Firewall Rule Optimization with a Genetic Algorithm

COSC 3P71 (Artificial Intelligence) group assignment. This project uses a genetic algorithm to evolve firewall rule sets: given a pool of candidate rules and a set of test network packets with known correct outcomes, the GA searches for a small, ordered rule list that maximizes classification accuracy while minimizing rule count and lookup cost.

Author

Matthew Gockiewicz, Adam Chorzepa, Ali Faour

Problem Overview

A firewall is just an ordered list of rules, checked top-to-bottom until one matches a packet (source, destination, port). The first match decides whether the packet is allowed or denied; if nothing matches, the packet is denied by default.

Writing a good rule set by hand is a balancing act: too many rules and lookups get slow, too few and traffic gets misclassified, and the order of rules matters just as much as which rules are included. This project treats that balancing act as a search problem and solves it with a genetic algorithm.

How It Works

• Chromosome (ga/chromosome.py): a candidate firewall, represented as an ordered subset of rules drawn from a master rule pool.
• Rule pool & simulator (simulator/rules.py, simulator/evaluator.py): defines the available rules and simulates how a packet traverses an ordered rule list, tracking whether the outcome was correct and how many rules were checked.
• Fitness function (ga/fitness.py): scores a chromosome as 1000 * accuracy - 10 * num_rules - avg_lookup_cost, rewarding correctness while penalizing bloated or slow rule sets.
• Genetic operators (ga/operators.py): tournament selection, single-point crossover (with de-duplication), and mutation (swap / delete / add a rule).
• GA engine (ga/engine.py): runs selection, crossover, and mutation over a fixed number of generations, using elitism to carry the best chromosomes forward unchanged, and records per-generation stats.
• Packet generator (simulator/packets.py): produces the synthetic labeled network traffic (Data/sample_packets.json) used to evaluate each firewall.
• Dashboard (visualizer/dashboard.py): plots fitness, rule count, and accuracy over the course of the run.

Project Structure

.
├── Data/
│   └── sample_packets.json   # Generated test packets (source, dest, port, expected)
├── ga/
│   ├── chromosome.py         # Chromosome (candidate firewall) representation
│   ├── engine.py             # Main GA loop
│   ├── fitness.py            # Fitness scoring
│   └── operators.py          # Selection, crossover, mutation
├── simulator/
│   ├── rules.py               # Rule definition + master rule pool
│   ├── evaluator.py           # Packet-vs-firewall simulation
│   └── packets.py             # Synthetic packet generator
├── visualizer/
│   └── dashboard.py           # Matplotlib results dashboard
└── main.py                    # Entry point: runs the full GA pipeline

Requirements

• Python 3.9+
• matplotlib (for the results dashboard)

pip install matplotlib

Usage

1. (Optional) Regenerate the test packets:

   python -m simulator.packets

2. Run the GA:

   python main.py

   This evolves a population of 50 firewalls over 200 generations, prints the best rule set found, and opens a dashboard showing fitness, rule count, and accuracy trends across generations.

Course

Developed for COSC 3P71: Artificial Intelligence, Brock University.