386 0.031 1 1 1 3 1 2 1 1 1 50.326 0.371 49.294 0.384 0.021 1 1 1 3 2 1 1 1 1 50.096 0.374 49.408 0.382 0.014 1 1 1 4 1 1 1 1 1 50.104 0.374 49.302 0.384 0.016 1 1 2 1 1 1 1 1 3 50.105 0.374 49.656 0.379 0.009 1 1 2 1 1 1 1 2 2 50.371 0.370 49.459 0.382 0.018 1 1 2 1 1 1 1 3 1 50.209 0.372 49.377 0.383 0.017 1 1 2 1 1 1 2 1 2 50.027 0.375 49.517 0.381 0.010 1 1 2 1 1 1 2 2 1 50.769 0.365 49.471 0.382 0.026 1 1 2 1 1 1 3 1 1 50.644 0.367 49.533 0.381 0.022 1 1 2 1 1 2 1 1 2 50.417 0.370 49.507 0.381 0.018 1 1 2 1 1 2 1 2 1 49.918 0.376 49.445 0.382 0.010 1 1 2 1 1 2 2 1 1 50.770 0.365 49.469 0.382 0.026 1 1 2 1 1 3 1 1 1 50.103 0.361 49.309 0.384 0.016 1 1 2 1 2 1 1 1 2 50.238 0.372 49.503 0.381 0.015 1 1 2 1 2 1 1 2 1 50.409 0.370 49.476 0.382 0.019 1 1 2 1 2 1 2 1 1 50.696 0.366 49.397 0.383 0.026 1 1 2 1 2 2 1 1 1 50.456 0.369 49.504 0.381 0.019 1 1 2 1 3 1 1 1 1 50.461 0.369 49.256 0.384 0.024 1 1 2 2 1 1 1 1 2 50.134 0.373 49.695 0.379 0.009 1 1 2 2 1 1 1 2 1 50.997 0.363 49.517 0.381 0.030 1 1 2 2 1 1 2 1 1 50.661 0.367 49.401 0.382 0.026 1 1 2 2 1 2 1 1 1 50.414 0.370 49.497 0.381 0.019 1 1 2 2 2 1 1 1 1 50.497 0.369 49.395 0.383 0.022 1 1 2 3 1 1 1 1 1 50.559 0.368 49.366 0.383 0.024 1 1 3 1 1 1 1 1 2 50.271 0.372 49.617 0.380 0.013 1 1 3 1 1 1 1 2 1 50.593 0.368 49.325 0.383 0.026 1 1 3 1 1 1 2 1 1 50.775 0.365 49.488 0.381 0.026 1 1 3 1 1 2 1 1 1 50.413 0.370 49.475 0.382 0.019 1 1 3 1 2 1 1 1 1 50.368 0.370 49.496 0.381 0.018 1 1 3 2 1 1 1 1 1 50.521 0.368 49.376 0.383 0.023 1 1 4 1 1 1 1 1 1 50.204 0.372 49.476 0.382 0.015 1 2 1 1 1 1 1 1 3 50.709 0.366 49.569 0.380 0.023 1 2 1 1 1 1 1 2 2 50.261 0.372 49.497 0.381 0.015 1 2 1 1 1 1 1 3 1 50.264 0.372 49.469 0.382 0.016 1 2 1 1 1 1 2 1 2 50.617 0.367 49.596 0.380 0.021 1 2 1 1 1 1 2 2 1 51.092 0.361 49.449 0.382 0.033 1 2 1 1 1 1 3 1 1 50.560 0.368 49.199 0.385 0.028 1 2 1 1 1 2 1 1 2 50.335 0.371 49.425 0.382 0.018 1 2 1 1 1 2 1 2 1 50.678 0.367 49.385 0.383 0.026 1 2 1 1 1 2 2 1 1 50.582 0.368 49.533 0.381 0.021 1 2 1 1 1 3 1 1 1 50.046 0.374 49.250 0.384 0.016 1 2 1 1 2 1 1 1 2 50.790 0.365 49.413 0.382 0.028 1 2 1 1 2 1 1 2 1 50.258 0.372 49.320 0.384 0.019 1 2 1 1 2 1 2 1 1 50.477 0.369 49.399 0.383 0.022 1 2 1 1 2 2 1 1 1 50.587 0.368 49.272 0.384 0.027 1 2 1 1 3 1 1 1 1 50.573 0.368 49.371 0.383 0.024 1 2 1 2 1 1 1 1 2 50.867 0.364 49.499 0.381 0.028 1 2 1 2 1 1 1 2 1 50.508 0.369 49.524 0.381 0.020 1 2 1 2 1 1 2 1 1 50.313 0.371 49.481 0.381 0.017 1 2 1 2 1 2 1 1 1 50.419 0.370 49.468 0.382 0.019 1 2 1 2 2 1 1 1 1 50.919 0.364 49.391 0.383 0.031 1 2 1 3 1 1 1 1 1 50.633 0.367 49.496 0.381 0.023 1 2 2 1 1 1 1 1 2 50.756 0.366 49.582 0.380 0.024 1 2 2 1 1 1 1 2 1 50.920 0.363 49.349 0.383 0.032 1 2 2 1 1 1 2 1 1 50.259 0.372 49.465 0.382 0.016 1 2 2 1 1 2 1 1 1 50.410 0.370 49.364 0.383 0.021 1 2 2 1 2 1 1 1 1 50.116 0.374 49.503 0.381 0.012 1 2 2 2 1 1 1 1 1 50.377 0.370 49.360 0.383 0.021 1 2 3 1 1 1 1 1 1 50.517 0.369 49.444 0.382 0.022 1 3 1 1 1 1 1 1 2 50.352 0.371 49.692 0.379 0.013 1 3 1 1 1 1 1 2 1 50.652 0.367 49.458 0.382 0.024 1 3 1 1 1 1 2 1 1 50.375 0.370 49.480 0.381 0.018 1 3 1 1 1 2 1 1 1 50.294 0.371 49.354 0.383 0.019 1 3 1 1 2 1 1 1 1 50.999 0.363 49.476 0.382 0.031 1 3 1 2 1 1 1 1 1 51.162 0.360 49.525 0.381 0.033 1 3 2 1 1 1 1 1 1 50.366 0.370 49.316 0.384 0.021 1 4 1 1 1 1 1 1 1 50.761 0.365 49.410 0.382 0.027 2 1 1 1 1 1 1 1 3 72.170 0.098 71.534 0.106 0.009 2 1 1 1 1 1 1 2 2 72.857 0.089 71.463 0.107 0.019 2 1 1 1 1 1 1 3 1 68.360 0.146 67.650 0.154 0.010 2 1 1 1 1 1 2 1 2 77.768 0.028 76.693 0.041 0.014 2 1 1 1 1 1 2 2 1 72.132 0.098 70.706 0.116 0.020 2 1 1 1 1 1 3 1 1 68.340 0.146 67.672 0.154 0.010 2 1 1 1 1 2 1 1 2 72.507 0.094 71.572 0.105 0.013 2 1 1 1 1 2 1 2 1 68.342 0.146 67.676 0.154 0.010 2 1 1 1 1 2 2 1 1 68.404 0.145 67.688 0.154 0.011 2 1 1 1 1 3 1 1 1 68.321 0.146 67.742 0.153 0.009 2 1 1 1 2 1 1 1 2 72.072 0.099 71.473 0.107 0.008 2 1 1 1 2 1 1 2 1 68.403 0.145 67.604 0.155 0.012 2 1 1 1 2 1 2 1 1 68.357 0.146 67.684 0.154 0.010 2 1 1 1 2 2 1 1 1 68.236 0.147 67.687 0.154 0.008 2 1 1 1 3 1 1 1 1 68.010 0.150 67.678 0.154 0.005 2 1 1 2 1 1 1 1 2 72.688 0.091 71.439 0.107 0.017 2 1 1 2 1 1 1 2 1 68.301 0.146 67.607 0.155 0.010 2 1 1 2 1 1 2 1 1 68.221 0.147 67.736 0.153 0.007 2 1 1 2 1 2 1 1 1 68.200 0.148 67.688 0.154 0.008 2 1 1 2 2 1 1 1 1 67.916 0.151 67.650 0.154 0.004 2 1 1 3 1 1 1 1 1 68.191 0.148 67.682 0.154 0.008 2 1 2 1 1 1 1 1 2 72.500 0.094 71.590 0.105 0.013 2 1 2 1 1 1 1 2 1 68.189 0.148 67.531 0.156 0.010 2 1 2 1 1 1 2 1 1 68.121 0.148 67.753 0.153 0.005 2 1 2 1 1 2 1 1 1 68.334 0.146 67.689 0.154 0.010 2 1 2 1 2 1 1 1 1 68.261 0.147 67.690 0.154 0.008 2 1 2 2 1 1 1 1 1 67.930 0.151 67.670 0.154 0.004 2 1 3 1 1 1 1 1 1 68.234 0.147 67.619 0.155 0.009 2 2 1 1 1 1 1 1 2 72.719 0.091 71.508 0.106 0.017 2 2 1 1 1 1 1 2 1 68.576 0.143 67.641 0.154 0.014 2 2 1 1 1 1 2 1 1 68.479 0.144 67.734 0.153 0.011 2 2 1 1 1 2 1 1 1 68.157 0.148 67.639 0.155 0.008 2 2 1 1 2 1 1 1 1 68.602 0.142 67.681 0.154 0.014 2 2 1 2 1 1 1 1 1 68.034 0.150 67.622 0.155 0.006 2 2 2 1 1 1 1 1 1 68.375 0.145 67.679 0.154 0.010 2 3 1 1 1 1 1 1 1 68.229 0.147 67.611 0.155 0.009 3 1 1 1 1 1 1 1 2 72.655 0.092 71.542 0.106 0.016 3 1 1 1 1 1 1 2 1 68.046 0.149 67.601 0.155 0.007 3 1 1 1 1 1 2 1 1 68.268 0.147 67.725 0.153 0.008 3 1 1 1 1 2 1 1 1 68.143 0.148 67.674 0.154 0.007 3 1 1 1 2 1 1 1 1 68.494 0.144 67.685 0.154 0.012 3 1 1 2 1 1 1 1 1 68.394 0.145 67.707 0.154 0.010 3 1 2 1 1 1 1 1 1 68.241 0.147 67.700 0.154 0.008 3 2 1 1 1 1 1 1 1 68.154 0.148 67.638 0.155 0.008 4 1 1 1 1 1 1 1 1 67.796 0.153 67.642 0.154 0.002As determined from the experimental results, when the resources are allocated asNL = 2, ND = 1, NF1 = 1, NF2-1 = 1, NF2-2 = 1, NH1 = 1, NH2 = 2, NH3-1 = 1, and NH3-2 = 2, the maximum throughput reaches up to 76.69 kpps with the lowest packet loss rate. Further, the error between the theoretical computation results and the simulated experiment results remains within 3.3%; the mean error is 0.848%.


## 5. Conclusion

A two-phase multiservice station and multiprotocol firewall model with multiple concurrent applications was proposed in this paper. Based on different phases, protocols, and applications, the values of performance indicators such as system throughput and packet loss rate were obtained. An optimal solution was derived after the results of simulated experiments and theoretical computation were compared, and the combinations of resource allocations were enumerated using a total of 12 resources. Furthermore, by comparing the error between the simulated experiment values and the theoretical computation values, it was found that this model may precisely represent the handling process of the firewall. Therefore, it may save a considerable amount of time in development and testing from the viewpoint of utilizing mobile networks, thus exhibiting significant potential for practical application. In the future, we plan to continue with our in-depth research by emphasizing the discussion of DDoS detection and user-behavior analysis.



---

*Source: 8130152-2018-04-30.xml*