Network Firewall Research Articles

An SDN/NFV-Enabled Enterprise Network Architecture Offering Fine-Grained Security Policy Enforcement

In recent years, the number of attacks and threat vectors against enterprise networks have been constantly increasing in numbers and variety. Despite these attacks, the main security systems, for example network firewalls, have remained rather unchanged. In addition, new challenges arise not only to the level of provided security, but also to the scalability and manageability of the deployed countermeasures such as firewalls and intrusion detection systems. Due to the tight integration into the physical network's infrastructure, a dynamic resource allocation to adapt the security measures to the current network conditions is a difficult undertaking. This article covers different architectural design patterns for the integration of SDN/NFV-based security solutions into enterprise networks.

Analytical Model for Elastic Scaling of Cloud-Based Firewalls

This paper shows how to properly achieve elasticity for network firewalls deployed in a cloud environment. Elasticity is the ability to adapt to workload changes by provisioning and de-provisioning resources in an autonomic manner, such that at each point in time the available resources match the current demand as closely as possible. Elasticity for cloud-based firewalls aims to satisfy an agreed-upon performance measure using only the minimal number of cloud firewall instances. Our contribution lies in determining the number of firewall instances that should be dynamically adjusted in accordance with the incoming traffic load and the targeted rules within the firewall rulebase. To do so, we develop an analytical model based on the principles of Markov chains and queueing theory. The model captures the behavior of a cloud-based firewall service comprising a load balancer and a variable number of virtual firewalls. From the analytical model, we then derive closed-form formulas to determine the minimal number of virtual firewalls required to meet the response time specified in the service level agreement. The model takes as input key system parameters including workload, processing capacity of load balancer and virtual machines, as well as the depth of the targeted firewall rules. We validate our model using discrete-event simulation, and real-world experiments conducted on Amazon Web Services cloud. We also provide numerical examples to show how our model can be used in practice by cloud performance/security engineers to achieve proper elasticity under fluctuating traffic load and variable depth of targeted firewall rules.

Intelligent generation of fuzzy rules for network firewalls based on the analysis of large-scale network traffic dumps

Intelligent generation of fuzzy rules for network firewalls based on the analysis of large-scale network traffic dumps

Brute-force Attacks Analysis against SSH in HPC Multi-user Service Environment

Background/Objectives: The brute-force attack is one of popular cyber security threats in the secure shell (SSH) service environment. The SANS Institute has warned about SSH brute-force attacks against remote services. Methods/Statistical Analysis: We describe two brute-force attack detection methods are applied in the High Performance Computing (HPC) service environment which has been operated by KISTI in KOREA. The first way parses failed authentication logs of systems. The second way analyze dropped events of network firewalls. Findings: We analyze SSH brute-force attacks that are detected applying these methods in our service environment. The analysis results show that SSH brute-force attacks are classified ‘1:N’ or ‘N:1’ types of attack between source and destination IP address. And a duration of attacks that is generally the time it takes to execute attacks keeps enough long times. Improvements/Applications: Two detection methods which are deployed in our HPC multi-user service environment are complementary to each other. These methods will be also able to apply for other service environment.

Signaling in IP-Based Networks: Retrospect and Prospect

Protocols have been developed to provide various signaling services in IP-based networks - for example, for quality-of-service (QoS) reservations, or configuring middleboxes such as Network Address Translators (NATs) and firewalls. This article presents a retrospective view on the development of the IETF Next Steps in Signaling protocols, with a more flexible signaling framework than the traditional Resource ReSerVation Protocol (RSVP). The challenges are discussed for signaling in emerging network architectures like software-defined networking, network function virtualization, and service function chaining, as well as ongoing standardization efforts.

Classification of HTTP Automated Software Communication Behavior Using a NoSQL Database

Application layer attacks have for years posed an ever-serious threat to network security, since they always come after a technically legitimate connection has been established. In recent years, cyber criminals have turned to fully exploiting the web as a medium of communication to launch a variety of forbidden or illicit activities by spreading malicious automated software (autoware) such as adware, spyware, or bots. When this malicious auto-ware infects a network, it will act like a robot, mimic normal behavior of web access, and bypass the network firewall or intrusion detection system. Besides that, in a private and large network, with huge Hypertext Transfer Protocol (HTTP) traffic generated each day, communication behavior identification and classification of auto-ware is a challenge. In this paper, based on a previous study, analysis of autoware communication behavior, and with the addition of new features, a method for classification of HTTP auto-ware communication is proposed. For that, a Not Only Structured Query Language (NoSQL) database is applied to handle large volumes of unstructured HTTP requests captured every day. The method is tested with real HTTP traffic data collected through a proxy server of a private network, providing good results in the classification and detection of suspicious auto-ware web access.

A Highly Compressible Regular Expression Matching Circuit for Network Intrusion Detection Systems: An ECD-NFA approach

Network attacks that flow through network firewalls or network intrusion detection systems (NIDS) are often identifiable by the patterns of data that they contain. The patterns are normally represented by complex regular expressions which are matched at a very high speed. The regular expressions are built into their equivalent automata, using minimal hardware resources in order to detect variations of these patterns. This paper explains the design, structure, and suitability of a hardware-based automata implementation. The approach is based on an input compression technique that uses Equivalence Classification (EC) technique. The technique is used to drive a novel Nondeterministic Finite Automata (NFA) referred to as Equivalence Class Descriptor NFA (ECD-NFA). The ECD-NFA approach creates classes of compressed inputs represented by positive integer values simply referred to as ECDs. The ECDs are class descriptors, which are used as inputs to drive the automata, instead of unclassified raw character-input strings. The ECD-NFA design is built to take advantage of the parallelism provided by Field Programmable Gate Array (FPGA) technology. The design further exploited the FPGA to provide high throughput and support for quick updates. The ECD-NFA design clocks at 460.00 MHz, with a throughput value of 3.68 Gigabits (Gbps). The design incurs very minimal logic circuit cost, and the preliminary results look promising.

Modelling and analysis of rule‐based network security middleboxes

This study presents an analytical model for rule-based network security middleboxes as those of network firewalls, intrusion detection systems and email spam filters. In these systems, incoming packets carrying requests arrive at the middlebox and obtain queued for processing in multiple stages. The stages consist of first a main stage for packet processing and then subsequent stages of rulebase interrogation in which rules or conditions are checked sequentially until a match is triggered. The service at these stages is characterised to be mutually exclusive; that is, only one stage is active at any time. The authors derive useful formulas that can predict the middlebox performance, taking into account its incoming request rate, the queue size and the processing capacity of the middlebox, and thereby proper engineering capacity of the middlebox can be achieved.

Performance Evaluation and Analysis of Network Firewalls in High Speed Networks

High speed and high capacity networks are critical for large scale (big) data services. In addition, security issues are even more important. KISTI (Korea Institute of Science and Technology Information) operates a variety of security facilities to provide secure supercomputing services to public users. A throughput of network firewalls affects entire trust networks. Because network firewalls act as the first line of defense against unwanted and malicious traffic flow between each networks. In this paper, we evaluate and compare the performance of two network firewalls are operated by KISTI in high speed networks and analyze results.

Experimental assessment of network design approaches for protecting industrial control systems

This paper surveys and provides experimental results related to network design techniques focused on enhancing the security of industrial control systems. It analyzes defense-in-depth strategies, network segmentation, network firewall configurations and the role of intrusion prevention systems, intrusion detection systems and anomaly detection systems. The paper also studies the applicability of emerging technologies in the area of IP networks, including software-defined networking, network functions virtualization and next generation firewalls in securing industrial control systems. The main contribution of this paper is the experimental assessment of existing and future network design approaches in the presence of real malware (e.g., Stuxnet) and synthetic attacks (e.g., denial-of-service attacks). The experimental results confirm the importance of defense-in-depth strategies and also highlight the embryonic state of software-defined networking security, which requires profound transformation and validation in order to be embraced by the industrial control system community.

Multi-pipelined and memory-efficient packet classification engines on FPGAs

A packet classification task incorporated in network firewalls to recognize and sift threats or unauthorized network accesses is accomplished by checking incoming packet headers against a pre-defined filter set. Plenty of solutions to reduce the memory requirement of filter set storage and accommodate packet classification to line rates have been proposed over the past decade. Among all the existing approaches, hierarchical data structures maintain great memory performance however their hardware realization suffers from two issues: (i) backtracking and (ii) memory inefficiency. In this paper, we propose two data structures denoted range tree-linked list hierarchical search structure (RLHS) and value-coded trie structure with ϵ-branch property (VCϵ) for packet classification. RLHS resolves backtracking by exploiting range tree in Stage 1 and linked list data structure in Stage 2 overcomes the memory inefficiency. VCϵ trie that naturally does not involve backtracking problem, solves memory inefficiency issue by comprising a fixed size bin at each node. Apart from conventional binary trie, a new rule is inserted into the first available bin on the path of this rule in a VCϵ trie, and ϵ-branch property is utilized in case all the bins are full. We also propose a rule categorization algorithm that partitions an input ruleset by considering the field features of rules to minimize the memory requirement. To support the proposed data structures, we designed high throughput SRAM-based parallel and pipelined architectures on Field Programmable Gate Arrays (FPGAs).

Statistical dynamic splay tree filters towards multilevel firewall packet filtering enhancement

Network Firewalls are considered to be one of the most important security components in today's IP network architectures. Performance of firewalls has significant impact on the overall network performance. Firewalls should be able to sustain a very high throughput and ensure network services availability. In this paper, we propose an analytical dynamic multilevel early packet filtering mechanism to enhance firewall performance. The proposed mechanism uses statistical splay tree filters that utilize traffic characteristics to minimize packet filtering time. The statistical splay tree filters are reordered according to the network traffic divergence upon certain threshold qualification (Chi–Square Test). That is, the proposed mechanism is able to decide whether or not there is a need to update the dynamic splay tree filters' order for filtering the next network traffic window and predict the best order pattern. Furthermore, the importance of optimizing packet rejection and acceptance is done through the multilevel packet filtering process; where in each level, unwanted packets are rejected as early as possible. The proposed mechanism can also be considered as a device protection mechanism against denial of service (DoS) attacks targeting the default filtering rule. Early packet acceptance is done using the splay tree data structure which adapts dynamically according to network traffic flows. Consequently, repeated packets will have less memory accesses and therefore reduce the overall packets filtering time as demonstrated in the evaluation section.

A Comparative Study of Software Firewall on Windows and Linux Platform

Nowadays, the communication through World Wide Web (WWW) is growing rapidly. All the gadgets, computer and handheld devices are connected via wire or wireless media and communicated to each others. Thus, network security is the essential requirement of an organization or individuals. Organizations are protecting their communication from unauthorized access by introducing network firewalls. A Firewall is an application program which runs on any platform such as windows, Linux, Solaris, Macintosh etc and protected the networks or systems via implementing policies and rules. In this paper, the performance of firewall is measured and compared on Windows and Linux platform individual. To evaluate the performance, a private network has been setup in which three machines are connected via a switch; one Windows machine running windows firewall, one Linux machine running Linux firewall (IPTable) and one more machine that acting as a client. On both the platforms, the performance is measured in two situations: first when network is traffic free and second network with traffic. When network is traffic free then both the platforms reflect the common normal processing behavior in context of time and packet received per second; and when packets are pumped at a very high speed in the network then the processing time and packet received per second increases exponentially in both the platforms.

Technology in Counselor Education: HIPAA and HITECH as Best Practice

The use of technology in counseling is expanding. Ethical use of technology in counseling practice is now a stand-alone section in the 2014 American Counseling Association Code of Ethics. The Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act provide a framework for best practices that counselor educators can utilize when incorporating the use of technology into counselor education programs. This article discusses recommended guidelines, standards, and regulations of HIPAA and HITECH that can provide a framework through which counselor educators can work to design policies and procedures to guide the ethical use of technology in programs that prepare and train future counselors.Keywords: counselor education, technology, best practice, HIPAA, HITECHThe enactment of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) brought forth a variety of standards addressing the privacy, security and transaction of individual protected health (PHI; Wheeler & Bertram, 2012). According to the language of HIPAA (2013, §160.103), PHI is defined as individually identifiable health information (p. 983) that is transmitted by or maintained in electronic media or any other medium, with the exception of educational or employment records. identifiable health information is specified as follows:Information, including demographic data, that relates to:* the individual's past, present or future physical or mental health or condition,* the provision of health care to the individual, or* the past, present, or future payment for the provision of health care to the individual, and that identifies the individual for which there is a reasonable basis to believe can be used to identify the individual. Individually identifiable health includes many common identifiers. (U.S. Department of Health and Human Services [HHS], n.d.-b, p. 4)The HIPAA standards identify 18 different elements that are considered to be part of one's PHI. These include basic demographic data such as names, street addresses, elements of dates (e.g., birth dates, admission dates, discharge dates) and phone numbers. It also includes such as vehicle identifiers, Internet protocol address numbers, biometric identifiers and photographic images (HIPAA, 2013, § 164.514, b.2.i).According to language in HIPAA, the applicability of its standards, requirements and implementation only apply to entities, which are (1) a health plan (2) a health care clearinghouse (3) a health care provider who transmits any health in electronic form in connection with [HIPAA standards and policies] (HIPAA, 2013, § 160.102). Covered entities have an array of required and suggested privacy and security measures that they must take into consideration in order to protect individuals' PHI; failure to protect individuals' could result in serious fines. For example, one recent ruling found a university medical training clinic to be in violation of HIPAA statutes when network firewall protection had been disabled. The oversight resulted in a $400,000 penalty (Yu, 2013). Moreover, the recent implementation of the Health Information Technology for Economic and Clinical Health (HITECH) Act in 2009 increased the fines resulting from failure to comply with HIPAA, including fines for individuals claiming they did not know that can range from $100-$50,000 (Modifications to the HIPAA Privacy, 2013, p. 5583). The final omnibus ruling of HIPAA-HITECH, enforcing these violations, went into effect on March 26, 2013 (Modifications to the HIPAA Privacy, 2013; Ostrowski, 2014). Enforcement of the changes from the HITECH Act on HIPAA standards began on September 23, 2013, for covered entities (Modifications to the HIPAA Privacy, 2013).Academic departments and universities must understand the importance of HIPAA and HITECH regulations in order to determine whether the department or university is considered a covered entity. …

Using Node-HTTP-Proxy for Remote Experiment Data Transmission Traversing Firewall

In this paper, a novel real time experimental data transmission solution based on a new web server software architecture that allows the traversing of network firewalls is proposed. With this new software architecture, the public network port 80 can be shared between Node.js and the Apache web server software system. With this new solution, the Apache web server application still listens to the public network port 80, but any client requests for the Node.js web server application through the port will be forwarded to a special network port which Node.js web server application is listening to. Accordingly, a new solution in which both Apache and Node.js web server applications work together via HTTP proxy developed by the Node-HTTP-Proxy software package is implemented on the server-side. With this new real time experiment control and data transmission solution, the end user can control remote experiments and view experimental data on the web browser without firewall issues and without the need of third party plug-ins. It also provides a new approach for the remote experiment control and real time data transmission based on pure HTTP protocol. The solution will significantly benefit the development of remote laboratory technology.

Analysis of Application-Layer Filtering Policies With Application to HTTP

Application firewalls are increasingly used to inspect upper-layer protocols (as HTTP) that are the target or vehicle of several attacks and are not properly addressed by network firewalls. Like other security controls, application firewalls need to be carefully configured, as errors have a significant impact on service security and availability. However, currently no technique is available to analyze their configuration for correctness and consistency. This paper extends a previous model for analysis of packet filters to the policy anomaly analysis in application firewalls. Both rule-pair and multirule anomalies are detected, hence reducing the likelihood of conflicting and suboptimal configurations. The expressiveness of this model has been successfully tested against the features of Squid, a popular Web caching proxy offering various access control capabilities. The tool implementing this model has been tested on various scenarios and exhibits good performance.

A Novel Real-time Video Transmission Approach for Remote Laboratory Development

Remote laboratories are an inevitable necessity for Internet enabled education in Science, Technology, Engineering, and Math (STEM) fields due to their effectiveness, flexibility, cost savings, and the fact that they provide many benefits to students, instructors and researchers. Accordingly, real-time experiment live video streaming is an essential part of remote experimentation operation. Nevertheless, in the development of real-time experiment video transmission, it is a key and difficult issue that the video is transferred across the network firewall in most of the current remote laboratory solutions. To address the network firewall issue, we developed a complete novel solution via HTTP Live Streaming (HLS) protocol and FFMPEG that is a powerful cross-platform command line video trans-code/encoding software package on the server side. In this paper, a novel, real-time video streaming transmission approach based on HLS for the remote laboratory development is presented. With this new solution, the terminal users can view the real-time experiment live video streaming on any portable device without any firewall issues or the need for a third party plug-in., This new solution also significantly benefits remote laboratory development in the future.

IPv6 기반의 네트워크 접근제어 시스템 설계 및 구현

인터넷 사용자 및 스마트 디바이스의 증가로 네트워크 보안의 중요성이 점차적으로 커지고 있다. 네트워크 보안의 세부기술들은 방화벽, IPS, DDoS차단시스템, UTM, VPN, 네트워크 접근제어시스템, 무선네트워크보안, 모바일보안, 망분리 등으로 구성된다. 현재 하드웨어 인프라는 이미 IPv6를 위한 기능을 지원하고 있지만 IPv6 기반 서비스의 제공은 미진하여 대부분의 보안제품들은 IPv4에서 동작하고 있다. 그러므로 본 논문에서는 IPv6를 지원하는 보안 기술인 네트워크 접근제어기능을 설계하고 이를 위해 필수적으로 요구되는 IPv6 단말의 탐색, 차단/격리 그리고 128bit IPv6 주소의 효율적인 관리를 위한 도메인자동 할당 기능을 설계 및 구현하였다. 이를 위해 KISA에서 실제 구축한 IPv6 환경에서 보편적 단말들에 적용이 가능하도록 구현하였다. 결과적으로 보편적으로 사용하고 있는 IPv6 장비들에 대해서 유 무선 호스트 검출, 차단, 격리 및 도메인 할당이 정상적으로 동작하는 것을 확인할 수 있었다. The increase in the Internet and smart device users requires high-level network security. Network security consists of Web Firewall, Network Firewall, IPS, DDoS system, UTM (Unified Treat Management), VPN, NAC (Network Access Control), Wireless security, Mobile security, and Virtualization. Most network security solutions running on IPv4, and IPv6 network services are not sufficiently ready. Therefore, in this paper, this study designed and implemented important functions of Network Access Control (NAC), which include IPv6 host detection, isolation, blocking and domain assignment for the IPv6 network. In particular, domain assignment function makes 128 bits IPv6 address management easy. This system was implemented on a KISA IPv6 test-bed using well known devices. Finally, the test result showed that all IPv6 based wired and wireless devices were well-controlled (detection, blocking, isolation and domain assignment).

Structural Analysis and Preparation of the Netfilter

As an open-source Linux system, firewall security and defense capability is very strong. In the whole process of network firewalls,and multiple monitoring points are based on netfilter. This paper analyzes the structure of the netfilter and ipt_entry store,look in everyday applications, Linux modular system can be better integrated,so that the speed and stability of the system is improved more.

A Kind of Embedded Firewall Mechanism for ARM Processors

The traditional firewall is a protect mechanism usually between the internal and external network, through the input and output of data packets in real-time network monitoring, it will make protective response immediately if it find security threats. With short data processing time and high efficiency, it can satisfy most procedures of application, but it has high cost and is difficult to achieve. In this paper, in view of these problems, embedded firewall security protection mechanisms set based AMR processor innovation, given the overall framework of embedded firewall hardware and the design for software architecture ,I selected good performance S3C2410X embedded chip, the embedded firewall network card drivers, key technologies of application research in detail, based on the embedded firewall performance of AMR processor through the contrast test ,the communication rate can reach 15.5Mpbs, 2.15times higher than that of general processor communication performance.