Early detection and limitation Hot-IPs using Non-Adaptive Group Testing and dynamic firewall rules

Abstract

In this paper, we propose a solution to fast detect and limit Hot-IPs using Non-Adaptive Group Testing method and dynamic firewall rules. Hot-IPs are hosts appear with high frequency in network. They can be threats such as denial of service attacks or Internet worms. Therefore, fast detecting and limiting Hot-IPs are very important issues in network to decrease these risks. Non-adaptive group testing method is used to fast detect Hot-IPs. We also implement parallel processing algorithm with PVM to reduce the decoding time. Beside on that, we use dynamic firewall rules to increase flexibility and security. This approach helps to decrease time to lookup rules and improve the performance for firewall processing.