Firewall Rules Research Articles

Evaluation of the Cyber Security Provision System for Critical Infrastructure

The paper presents an assessment of the functional mechanisms that are part of the security system for the power grid control. The security system, its components, and the real time processes for the control of electricity supply were defined. In particular, SCADA protocols used in the control system and mechanisms for transferring them between the control center and actuators were identified. The paper also includes presentation of a test environment that is used for developed security mechanisms evaluation. In the last fragment of the paper, the test scenarios were formulated and the results obtained in the cyber security system were shown, which cover security probes reaction delay, forged malicious IEC 60870-5-104 traffic detection, DarkNet and HoneyPot interception of adversary actions, and dynamic firewall rules creation.

A deliberately insecure RDF-based Semantic Web application framework for teaching SPARQL/SPARUL injection attacks and defense mechanisms

The Semantic Web uses the Resource Description Framework (RDF) and the Simple Protocol and Query/Update Languages (SPARQL/SPARUL) as standardized logical data representation and manipulation models allowing machines to directly interpret data on the Web. As Semantic Web applications grow increasingly popular, new and challenging security threats emerge. Semantic query languages owing to their flexible nature introduce new vulnerabilities if secure programming practices are not followed. This makes them prone to both existing attacks such as command injection as well as novel attacks, making it necessary for application developers to understand the security risks involved when developing and deploying semantic applications. In this research, we have analyzed and categorized the possible SPARQL/SPARUL injection attacks to which semantic applications are vulnerable. Moreover, we have developed a deliberately insecure RDF-based Semantic Web application, called SemWebGoat – inspired by the open source vulnerable web application, WebGoat – which offers a realistic teaching and learning environment for exploiting SPARQL/SPARUL oriented injection vulnerabilities. With the aim of teaching both developers and web administrators the art of protecting their Semantic Web applications, we have implemented web application firewall (WAF) rules using the popular open-source firewall – ModSecurity – and extended some penetration testing tools to detect and mitigate SPARQL/SPARUL injections. For the evaluation, we conducted a user study to determine the usability of SemWebGoat attack lessons as well as a detection rate and false alarm analysis of our proposed firewall rules based on OWASP top-ten attack dataset. The results of the user study conclude that web developers are not normally familiar with the injection vulnerabilities demonstrated. The positive test results of our ModSecurity rule set show that it a suitable defense mechanism for protecting vulnerable Semantic Web application against injection attacks.

Performance Evaluations of IPTables Firewall Solutions under DDoS attacks

Abstract The paper presents design, background and experimental results of the IPTables applied in IPv4 and IP6Tables applied in IPv6 network compared through several tested parameters. The experimental testbed environment is based on P2P grid utilized for DDoS attacks. IPTables tool is used for packet filtering and consequently for preventing DoS/DDoS attacks. It allows a system administrator to configure the tables, the chains and rules it stores in order to manage the incoming and outgoing packets. The packets are treated according to the rules’ results provided by the packet processing. A rule in a chain can be bound with another chain in the table etc. We employ the P2P grid environment to carry out as well as to coordinate DDoS attack on the availability of services to simulate real DDoS attack launched indirectly through many compromised computing systems. The same routing protocols as well as the same firewall rules were used for IPv4 and for IPv6 network. The main aim was to analyse pros and cons of new IP6Tables tool compared with IPTables in IPv4 networks in light of the resistance to DDoS attacks which is still one of the most significant threats in the IPv6 networks.

A Novel Technique for Effective Optimization of Cross Domain Network Protocol for Redundancy Removal in Firewall Policies

today's rapidly progressing professional world, internet is being used as a medium for almost every operation. Firewalls are extensively implemented to prevent unauthorized access to concealed networks and secure them. Based upon the applied policies a firewall can approve or decline the data packet by scrutinizing them. The large size and intricacy of modern networks result in big and complex firewall policies. Optimizing these policies is crucial for network performance inflation. Existing system facilitates inter-firewall or intra- firewall optimization within similar sets of administrative domains. They try to achieve optimization but at the cost of decreased network performance. In this paper, a protocol to increase the network performance while the cross domain firewall rules are optimized is explained. Rule optimization is achieved by redundant rule removal between the two firewalls. For boosting the performance and security, the data sent over the network will be encrypted and decrypted over a session key. Two types of rules i.e. network and user rules are supported. User can configure his own rules as per the required configuration in appropriate domain. Network rules will be common for both the domains and can be updated by the network administrator. The key technical experimentation is that firewall policies cannot be involved within similar domain areas because a firewall strategy contains exhaustive information and even potential security holes.

The Research and Application of Multi-Firewall Technology in Enterprise Network Security

A firewall’s complexity is known to increase with the size of its rule set. Empirical studies show that as the rule set grows larger, the number of configuration errors on a firewall increases sharply, while the performance of the firewall degrades. When designing a security-sensitive network, it is critical to construct the network topology and its routing structure carefully in order to reduce the multi-firewall rule sets, which helps lower the chance of security loopholes and prevent performance bottleneck. This paper studies the problems of how to place the firewalls in a topology during network design and how to construct the routing Tables during operation such that the maximum firewall rule set can be minimized. We have two major contributions. First, we prove that the problems are NP-complete. Second, we propose a heuristic solution and demonstrate the effectiveness of the algorithm by simulations. The results show that the proposed algorithm reduces the maximum multi-firewall rule set when comparing with other algorithms.

Frontier technologies of trust computing and network security

The increasing complexity of computer systems and communication networks induces tremendous requirements for trust and security. This special issue includes topics on trusted computing, risk and reputation management, network security and survivable computer systems/networks. These issues have evolved into an active and important area of research and development. The past decade has witnessed a proliferation of concurrency and computation systems for practice of highly trust, security and privacy, which has become a key subject in determining future research and development activities in many academic and industrial branches. This special issue aims to present and discuss advances of current research and development in all aspects of trusted computing and network security. In addition, this special issue provides snapshots of contemporary academia work in the field of network trusted computing. We prepared and organized this special issue to record state-of-the-art research, novel development and trends for future insight in this domain. In this special issue, 14 papers have been accepted for publication, which demonstrate novel and original work in this field. A detailed overview of the selected works is given below.

Design and Implementation of the Firewall Policy Audit Based on Improved Policy Tree

Firewall plays an important role in today's network security, and its rule configuration is reasonable or not directly related to the security of network environment. With the increasing size of the network, firewall configurations are becoming increasingly complex, and the firewall policy audit should be born in order to better play the protective properties of the firewall. Firstly, this paper studies the relationship between firewall rules in detail, analyzes some common types of rules abnormal of audit programs and reviews existing policies. Next, this paper proposes a improved audit program based on the tree structure, discusses and achieves the audit process of the program in detail. Finally, this paper shows a graphical reports and detailed audit findings of the prototype system, and does a comparison and verification between the results of the improved audit program and the traditional strategy tree.

Expert Rules of Firewall: A Technique to Construct and Modified a Set of Rules

Expert Rules of Firewall: A Technique to Construct and Modified a Set of Rules

English

Firewalls have become the most essential part that is deployed on the Internet for protecting the private networks. Optimizing firewall rules is very critical for enhancing the performance of a network. The early work on firewall optimization focuses on either intra-firewall or inter-firewall optimization within one administrative domain where the privacy of firewall policies is not a concern. The main technical challenge to focused on is that firewall policies cannot be disclosed across domains because a firewall policy contains secret information and even potential security holes, which can be easily utilized by attackers. Proposed work involves first the protocol for preserving firewall policies and optimizing them. Particularly, for any two adjacent firewalls that belongs to two different administrative domains, this protocol can identify the rules in each firewall that can be removed because of the other firewall. This process of optimization involves computation between the two firewalls without any party disclosing their policies to the other. The communication cost is reduced by the optimization process. This protocol sustains no extra online packet processing overhead, and also the offline processing time is less.

REDUNDANCY REMOVAL OF RULES WITH REORDERING THEM TO INCREASE THE FIREWALL OPTIMIZATION

Firewalls are widely getting used for securing the private network. Firewalls check each incoming and outgoing packets and according the rules given by network administrator and it will take the decision whether to accept or discard the packet. As per the huge requirement of services on internet the rule set becomes large and takes more time to process one packet and it affects the throughput of firewall. So firewall optimization has a great demand to get good performance. Exiting research efforts developed techniques for either intra-firewall or inter-firewall optimization within a single administrative domain. In addition, existing techniques are inefficient in reducing packet processing delay, because they optimize firewall rules by only reducing the number of rules, but lack the intelligence to decide the order of rules. This paper proposes an adaptive cross-domain firewall policy optimization technique using statistical analysis, while protecting the policy confidentiality. To the best of our knowledge, we are the first to propose a technique that dynamically decides the order of rules based on the network statistics. The proposed technique not only identifies and removes redundant rules but also identifies the order of rules in the rule set to improve the performance of the system. The optimization process involves two tasks: First, collaboratively reduce the number of rules between multiple firewalls, while protecting confidentiality of them. Second, using network usage statistics, identify the order of rules in the rule set The feasibility of the proposed technique is shown with the help of the prototype implementation. The evaluation results show the effectiveness and efficiency of the proposed solution.

REVIEW ON REDUNDANCY REMOVAL OF RULES FOR OPTIMIZING FIREWALL

Firewalls are such a system, designed to prevent unauthorized internet access to or from private networks. A firewall checks all incoming and outgoing traffic by analyzing the data packets and then by using different policies determines whether to accept or discard the traffic. It is important to boost the firewall policies to improve network performance. The performance of the firewall is critical in enforcing and administrating security when network is under attack. Growth of the Internet with the increasing civilization of the attacks is placing stiff demands on firewall performance. It has been noticed that firewall policies are badly outlined and very erroneous. So it is very important to increase the performance of the firewall with good design of policies. Firewall performance can be optimized using various techniques like, optimizing firewall rules, optimization using data mining techniques. Firewall policies cannot be shared across domains as it contains confidential information and also various security holes are also present. Virtual private network integrated with mutual firewall protect the external network from encipher drift freight with minimum cost. Previous work gives emphasis on cross-domain privacy-preserving interfirewall optimization by removing interfirewall policy redundancies with preserving privacy. This privacy preserving protocol identifies rules of two adjoining firewalls resting between separate domains. This protocol sustains no more online packet process cost and offline process time is also less [16].

FMPC: A Fast Multi-Dimensional Packet Classification Algorithm

With the rapid development of the Internet, the number of firewall rules is increasing. The enormous quantity of rules challenges the performance of the packet classification that has already become a bottleneck in firewalls. This dissertation proposes a rapid and multi-dimensional algorithm for packet classification based on BSOL(Binary Search On Leaves), which is named FMPC(FastMulti-dimensional Packet Classification). Different from BSOL, FMPC cuts all dimensions at the same time to decompose rule spaces and stores leaf spaces into hash tables; FMPC constructs a Bloom Filter for every hash table and stores them into embedded SRAM. When classifying a packet, FMPC performs parallel queries on Bloom Filters and determines how to visit hash tables according to the results. Algorithm analysis and the result of simulations show: the average number of hash-table lookups of FMPC is 1 when classifying a packet, which is much smaller than that of BSOL; inthe worst case, the number of hash-table lookups of FMPCisO(logwmax+1⁡), which is also smaller than that of BSOL in multi-dimensional environment, where wmax is the length, in bits, of the dimension whose length is the longest..

Not coping with change

Not many organisations cope well with change. Whether it's adding people to, or deleting them from, an HR database or Active Directory, installing or moving switches or access points, or tinkering with firewall rules, much of what changes within an organisation's network goes unremarked and undocumented. In this interview with Michael Fimin, CEO of Netwrix, we discover just what problems such unmanaged change can cause.

Dynamic rule and rule‐field optimisation for improving firewall performance and security

A novel approach is presented to improve firewall packet filtering through optimising the order of firewall rules for early packet acceptance as well as the order of rule-fields for early packet rejection. The proposed approach is based on the calculation of the histograms of packet matching rules and of packet not matching rule-fields. These histograms are able to effectively monitor firewall performance in real-time and to predict the patterns of packet filtering in terms of rules order and rule-fields order. Furthermore, the proposed approach becomes even more significant when firewall is heavily loaded with burst traffic. A comparison of the proposed approach and the other conventional approaches, including static rule order approach and dynamic rule order approach is presented. The numerical results obtained by simulations demonstrate that the proposed approach is able to significantly improve the firewall efficiency in terms of cumulative processing time compared to other conventional approaches. Furthermore, the proposed scheme also has the capability to significantly reduce the effect of many common network attacks on firewall performance.

Dynamic Rule based Interfirewall Optimization using Redundancy Removal Algorithm

Firewall is a typical security system that extensively secures the private networks. The operation of a firewall is to analyze every packet and decide whether to accept or discard it based upon the firewall policy. This policy is specified as a set of rules. The work focuses on inter-firewall optimization over distinct administrative domain without exploiting the privacy policies. With the massive growth of Internet-based applications, the number of rules in firewalls has been increasing in a rapid rate, which degrades the network performance and throughput. To mitigate the number of rules validation for every session, a dynamic rules estimation algorithm is proposed. However, an error in a firewall either discloses secret information from its network or interrupts proper communication between its network and the Internet. The redundancy removal algorithm is used to overcome these problems by reducing the redundant rules in the firewall with multi-rule coverage. The optimization process involves semihonest computation between the two firewalls by preserving privacy of the each party firewall policies. The algorithm used will avoid the rules overhead and increases the efficiency by optimizing the firewall.

Automatic Test Packet Generation

Networks are getting larger and more complex, yet administrators rely on rudimentary tools such as ping and traceroute to debug problems. We propose an automated and systematic approach for testing and debugging networks called “Automatic Test Packet Generation” (ATPG). ATPG reads router configurations and generates a device-independent model. The model is used to generate a minimum set of test packets to (minimally) exercise every link in the network or (maximally) exercise every rule in the network. Test packets are sent periodically, and detected failures trigger a separate mechanism to localize the fault. ATPG can detect both functional (e.g., incorrect firewall rule) and performance problems (e.g., congested queue). ATPG complements but goes beyond earlier work in static checking (which cannot detect liveness or performance faults) or fault localization (which only localize faults given liveness results). We describe our prototype ATPG implementation and results on two real-world data sets: Stanford University's backbone network and Internet2. We find that a small number of test packets suffices to test all rules in these networks: For example, 4000 packets can cover all rules in Stanford backbone network, while 54 are enough to cover all links. Sending 4000 test packets 10 times per second consumes less than 1% of link capacity. ATPG code and the data sets are publicly available.

GEOMETRIC EFFICIENT MATCHING ALGORITHM FOR FIREWALLS

Concept of Firewall is the most important thing in network and the traffic which is passing through network perimeter needs to be filtering the traffic that is going to pass through it. Thus there is potential risk in this process. As each packet needs to be checked with each firewall rule to find the matching rules. ’Geometric Efficient Matching Algorithm ‘ is one of the computational geometry algorithm which gives practically better solution for the purpose of finding the rule which exactly matches. With the help of firewall rule statistics we have generated random model of perimeter rule which is not uniform. We also reduced the space requirement up to 2-3 MB for 5000 rules. Also it solves problem of firewall misconfiguration for firewall packet matching

Decision Diagram-Based Modeling of Network Reachability

The computer network attack graph generation method obtained mostly through network scanning, this network reachability information, this approach takes a long presence information and incomplete defects by analyzing network reachability main task of research and developing trends is proposed based on binary decision diagrams algorithm approach to achieve network reachability studies. The algorithm uses the decision diagram modeling firewall rules, through the collection operations to achieve network reachability studies.

Energy Efficient Secure Firewall and Packet Filtering System in Wireless Sensor Networks

Sensor networks play a key role in collecting information from the human unattended and surveillance area. The information collected from any types of networks should be secure in all perspective and that too security in sensor networks is crucial because the information is of auto generated type and it is difficult to distinguish between original and replicated information at receiver side. The existing secure mechanism like cryptographic techniques is too complex and it affects the performance of the sensor networks by dissipating more energy for both computational and communicational purpose. This research work aims to propose a low complex simple secure mechanism for sensor networks which can withstand the simple types of attacks to provide a framework for achieving Confidential, Authentication and Integrity. This security is achieved by adopting a firewall rules and packet filtering in the sensor networks with an efficient clustering mechanism for the resource constrained sensor devices.

To Design and Implementation of Framework for Firewall Policy with Minimum Rule Set

Firewall is a most crucial element to implement security policies in a network and also crucial to success of network rather say to success of an organization. Despite of its important in any network it has many problems and one of them is increasing number of rules in firewall’s rule set. Since in today’s environment, enterprises looking to provide strongest security to their users and also want to secure their data at maximum level and hence they have increased rules in firewall’s rule set. However increasing number of rules in firewall rule set is not an efficient way to provide maximum security. And this study shows that how can the use of minimum number of rules in firewall rule set to implement optimum security is possible. It has also proved that this problem of minimizing maximum firewall rule set in network is NP complete. One point is noteworthy to mention here that in today’s time as enterprises are moving towards cloud technology the complexity at data center is increased and it is being difficult to implement security in clouds. So by having highly optimized firewalls, it is possible that they can be used to provide security in clouds.