Exact ternary correlation speeds up firewall log audits on GPU hardware
Hierarchical Rule Auditing with Exact Ternary GPU Correlation
Distributed, Parallel, and Cluster ComputingCryptography and Security
Summary
Checking firewall logs against security rules is difficult because rules can overlap and some data might be missing. The authors present a precise method that uses a special matrix calculation to handle these challenges exactly. Their approach also avoids counting the same records twice and works well with many different endpoints. They tested multiple ways to run the method on CPUs and GPUs and found that their combined GPU technique reduces time slightly compared to alternatives. However, bitmap-based methods remain faster in many cases.
What this means in practice
- •For network security teams: Run precise audits of firewall log entries against complex overlapping rules using GPU acceleration to reduce audit latency slightly.
- •For cloud infrastructure engineers: Manage large-scale access control policies by handling hierarchical address classes and reducing double counting in security compliance checks.
Authors
shengwei wang
Abstract
Auditing firewall logs against requirements mapped to controls and frameworks must retain overlapping obligations, preserve uncertainty from missing attributes and count distinct affected records. Direct, bitmap and relational methods can express this audit; a correlation implementation must preserve distinctions that ordinary match counts and rule-hit totals discard. We present an exact ternary correlation algorithm that compiles categorical conjunctions into one bounded-integer matrix product. A dominating false-predicate penalty separates known mismatches from missing evidence, while per-record hierarchy unions prevent duplicate counting. We prove their composition and handle high-cardinality endpoints through exact address classes and versioned labels. Evaluation compares eight CPU/GPU implementations, includes public traffic and 133 published source-address ACLs with generated observations, and measures hierarchy and policy-rebuild costs. On an NVIDIA L4, matched fused execution reduces latency by 8.8 to 11.2 percent relative to two-product correlation across five tested shapes. At 100,000 records and 1,024 requirements, it takes 12.28 ms versus 13.82 ms for two products and 12.29 ms for GPU bitmaps. Bitmaps remain faster in most regimes, with hierarchy operations and reductions dominating the measured fused-correlation stage intervals.