Firewall Rules Research Articles

APT-scope: A novel framework to predict advanced persistent threat groups from enriched heterogeneous information network of cyber threat intelligence

Addressing the expanding Advanced Persistent Threat (APT) landscape is crucial for governments, enterprises and threat intelligence research groups. While defenders often rely on tabular formats for assets like logs, alerts, firewall rules; attackers leverage a graph-based mindset. In this work, we propose a novel multistage framework named APT-Scope which employs a comprehensive approach to Cyber Threat Intelligence (CTI) analysis on qualified real-world data. APT-Scope workflow consists of data gathering, enrichment, and analysis stages, where relationships between entities are used to construct a Heterogeneous Information Network (HIN). We applied CTI enrichment using additional active data collection techniques like DNS and Whois lookups, port scans, SSL footprinting, named entity recognition via SpaCy, and constructed a machine learning pipeline to predict relationships between entities using FastRP and Logistic Regression. By analyzing the resulting HIN, we discovered aliases for APT groups and predicted threat actors of APT attacks with unknown perpetrators. We observed AUCPR metrics as train score = 96.57% and test score = 92.36%. Our work is beneficial to oversee the entire APT landscape, steer ongoing and future CTI operations and make strategic decisions.

A deep experimental analysis of energy‐proficient firewall policies and security practices for resource limited wireless networks

AbstractThe role of firewalls and security principles in resource‐limited wireless networks and Wireless Sensor Networks (WSN) is more expected than in any dedicated network environment. The advanced wireless technologies and emerging fashion of autonomous wireless network nodes are mostly expecting resilient firewall services with multi‐level security policies. Wireless networks are classified under sensor networks, Internet of Things (IoT) mobile networks, and so forth. According to the expectations, security frameworks are gradually invented around the communication platform using various ideologies. The novel ideology and respective implementation effort open better solutions against wireless network attacks. Anyhow, the minimal production of time complexity, energy complexity, and computation overhead from any novel security approach is always considered under the best practices. The complexity levels directly affect the wireless node's energy consumption ability and operational spans severely. The energy optimization techniques and load‐balancing techniques integrated into multi‐class firewall rules are extremely useful solutions for resource‐limited wireless networks. This article has been motivated to analyze the recent firewall techniques and secure data communication mechanisms used for securing wireless networks. Consequently, the practice of comparative literature analysis helps to improve the current limitations identified under the classified categories of security mechanisms such as energy‐optimized security principles and load‐balanced security principles. The establishment of secure and energy‐optimized multi‐class firewall rules in each wireless node assures a healthy focus on next‐generation networks. The experiment section shows the benefits of energy‐optimized secure network communication in terms of better accuracy and the benefits of load‐balanced secure network communication through minimal overhead in computing platforms.

AI-Based Approach to Firewall Rule Refinement on High-Performance Computing Service Network

High-performance computing (HPC) relies heavily on network security, particularly when supercomputing services are provided via public networks. As supercomputer operators, we introduced several security devices, such as anti-DDoS, intrusion prevention systems (IPSs), firewalls, and web application firewalls, to ensure the secure use of supercomputing resources. Potential threats are identified based on predefined security policies and added to the firewall rules for access control after detecting abnormal behavior through anti-DDoS, IPS, and system access logs. After analyzing the status change patterns for rule policies added owing to human errors among these added firewall log events, 289,320 data points were extracted over a period of four years. Security experts and operators must go through a strict verification process to rectify policies that were added incorrectly owing to human error, which adds to their workload. To address this challenge, our research applies various machine- and deep-learning algorithms to autonomously determine the normalcy of detection without requiring administrative intervention. Machine-learning algorithms, including naïve Bayes, K-nearest neighbor (KNN), OneR, a decision tree called J48, support vector machine (SVM), logistic regression, and the implemented neural network (NN) model with the cross-entropy loss function, were tested. The results indicate that the KNN and NN models exhibited an accuracy of 97%. Additional training and feature refinement led to even better improvements, increasing the accuracy to 98%, a 1% increase. By leveraging the capabilities of machine-learning and deep-learning technologies, we have provided the basis for a more robust, efficient, and autonomous network security infrastructure for supercomputing services.

Application Study on the Reinforcement Learning Strategies in the Network Awareness Risk Perception and Prevention

The intricacy of wireless network ecosystems and Internet of Things (IoT) connected devices have increased rapidly as technology advances and cyber threats increase. The existing methods cannot make sequential decisions in complex network environments, particularly in scenarios with partial observability and non-stationarity. Network awareness monitors and comprehends the network's assets, vulnerabilities, and ongoing activities in real-time. Advanced analytics, machine learning algorithms, and artificial intelligence are used to improve risk perception by analyzing massive amounts of information, identifying trends, and anticipating future security breaches. Hence, this study suggests the Deep Reinforcement Learning-assisted Network Awareness Risk Perception and Prevention Model (DRL-NARPP) for detecting malicious activity in cybersecurity. The proposed system begins with the concept of network awareness, which uses DRL algorithms to constantly monitor and evaluate the condition of the network in terms of factors like asset configurations, traffic patterns, and vulnerabilities. DRL provides autonomous learning and adaptation to changing network settings, revealing the ever-changing nature of network awareness risks in real time. Incorporating DRL into risk perception increases the system's capacity to recognize advanced attack methods while simultaneously decreasing the number of false positives and enhancing the reliability of risk assessments. DRL algorithms drive dynamic and context-aware response mechanisms, making up the adaptive network prevention component of the development. Predicting new threats and proactively deploying preventive measures, such as changing firewall rules, isolating compromised devices, or dynamically reallocating resources to reduce developing risks, is made possible by the system's ability to learn from historical data and prevailing network activity. The suggested DRL-NARPP model increases the anomaly detection rate by 98.3%, the attack prediction accuracy rate by 97.4%, and the network risk assessment ratio by 96.4%, reducing the false positive ratio by 11.2% compared to other popular methodologies.

“Focus Flow” An approach to Distraction Free Environment

In the modern landscape of digital work environments, staying focused on tasks amidst a plethora of distractions has become a significant challenge. To address this issue, the "Focus Flow," a desktop application meticulously crafted to optimize productivity by minimizing interruptions from social media, games, and other potential distractions. The core feature, "Focus Mode," empowers users to isolate and prevent access to distracting applications, fostering an environment conducive to concentration. Technical implementation involves the strategic use of file permissions or firewall rules, ensuring a seamless and secure process running in the background. Beyond distraction control, Focus Flow integrates an array of functionalities. From straightforward to- do lists, local task management, and a documents viewer for seamless file accessibility to a unique Test Mode that transforms the system into a secure environment for standardized test- taking, the application aims to provide a holistic solution to enhance productivity. Moreover, the inclusion of an in-app chat feature enables communication within the application, fostering collaboration without external distractions. A central dashboard serves as a command center, offering quick access to Focus Mode, statistics, task management, and other essential features. The application also incorporates progress tracking, allowing users to visualize trends over time and set and monitor productivity goals. In summary, Focus Flow aspires to redefine the way users approach works, providing a comprehensive toolkit to create a distraction-free and productive work environment.

ShieldedLink Application: A Comprehensive Mobile Security Solution

Abstract: ShieldedLink Application is a robust DNS resolver and firewall solution designed to prioritize speed, security, privacy, and configurability. Operating across over 300 global locations within Cloudflare's data centers, it offers end-to-end median latency as low as 30ms, ensuring swift resolution of domain names to IP addresses. Security is ensured through exclusive response over TLS, safeguarding user data from potential surveillance and DNS manipulation attacks. Each user benefits from a dedicated endpoint, guaranteeing privacy akin to a personalized resolver setup. Transparency is facilitated with optional peruser logs for analytics and reporting. Additionally, users enjoy configurability through preset blocklists, empowering them to define firewall rules based on their preferences. Complemented by the ShieldedLink Application companion app for Android, users can further enhance their security by implementing granular app blocking rules, including blocking by category, app activity, or device status.

Performance evaluation of a firewall service based on virtualized IncludeOS unikernels

Network function virtualization technology has long moved beyond the experimental phase to become a standard in the implementation of modern telecommunications networks. It is anticipated that in the near future all network services will be implemented in software based on cloud-native architecture. As a result, telecommunications service providers have started exploring containers and unikernels as alternative technologies to traditional virtual machines. This paper presents performance evaluation of a firewall service based on IncludeOS unikernels. It shows that IncludeOS unikernels achieve promising performance results compared to Ubuntu-based virtual machines and containers. The presented evaluation is based on a number of experiments and benchmarks performed to investigate how different parameters of a firewall service change depending on the number of firewall rules.

METHODS AND MEANS TO IMPROVE THE EFFICIENCY OF NETWORK TRAFFIC SECURITY MONITORING BASED ON ARTIFICIAL INTELLIGENCE

This paper aims to provide a solution for malicious network traffic detection and categorization. Remote attacks on computer systems are becoming more common and more dangerous nowadays. This is due to several factors, some of which are as follows: first of all, the usage of computer networks and network infrastructure overall is on the rise, with tools such as messengers, email, and so on. Second, alongside increased usage, the amount of sensitive information being transmitted over networks has also grown. Third, the usage of computer networks for complex systems, such as grid and cloud computing, as well as IoT and “smart” locations (e.g., “smart city”) has also seen an increase. Detecting malicious network traffic is the first step in defending against a remote attack. Historically, this was handled by a variety of algorithms, including machine learning algorithms such as clustering.
 However, these algorithms require a large amount of sample data to be effective against a given attack. This means that defending against zero‑day attacks or attacks with high variance in input data proves difficult for such algorithms. In this paper, we propose a semi‑supervised generative adversarial network (GAN) to train a discriminator model to categorize malicious traffic as well as identify malicious and non‑malicious traffic. The proposed solution consists of a GAN generator that creates tabular data representing network traffic from a remote attack and a classifier deep neural network for said traffic. The main goal is to achieve accurate categorization of malicious traffic with a few labeled examples. This can also, in theory, improve classification accuracy compared to fully supervised models. It may also improve the model’s performance against completely new types of attacks. The resulting model shows a prediction accuracy of 91 %, which is lower than a conventional deep learning model; however, this accuracy is achieved with a small sample of data (under 1000 labeled examples). As such, the results of this research may be used to improve computer system security, for example, by using dynamic firewall rule adjustments based on the results of incoming traffic classification. The proposed model was implemented and tested in the Python programming language and the TensorFlow framework. The dataset used for testing is the NSL‑KDD dataset.

Dynamic Firewall Rule Building Engine for Hybrid Cloud

Growth in the cloud computing resource management aspects have also increases the risks associated with the services hosted on the cloud.The foundational challenges are firstly to accommodate the ease of access without violating the security aspects and the time constraints to provide service responses on time, to provide the security to the active services. A good number of researches are observed to achieve the best firewall security to the hosted services. Nonetheless, the existing methods are often criticised for higher complexity and the non-performing aspects for the newer attack types. Henceforth, this work aims to solve the existing research bottlenecks. The proposed work firstly aims to solve the higher complexity of the deployed strategy by reducing the attribute sets with a sense of accuracy, time complexity and information loss. Further, this work proposes a dynamic firewall rule engine design strategy for detection of the attacks using the thresholding method. The proposed algorithms are testing on the benchmarked KDD dataset and as outcome a nearly 99.7% accuracy is observed and the time complexity is reduced to nearly 40%. Hence, this proposed work demonstrates a state-of-the-art technology for firewall design for hybrid cloud and shall be considered as a new benchmark in this domain of the research.

An innovative two-stage algorithm to optimize Firewall rule ordering

Packet classification activity performed by a FireWall (FW) introduces high latency in network communications due to the computation time required to check whether any packet matches one of the FW rules. Such a classification process is done by sequentially checking the list of rules until a match is found or the end of the list is reached. Given the complexity of FW rules in some environments, this latency could become relevant. This problem is addressed by ordering the list of FW rules to minimize the classification latency, where the rules with higher activation frequencies are placed accordingly starting from the top of the list. This is not always feasible because dependency constraints between rules could exist: swapping the positions of dependent rules results in a loss of the integrity of the implemented security policy. For this reason, the FW rule ordering problem belongs to the realm of constrained combinatorial optimization.This paper proposes a two-stage algorithm to address this problem. The first stage performs an innovative topological sorting algorithm aimed at finding an optimal ordering for the constrained rules, taking into account the fact that rule activation frequencies are influenced by inter-packet arrival time, which typically obeys Zipf's law. The second stage employs a genetic algorithm to find the optimal ordering of all rules within the list. The proposed approach is evaluated using different filtering lists of different complexity provided by ClassBench. A comparison with other state-of-the-art algorithms addressing the same problem is performed. Furthermore, the performance analysis is extended employing an exact optimization method. The results obtained show the effectiveness of the proposed algorithm in minimizing packet classification latency, while a short reordering time is required.

Securing Access to Applications with IAP and Compute Engine

Cloud Identity- Aware Proxy (IAP) is a security service handed by Google Cloud Platform that allows directors to authenticate and authorize access to web operations and VMs running on Google Cloud. This service provides a fresh subcaste of security to operations and VMs by vindicating the stoner's identity and determining if they've authorization to pierce the resource. Setting up Cloud IAP for Compute Engine involves configuring access programs, OAuth2.0 customer IDs, and firewall rules. Once configured, IAP allows only authorized druggies to pierce the operation, grounded on their Google identity and class in specific Google groups. In this process, directors must produce an access policy, which determines which druggies or groups can pierce the operation. They must also produce an OAuth2.0 customer ID, which is used for authentication with IAP. Eventually, the director must modernize the Compute Engine case firewall rules to allow business from IAP. The benefits of setting up Cloud IAP for Compute Engine include enhanced security for the operation and the capability to manage access to coffers centrally. It also eliminates the need to manage access control within the operation and simplifies the process of granting or repealing access for druggies. While setting up Cloud IAP for Compute Engine can be a complex process, following the recommended way ensures that the operation is secure and only accessible to authorized druggies.

Automated Firewall Configuration in Virtual Networks

The configuration of security functions in computer networks is still typically performed manually, which likely leads to security breaches and long re-configuration times. This problem is exacerbated for modern networks based on network virtualization, because their complexity and dynamics make a correct manual configuration practically unfeasible. This article focuses on packet filters, i.e., the most common firewall technology used in computer networks, and it proposes a new methodology to automatically define the allocation scheme and configuration of packet filters in the logical topology of a virtual network. The proposed method is based on solving a carefully designed partial weighted Maximum Satisfiability Modulo Theories problem by means of a state-of-the-art solver. This approach formally guarantees the correctness of the solution, i.e., that all security requirements are satisfied, and it minimizes the number of needed firewalls and firewall rules. This methodology is extensively evaluated using different metrics and tests on both synthetic and real use cases, and compared to the state-of-the-art solutions, showing its superiority.

Multiverse fractional calculus based hybrid deep learning and fusion approach for detecting malicious behavior in cloud computing environment

The tremendous development and rapid evolution in computing advancements has urged a lot of organizations to expand their data as well as computational needs. Such type of services offers security concepts like confidentiality, integrity, and availability. Thus, a highly secured domain is the fundamental need of cloud environments. In addition, security breaches are also growing equally in the cloud because of the sophisticated services of the cloud, which cannot be mitigated efficiently through firewall rules and packet filtering methods. In order to mitigate the malicious attacks and to detect the malicious behavior with high detection accuracy, an effective strategy named Multiverse Fractional Calculus (MFC) based hybrid deep learning approach is proposed. Here, two network classifiers namely Hierarchical Attention Network (HAN) and Random Multimodel Deep Learning (RMDL) are employed to detect the presence of malicious behavior. The network classifier is trained by exploiting proposed MFC, which is an integration of multi-verse optimizer and fractional calculus. The proposed MFC-based hybrid deep learning approach has attained superior results with utmost testing sensitivity, accuracy, and specificity of 0.949, 0.939, and 0.947.

Integrating digital solutions into national health data systems through public-private collaboration: An early experience of the SPICE platform in Kenya.

Public-private collaborative efforts to address healthcare challenges in low- and middle-income countries have been the focus of digital initiatives to improve both access and quality of health services. We report the early feasibility, experience, and learnings of migrating healthcare data generated from a proprietary, privately owned cloud-based environment into an on-premises National Health Data Center (NHDC) in compliance with Kenya's data management legislation. In 2018, Medtronic LABS entered into a partnership with the Kenya Ministry of Health and other stakeholders to improve access to quality services and data availability for non-communicable diseases (diabetes and hypertension), anchored on the SPICE digital health platform. Data migration from SPICE to the NHDC necessitated the establishment of multi-stakeholder coordination structures, alignment on system configuration requirements, provisioning of on-premises servers, data replication and monitoring. The data replication process showed consistency in format and content with no evidence of data loss. The monitoring of the server uptime and availability, however, exposed overall downtime of 15% of the total time tracked between April and December 2022 caused by Internet Protocol address configuration issues, power outages, firewall rule changes, and unscheduled system maintenance. Monthly tracked downtime however reduced from a high of 28% in April 2022 to 5% in December 2022. Our early experience shows that data migration from proprietary host environments to public "one-stop-shop" national data warehouses are feasible provided investments are made in the requisite infrastructure, software and human resource capacity to ensure long-term sustainability, maintenance, and scale to match cloud-based data hosting. Further, digital health solutions developed in collaboration with non-state actors can be integrated into national data systems, saving Governments the cost and efforts of building similar tools while leveraging private sector capacity.

Towards Secure Implementations Of SDN Based Firewall

Software-defined networking (SDN) is an emerging technology as a new paradigm for network architecture. It is a revolutionizing technology that facilitates effective management and programmability in a network. With the surge in popularity of SDN, security measures to protect enterprise networks are getting more critical. In SDN, security methods like firewalls must deal with unpredictable network environments. A firewall is an essential part of network security. It can restrict network data traffic flows according to predefined rules. This research paper analyzes the performance of SDN-based firewalls implemented on different network layers. Mininet simulation tool creates a topology using POX controller and open flow switch. Evaluate data flow by implementing and without a firewall using transmission control protocol (TCP) and user datagram protocol (UDP). To evaluate the performance of the proposed firewall, network parameters like bandwidth, roundtrip time, jitter, and packet loss must be analyzed. The outcome proved that the performance has improved whether either firewall was implemented or not. In the future, by using the Mininet simulation tool with other external controllers like RYU, Floodlight, NOX, etc., analyze the parameters mentioned above and make firewall rules for the application layer.

Packet Filtering Automation System Design Based on Data Synchronization on IP Profile Database Using Python

Data traffic on a dense network is a threat to cybercrime and a high vulnerability for technology companies so that the challenges to prevent it will be more diverse. Adding a strengthening of the boundary wall or firewall and sorting data through packet filtering plus writing firewall rules to prevent malware and attacks from outside at the network device level is an alternative to protect the traffic you have. When heavy traffic makes data exchange uncontrollable, this research will create an automation design so that the sorting of incoming data packets through selection based on the specified rules runs in real-time so that the prevention of crime that enters the network is more swiftly handled. The system is running successfully by connecting the MQTT Collector as a subscriber that uses the python programming language to retrieve profiling data from the IP Profile database. The system was tested on a mikrotik router RB951Ui-2HnD which then the blocking track record will be stored in the Dynamic Firewall Data database in MongoDB. Also added a tool for controlling data in storage in the form of a program release. The results of the test show that data with an average base score above 20 is blocked and then stored in the block list in checking the collection in the database every 30 seconds. In addition, the data in the database will be checked every day within 30 days which will then be released and recorded in the release log in MongoDB.

High-speed Firewall Rule Verification Technique Improves Throughput Performance for IP Version 6

Throughput performance of firewalls depend on the execution speed to verify rules. Internet Protocol Version 6 (IPv6) and IPv4 ruleset memory requirements differ and affect rule access and execution time in a wide range of common firewalls. This paper contributes a high-speed firewall to execute rules for IPv6 with constant O(1) access time, and consumes optimal O(nbit) memory for 64-bit architectures, named FW6 firewall. Results are based on actual performance evaluations in conjunction with other high-speed firewalls (IPSets, IPack, and F3), such as processing time, memory consumption and throughput. Throughput measurements in IPv6 TCP/UDP packet trials (across ruleset and window sizes) show FW6 significantly outperforms IPSets. The trials have shown that FW6 improves throughput performance over IPSets by 0.24% (mean) and 0.21% (median) across all test variables. Nevertheless, the results suggest similarity and a minor performance increase by FW6 over IPSets. In addition, FW6 and IPSets throughputs are similar to IPack and F3 in IPv4 ruleset execution comparisons. As a result, FW6 can be used to replace previous high-speed firewalls.

Continuous Verification of Network Security Compliance

Continuous verification of network security compliance is an accepted need. Especially, the analysis of stateful packet filters plays a central role for network security in practice. But the few existing tools which support the analysis of stateful packet filters are based on general applicable formal methods like Satifiability Modulo Theories (SMT) or theorem prover and show runtimes in the order of minutes to hours making them unsuitable for continuous compliance verification. In this work, we address these challenges and present the concept of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">state shell interweaving</i> to transform a stateful firewall rule set into a stateless rule set. This allows us to reuse any fast domain specific engine from the field of data plane verification tools leveraging smart, very fast, and domain specialized data structures and algorithms including Header Space Analysis (HSA). First, we introduce the formal language <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">FPL</i> that enables a high-level human-understandable specification of the desired state of network security. Second, we demonstrate the instantiation of a compliance process using a verification framework that analyzes the configuration of complex networks and devices - including stateful firewalls - for compliance with FPL policies. Our evaluation results show the scalability of the presented approach for the well known Internet2 and Stanford benchmarks as well as for large firewall rule sets where it outscales state-of-the-art tools by a factor of over 41.

Layer 7 Packet Filtering Implementation on Actual Kernels

The use of Application layer packet classifier and optimization of bandwidth towards QoS in Linux using netfilter, iproute2 and layer-7 Filter. As seen in the statistics the huge amount of data flows through the network, so it is necessity to apply packet-filtering rules in order to control the traffic and add firewall rules. Some services are inherently insecure and impossible to secure on individual hosts. Packet filtering tools can help you segment and contain parts of your network to increase security. A packet filtering tools can help you enforce your network security policies by selectively allowing network services. Because a packet filtering tools must examine all inbound/outbound network traffic, it can help you log network activity. We are looking at packet filtering tools like Netfilters and iproute2, who examine the IP packets for filtering and using the queuing disciplines for traffic control.

DSSF: Decision Support System to Detect and Solve Firewall Rule Anomalies based on a Probability Approach

Currently, establishing a private network on the Internet is highly hazardous for attacks as attackers continuously scan computers for vulnerabilities within the connected network. The firewall ranked the highest as a network device is selected to protect unauthorized accesses and attacks. However, firewalls can effectively protect against assaults based on adequately defined rules without any anomalies. In order to resolve anomaly problems and assist firewall admins with the ability to manage the rules effectively, in this paper, a prototype of the decision support system has been designed and developed for encouraging admins to optimize firewall rules and minimize deficiencies that occur in rules by using the probability approach. The experimental results clearly show that the developed model encourages experts and administrators of firewalls to make significant decisions to resolve rule anomalies by expert's confidence increases by 14.8 %, and administrators' confidence soars similarly about 44.2 %. Lastly, the accuracy of correcting rule anomalies is 83 %.