Network Firewall Research Articles

Genetic fuzzy rules and hybrid QDCNN-F-DSAE for detecting attacker behavior with tuning of firewall

ABSTRACT The application of computer technology is increasing quickly as the field of information technology develops over time. Because of the growth of computer networks, there is a rise in network attacks. Moreover, the majority of transactions are conducted via the Internet, and then the web application security is becoming increasingly important. A network firewall shields the web servers from unauthorised and dangerous traffic. In this work, the hybrid Quantum Dilated Convolutional Neural Network fused Deep-Stacked Auto Encoder (QDCNN-F-DSAE) model with Genetic Fuzzy System (GFS) is developed for network protection. With the utilisation of genetic fuzzy system (GFS) and firewall tuning, the QDCNN-F-DSAE identified the attack, ransomware activity, and prompt decision-making. The data offered by the simulated environment is used to make decisions, and the decisions should be made quickly within a few seconds using the proposed QDCNN-F-DSAE with GFS. Furthermore, it identifies the attacks and alerts the users to store the data from the supplied source. The malicious function and protected private Local Area Network (LAN) are discovered and removed by the firewall after the formation of genetic fuzzy rules. Moreover, this model is estimated using the accuracy, sensitivity, and specificity measures that offered the finest values of 0.915, 0.908, and 0.920.

Is the European Crohn’s and Colitis organisation (ECCO) e-guide an acceptable and feasible tool for increasing gastroenterologists’ guideline adherence? A mixed methods evaluation

Background and aimsManagement of inflammatory bowel disease is constantly evolving, increasing the importance for gastroenterologists to keep up to date with guidelines. Traditional implementation strategies have had only small positive impacts on clinical practice. eHealth strategies such as the European Crohn’s and Colitis Organisation e-guide may be beneficial for clinician decision making in keeping with guidelines. The aim of this study was to evaluate the feasibility and acceptability of the e-guide.MethodsA mixed methods approach was used to evaluate feasibility and acceptability. Cognitive (think-aloud) interviews were conducted with Australian gastroenterologists while using the e-guide. Two clinical scenarios were developed to allow evaluation of various aspects of the e-guide. Content analysis was applied to the qualitative interview data and descriptive analysis to the quantitative and observational data.ResultsSeventeen participants completed the study. Data saturation were reached. The ECCO e-guide was largely feasible and acceptable, as demonstrated by most clinical questions answered correctly, 87% reaching the answer within 3 min, and most feeling it was useful, would be beneficial to their practice and would use it again. Issues raised included difficulties with website navigation, layout of the e-guide and difficulties with access (network firewalls, paid subscription required).ConclusionsThe ECCO e-guide is largely acceptable and feasible for gastroenterologists to use. Aspects of the e-guide could be modified to improve user experience. This study highlights the importance of engaging end-users in the development and evaluation of clinician educational tools.

Windows Bypass and Multilayer Security

Firstly, the abstract delves into the diverse array of bypass techniques employed by adversaries, ranging from traditional methods such as password cracking and privilege escalation to more advanced tactics like file less malware and code injection. Understanding these tactics is crucial for defenders to anticipate and counteract potential threats effectively. Secondly, the abstract highlights the limitations of singular security measures and advocates for the adoption of multilayer security strategies. By implementing a combination of preventive, detective, and corrective controls, organizations can create multiple barriers for attackers, making it significantly more challenging to compromise Windows systems. These layers may include network firewalls, intrusion detection systems, endpoint protection software, and user training programs. Moreover, the abstract emphasizes the importance of proactive security measures, such as regular software updates, vulnerability assessments, and penetration testing, to identify and address potential weaknesses before they can be exploited by attackers. Additionally, the abstract discusses the significance of user education and awareness in mitigating common attack vectors, such as phishing and social engineering.

Virtual Private Network—Firewall Integration for Wireless Local Area Network Improvement against Jammers

Wireless networks are susceptible to many security problems since the wireless medium is open. Jammer (jamming attack) is the most important problems in wireless networks. It is denial-of-service attack in which attackers send malicious signals or messages on a channel that is intended for normal traffic by intentionally interfering with the network. One of the solutions is the development of tunneling technology as an attempt to secure communication networks. Virtual Private Network (VPN) tunneling technology when integrated with firewall would provide a suitable security. In this study, number of Jammers would interfere with the normal operation of the network resulting in performance degradation of network. These Jammers decrease throughput and increase delay and data dropped. The aim of this study is to improve the performance of Wireless Local Area Network (WLAN) by integrating Firewall with VPN in number of different Riverbed Modeler simulation scenarios which it is utilized in this study for video and data applications. Firewall is a technology employed to regulate the level of network connectivity. It can block unauthorized access from an external network to an internal network’s resources. In this study, the tunneling technology of VPN was integrated with firewall to improve the performance by increasing the throughput and decreasing delay and data dropped. The firewall would block any access to the server from the workstations and the VPN would filter the packets to allow a specific access to the specific server. The results showed that VPN when integrated with firewall increased the throughput from 1,350,000 to 1,500,000 bits/sec and decreased the delay from 0.0054 sec to 0.0047 sec and data dropped from 7,800 to 5,000 bits/sec so that this study proved that VPN incorporated with firewall provides a good throughput and delay improvement for wireless local area network.

Detection and Classification of Botnet Traffic using Deep Learning with Model Explanation

Distributed denial-of-service attacks are a kind of malicious attempts among many others that make target services unavailable to legitimate users by using a large number of bots, which send many service requests exceeding the processing capacity of the services. Detection of botnet traffic is therefore critical to maintaining the availability and quality of the services. In contrast, identifying the type of botnet attacks helps system administrators quickly determine which part of the computer and network system is under attack. Current works focus on rule-based detection, which sets rules in the network firewall to drop suspicious traffic that matches the rules. With the emergence of machine learning and deep learning (ML/DL), several preliminary works have been developed to learn botnet traffic behavior and perform detection. However, the performance of existing ML/DL models can be further improved and their decision/prediction are not transparent, making it hard for users to interpret and trust the results. In this work, we develop a novel deep learning model for botnet detection and classification combined with its ability of explaining the decision of the model. We first leverage latent representation of traffic features generated using convolutional neural networks to detect whether a traffic record is generated by a bot then determine the type of bots. We adopt an existing explainable framework to interpret the prediction of the developed deep learning model. We perform extensive experiments with real network traffic as well as synthetic traffic generated by IXIA BreakingPoint System. We compare the developed model with existing models on various performance metrics. The experimental results show that the developed model outperforms the existing machine learning models with an improvement of up to <inline-formula><tex-math notation="LaTeX">$15\%$</tex-math></inline-formula> for all performance metrics while providing a clear explanation of the model decision.

Research on the optimisation of whitelisting technology for network firewall in industrial control system using genetic algorithm

Research on the optimisation of whitelisting technology for network firewall in industrial control system using genetic algorithm

Research on the optimisation of whitelisting technology for network firewall in industrial control system using genetic algorithm

Research on the optimisation of whitelisting technology for network firewall in industrial control system using genetic algorithm

Relay learning: a physically secure framework for clinical multi-site deep learning

Big data serves as the cornerstone for constructing real-world deep learning systems across various domains. In medicine and healthcare, a single clinical site lacks sufficient data, thus necessitating the involvement of multiple sites. Unfortunately, concerns regarding data security and privacy hinder the sharing and reuse of data across sites. Existing approaches to multi-site clinical learning heavily depend on the security of the network firewall and system implementation. To address this issue, we propose Relay Learning, a secure deep-learning framework that physically isolates clinical data from external intruders while still leveraging the benefits of multi-site big data. We demonstrate the efficacy of Relay Learning in three medical tasks of different diseases and anatomical structures, including structure segmentation of retina fundus, mediastinum tumors diagnosis, and brain midline localization. We evaluate Relay Learning by comparing its performance to alternative solutions through multi-site validation and external validation. Incorporating a total of 41,038 medical images from 21 medical hosts, including 7 external hosts, with non-uniform distributions, we observe significant performance improvements with Relay Learning across all three tasks. Specifically, it achieves an average performance increase of 44.4%, 24.2%, and 36.7% for retinal fundus segmentation, mediastinum tumor diagnosis, and brain midline localization, respectively. Remarkably, Relay Learning even outperforms central learning on external test sets. In the meanwhile, Relay Learning keeps data sovereignty locally without cross-site network connections. We anticipate that Relay Learning will revolutionize clinical multi-site collaboration and reshape the landscape of healthcare in the future.

Analisis Keamanan Komputer Terhadap Serangan Distributed Denial of Service (DDOS)

Distributed Denial of Service (DDoS) is a type of active attack, an attack that can overwhelm a system by flooding a computer or server with network traffic, disrupting user services. The goal of this attack is usually to disable services and disconnect from the compromised­­­­­­­­ computer or network. The impact is very large for companies or agencies that offer services. Victims of these attacks are unable to provide the services they are supposed to. Due to a bug or constraint on the server you are trying to use and one of the ways to deal with these attacks is to use a computer network firewall, which is useful for protecting computers from various outer space attacks. If the computer has a firewall security system, it is likely that no one on the Internet can access the data on the connected computer or web server. Firewall, works like a partition or wall that blocks the computer from the Internet. This "firewall" allows you to control what data, information, and activity can be transferred from the Internet to your computer and vice versa. With better data security and can avoid DDOS attacks that want to be carried out by irresponsible parties.

Privacy and Security Enhancement of Smart Cities using Hybrid Deep Learning-enabled Blockchain

The emergence of the Internet of Things (IoT) accelerated the implementation of various smart city applications and initiatives. The rapid adoption of IoT-powered smart cities is faced by a number of security and privacy challenges that hindered their application in areas such as critical infrastructure. One of the most crucial elements of any smart city is safety. Without the right safeguards, bad actors can quickly exploit weak systems to access networks or sensitive data. Security issues are a big worry for smart cities in addition to safety issues. Smart cities become easy targets for attackers attempting to steal data or disrupt services if they are not adequately protected against cyberthreats like malware or distributed denial-of-service (DDoS) attacks. Therefore, in order to safeguard their systems from potential threats, businesses must employ strong security protocols including encryption, authentication, and access control measures. In order to ensure that their network traffic remains secure, organizations should implement powerful network firewalls and intrusion detection systems (IDS). This article proposes a blockchain-supported hybrid Convolutional Neural Network (CNN) with Kernel Principal Component Analysis (KPCA) to provide privacy and security for smart city users and systems. Blockchain is used to provide trust, and CNN enabled with KPCA is used for classifying threats. The proposed solution comprises three steps, preprocessing, feature selection, and classification. The standard features of the datasets used are converted to a numeric format during the preprocessing stage, and the result is sent to KPCA for feature extraction. Feature extraction reduces the dimensionality of relevant features before it passes the resulting dataset to the CNN to classify and detect malicious activities. Two prominent datasets namely ToN-IoT and BoT-IoT were used to measure the performance of this anticipated method compared to its best rivals in the literature. Experimental evaluation results show an improved performance in terms of threat prediction accuracy, and hence, increased security, privacy, and maintainability of IoT-enabled smart cities.

IMPLEMENTATION OF SHARED INTERNET SERVICE COMPUTER NETWORK (RT/RW NET) HOME.NET

The home.net network in pademangan II Gg. 15 North Jakarta is being built to meet the needs of the local community's internet network at low cost. When building an internet network the author uses a Mikrotik Router with a firewall network setting method. The author uses the firewall method so that internet network security will be safe. The internet network is currently experiencing problems in managing user bandwidth which results in unbalanced bandwidth between clients when used together. This study discusses bandwidth management for home.net network users based on the priority value of each user, which varies according to their needs. By using the internet network firewall can be controlled. The results achieved were that before bandwidth management was used, the speed on the network was 46.2 Mbps. After using the speed on the network will be reduced to 1360.3kbps.

Clock Synchronization and Timestamping of Data on Acquisition at the Wellsite: Guidelines and Recommendations

Summary Due to the nature of drilling operations, there are several companies collecting data at the rig. The data acquisition system of each company applies its own timestamp to the data. Subsequent aggregation of data (for example, in a data repository) relies on synchronized timestamps applied to the different data sources to correctly collate the data. Unfortunately, synchronized timestamping is rarely achieved. In this paper, we document the different sources of errors in timestamping of data and provide guidelines to help mitigate some of these causes. There are many reasons for the unsynchronized timestamping of data from different sources. It can be as simple as clock synchronization at the rig; each data-providing or -producing company has an independent clock. It can also be due to where the timestamp is applied, for example, at the data source or on data reception. Additionally, it can be due to how the timestamp is applied—at the start of the sampling interval, the midpoint, or the end. Some of the communication methods used at the wellsite, such as mud pulse telemetry that is used to transmit downhole measurements to the surface, have a high, nonstationary latency and the actual acquisition time may vary significantly from the received time. Not correcting the reception time for the transmission delay can result in erroneous timestamping of downhole-acquired data. Timestamping of derived data (data computed from two or more sources) is problematic if the data sources are unsynchronized. Synchronization of clocks within the data acquisition network is therefore extremely important. The resolution of time synchronization depends on purpose; motion control of the rig equipment (for example, the hoist) demands high-resolution timekeeping. However, for the purposes of timestamping acquired data, synchronization to a network time server (a computer with access to a reference clock that distributes the time of day to its client computers over a network) with a resolution of 1 millisecond is sufficient. The issue is agreeing on the common source of time (the reference clock) and agreeing on the passage of time signals through network firewalls. Timestamping is a more involved matter, calling for agreement on standards and, if possible, a computer-interpretable description of the time-related information associated with real-time data. In this paper, we describe in some detail sender vs. receiver timestamping, the downhole to surface timestamp chain, and timestamping of derived data. Systems automation and interoperability at the rigsite—allowing plug-and-play access to equipment and applications—rely on an agreed-upon network synchronization scheme and timestamping methods and standards. Indeed, designing applications that must handle uncertain time adds considerable complexity and cost, not to mention the impact on accuracy and reliability. We present an ordered approach (or guidelines) to a quite resolvable problem. In the last section of the paper, we use a semantic network approach (a semantic graph) to describe relationships for clock synchronization and timestamping (the guidelines and recommendations developed in this paper). A complete description of the semantic vocabulary is provided in an appendix. This makes these guidelines and recommendations digital—able to be interpreted by digital devices—and therefore implementable and auditable.

Deep Learning Technique-Enabled Web Application Firewall for the Detection of Web Attacks.

New techniques and tactics are being used to gain unauthorized access to the web that harm, steal, and destroy information. Protecting the system from many threats such as DDoS, SQL injection, cross-site scripting, etc., is always a challenging issue. This research work makes a comparative analysis between normal HTTP traffic and attack traffic that identifies attack-indicating parameters and features. Different features of standard datasets ISCX, CISC, and CICDDoS were analyzed and attack and normal traffic were compared by taking different parameters into consideration. A layered architecture model for DDoS, XSS, and SQL injection attack detection was developed using a dataset collected from the simulation environment. In the long short-term memory (LSTM)-based layered architecture, the first layer was the DDoS detection model designed with an accuracy of 97.57% and the second was the XSS and SQL injection layer with an obtained accuracy of 89.34%. The higher rate of HTTP traffic was investigated first and filtered out, and then passed to the second layer. The web application firewall (WAF) adds an extra layer of security to the web application by providing application-level filtering that cannot be achieved by the traditional network firewall system.

H-DOCTOR: Honeypot based firewall tuning for attack prevention

A honeypot is a well-known entrapment technique used by network and Internet of Things (IoT) security professionals to lure intruders. Unlike traditional security measures, they can capture information in real time from the attacker about how they are attacking. A network firewall protects Internet servers from unwanted and malicious traffic. Detecting ransomware with existing security systems such as IDPS (Intrusion Detection and Protection System) and AV (Antivirus) is difficult and time-consuming. In this paper, a novel hybrid Honeynet deployed in Docker for detecting attacker behavior with Tuning Of fiRewall (H-DOCTOR) has been proposed. The proposed H-DOCTOR technique comprises both low interaction and high interaction honeypot to attract the malicious attacker and to analyze the behavioral patterns. This is a form of bait, designed to detect or block attacks, or to divert an attacker's attention away from the legitimate services and tune the firewall. The proposed H-DOCTOR method identify ransomware activity, attack trends, and timely decision-making through the use of an effective rule and tunes the firewall. The proposed H-DOCTOR framework is compared with existing methods such as HyInt,IDS and honeypot-based IDS. The proposed system achieves higher accuracy of 86% and the existing system such as HyInt,IDS and honeypot-based IDS achieves 73.25%, 76.75% and 81.25%.

Analisis Penerapan Sangfor Ngaf Firewall Sebagai Keamanan Pada Jaringan Internet Universitas Muhammadiyah Purwokerto

Computer network technology is developing very rapidly, but as a result of these technologicaldevelopments causing the exploitation of security gaps in network systems by exploiting securitholes, unauthorized users can easily commit crimes in the cyber world known as Cyber CrimeSniffing, Spoffing, DoS attacks. Sangfor NGAF is a network firewall security tool designed to filteand check across networks and applications, The analysis is intended to provide an overview ofsecurity vulnerabilities in network systems where these steps are important steps to determine thebest way to close security holes in the network. In this analysis there are steps taken, namelPreparation, Observation, Data Collection, and Network Analysis. The results of this study areseveral servers that have been compromised, from the analysis results obtained there are variouskinds of attacks including WebShell or Backlink, Bot Controlled, Brute-force, SQL Injection, and so on.

Deployment of Honeypot and SIEM Tools for Cyber Security Education Model In UITM

Nowadays the threat of cyber-attacks is increasing as more organizations undergo digital transformation. Therefore, organizations need to take proactive measures to mitigate the cyber threat to avoid further loss to their business. To mitigate cyber risk effectively, organizations need to employ competent people in the IT security team to implement effective security controls. But there is a shortage of cyber security talent or professionals in the job market and to produce talents in the cyber security field requires extensive effort in education and training. A good cyber security education program should have to date curriculum and provide practical experience. To achieve this, the program must be supported by a cyber security lab equipped with various software, equipment, and tools used by a real professional in the industry. Therefore, this paper proposed a model of a cyber security lab equipped with honeypot and SIEM systems to enhance the quality of cyber security education. The cyber security lab based on the model was deployed at Universiti Teknologi MARA (UiTM) and used for teaching and learning activities. The honeypot will provide student experience analyzing the behaviour of hackers while the SIEM system will aggregate the logs data of the Campus Network Firewall in real-time. To evaluate the effectiveness of the proposed lab model, a functional test and a survey was conducted. The survey result shows that majority of the respondent agreed that the cyber security lab improve their teaching and learning experience while taking the cyber security subject.

FFF: Fast Firewall Framework to Enhance Rule Verifying over High-speed Networks

The current traffic trend on computer networks is growing exponentially, affecting network firewalls because they constantly have to filter out massive amounts of data. In this paper, we implement a firewall framework to improve traffic processing speed, named the Fast Firewall Framework (FFF). FFF can verify rules at Big-O(1) worst-case access time, and it also consumes a small amount of memory, which is only Big-O(nbit). To evaluate the firewalls' effectiveness, we benchmark the proposed firewall framework against the two fastest firewalls (The state of the art of opensource firewall), IPSets and IPack. The experimental results show that the Fast Firewall Framework can execute rules faster than both firewalls and consumes less memory. In particular, the proposed firewall framework has a simple structure that makes it easier to implement.

Applying Spring Security Framework with KeyCloak-Based OAuth2 to Protect Microservice Architecture APIs: A Case Study.

In this study, we implemented an integrated security solution with Spring Security and Keycloak open-access platform (SSK) to secure data collection and exchange over microservice architecture application programming interfaces (APIs). The adopted solution implemented the following security features: open authorization, multi-factor authentication, identity brokering, and user management to safeguard microservice APIs. Then, we extended the security solution with a virtual private network (VPN), Blowfish and crypt (Bcrypt) hash, encryption method, API key, network firewall, and secure socket layer (SSL) to build up a digital infrastructure. To accomplish and describe the adopted SSK solution, we utilized a web engineering security method. As a case study, we designed and developed an electronic health coaching (eCoach) prototype system and hosted the system in the expanded digital secure infrastructure to collect and exchange personal health data over microservice APIs. We further described our adopted security solution’s procedural, technical, and practical considerations. We validated our SSK solution implementation by theoretical evaluation and experimental testing. We have compared the test outcomes with related studies qualitatively to determine the efficacy of the hybrid security solution in digital infrastructure. The SSK implementation and configuration in the eCoach prototype system has effectively secured its microservice APIs from an attack in all the considered scenarios with 100% accuracy. The developed digital infrastructure with SSK solution efficiently sustained a load of (≈)300 concurrent users. In addition, we have performed a qualitative comparison among the following security solutions: Spring-based security, Keycloak-based security, and their combination (our utilized hybrid security solution), where SSK showed a promising outcome.

Future Development Trend of Wireless Communication Smart Antenna Technology

From the overall situation of modern society, we have step by step into the comprehensive information age, our traditional way of life and work has been gradually changed by advanced communication technology. In the process of the continuous development of the information age, due to the continuous development of information technology, computer network security has been threatened by the very serious, and criminals in order to benefit, such as hackers constantly trying to break through the network firewall information acquisition, data and information of trafficking, serious can lead to companies appear even leakage of trade secrets. This paper improves from the radio monitoring level, aiming at the leakage of computer information, has the purpose to improve the network communication mode, aiming to provide relevant technologies and solutions, and provide relevant reference for the application of computer network.

Reducing Complexity of Server Configuration through Public Cloud Storage

Hosting networking applications typically involves a server publicly accessible over the Internet. However, preparing a server requires excessive time and effort, particularly for non-expert users. This is because users configure multiple elements including the server, host firewalls, and network firewalls, while considering their interactions. To address this problem, we propose a method that uses public cloud storage, such that all messages are communicated through the storage between the server and clients. As the storage is public and accessible over the Internet, users need not consider firewalls and can focus on configuring the server. We implemented the proposed method for web applications and evaluated its performance by accessing applications from 90 hosts in diverse locations. The evaluation showed that the proposed method does not incur extra delays and clients can access the applications as reliably as the current practice of configuring servers. We also recruited 54 participants and examined the time required to configure a server with the proposed method compared to configuration using current practice. This study demonstrated that the proposed method reduces configuration time from 40−60 to nearly 30 min. We believe that the proposed method provides a basis for improving the manageability of server configuration.