Network Security Policy Research Articles

Application of evolutionary algorithm in performance optimization of embedded network firewall

With the development of the network, the problem of network security is becoming increasingly serious. The importance of a firewall as the "first portal" to network security is obvious. In order to cope with a complex network environment, the firewall must formulate a large number of targeted rules to help it implement network security policies. Based on the characteristics of the cloud environment, this paper makes in-depth research on network security protection technology, and studies the network firewall system. The system implements unified configuration of firewall policy rules on the cloud management end and delivers them to the physical server where the virtual machine is located. Aiming at the characteristics of virtual machines sharing network resources through kernel bridges, a network threat model for virtual machines in a cloud environment is proposed. Through analysis of network security threats, a packet filtering firewall scheme based on kernel bridges is determined. Various conflict relationships between rules are defined, and a conflict detection algorithm is designed. Based on this, a rule order adjustment algorithm that does not destroy the original semantics of the rule table is proposed. Starting from the matching probability of the rules, simple rules are separated from the default rules according to the firewall logs, the relationships between these rules and the original rules are analyzed, and the rules are merged into new rules to evaluate the impact of these rules on the performance of the firewall. New rules are added to the firewall rule base to achieve linear firewall optimization. It can be seen from the experimental results that the optimization strategy proposed in this paper can effectively reduce the average number of matching rules and improve the performance of the firewall.

On the fine-grained fingerprinting threat to software-defined networks

Software-defined networking (SDN) is an emerging networking technology, which has attracted wide attention from academia and industry, playing a key role in enabling techniques of the 5th generation wireless systems (5G). The fundamental characteristic of SDN is that it decouples the control plane from the data plane, which can provide flexibility and programmability for 5G. Unfortunately, the separation of the two planes becomes a potential attack surface as well, which enables adversaries to fingerprint and attack the SDNs. Existing work showed the possibility of fingerprinting an SDN with time-based features. However, they are coarse-grained. This paper proposes a fine-grained fingerprinting approach that reveals the much more severe threats to SDN security and explores the mitigation strategies. By analyzing network packets, the approach can dig out sensitive and control-related information, i.e., match fields of SDN flow rules. The match fields of flow rules can be used to infer the type of an SDN controller and the security policy of an SDN network. With sensitive configuration information, adversaries can launch more targeted and destructive attacks against an SDN. We implement our approach in both simulated and physical environments with different kinds of SDN controllers to verify the effectiveness of our concept. Experimental results demonstrate the feasibility to obtain fine-grained and highly sensitive information in SDN, and hence reveal the high risk of information disclosure in SDN and severe threats of attacks against SDN. To mitigate the fine-grained fingerprinting threat we have revealed, we explore a lightweight countermeasure trying to hide the sensitive time-based features of SDN networks. Implementation and evaluation demonstrate that our countermeasure can play a role in mitigating the risk of SDN control information leakage with only minor overheads.

Efficient Non-Dominated Multi-Objective Genetic Algorithm (NDMGA) and network security policy enforcement for Policy Space Analysis (PSA)

Computer network security is the first line of protection for guaranteeing information reliability. A computer network can be threatened when it does not have a well-designed or properly implemented network security policy. The major issue is that network operators cannot always support their network security strategy. Network operators often depend on security facilities to defend their Information Technology (IT) organizations. Different forms of security policies concerned with the network are distinct and circulated among various security middleboxes (MBs) organized into networks. Conversely, due to the inherent sophistication of security policies, it is not appropriate to use recent path-wise implementation algorithms. The present study solves the problem of policy implementation with MBs relatively faster compared to existing methods. In particular, this research models security policy implementation as a Weighted K Set Covering Problem (WKSCP) and employs a computational-geometry-based Policy Space Analysis (PSA) tool for a set of procedures as the security mechanism. Using the PSA tool leads to a Non-Dominated Multi-Objective Genetic Algorithm (NDMGA), which reveals the inherent complexities involved in a security policy and informs implementation of the policy enforcement algorithm. The resolution to this issue is to determine a collection of enforcement network nodes for an MB to execute on-datapath examination with globally distinct security policies. Therefore, the chosen policy enforcement nodes should be initially positioned on paths that are related to security strategies. Compared to the scope-wise strategy enforcement mechanism, where the procedures are executed over the objects of the network path, the scheme in this present work is implemented over the objects pertaining to the network nodes. A secure node may contain multiple paths, thus storing a large possible flow space that preserves the distribution and circumvents the ineffective usage of network bandwidth due to random traffic steering. Compared to current methodologies, the suggested NDMGA-based PSA tool yielded a 95% decrease in policy implemented nodes and a 93% decline in implemented rules.

An information network security policy learning algorithm based on Sarsa with optimistic initial values

With the widespread applications of artificial intelligence and automation, more and more devices are monitored by computer systems. In many cases, multiple management control information systems compose a comprehensive information system network. As the scale of the network is getting larger and larger and the topology of the network is getting more and more sophisticated, it is impossible for a fixed mode network system control policy, which was designed for small and simple network that often lacked ability to deal with dynamic environment, to handle security policy task. Hereby a network security policy online learning algorithm based on Sarsa with the optimistic initial values is proposed. The algorithm consists of two parts, one acting as the defence agent and the other acting as the attacking agent. The defence agent learns and improves the system protection policy by fighting against simulating attacking from attacking agent. Defence agent takes advantage of Sarsa method to improve its defence policy, which utilises historical experience to improve the defence policy in an online mode. The use of optimistic initial values speeds up the training time.

An information network security policy learning algorithm based on Sarsa with optimistic initial values

With the widespread applications of artificial intelligence and automation, more and more devices are monitored by computer systems. In many cases, multiple management control information systems compose a comprehensive information system network. As the scale of the network is getting larger and larger and the topology of the network is getting more and more sophisticated, it is impossible for a fixed mode network system control policy, which was designed for small and simple network that often lacked ability to deal with dynamic environment, to handle security policy task. Hereby a network security policy online learning algorithm based on Sarsa with the optimistic initial values is proposed. The algorithm consists of two parts, one acting as the defence agent and the other acting as the attacking agent. The defence agent learns and improves the system protection policy by fighting against simulating attacking from attacking agent. Defence agent takes advantage of Sarsa method to improve its defence policy, which utilises historical experience to improve the defence policy in an online mode. The use of optimistic initial values speeds up the training time.

Network Security Risk Assessment Based on Node Correlation

A network security risk assessment method based on node correlation is proposed in order to solve the problem that little consideration is given to node correlation and diversity in tradition network security risk assessments. This method which is based on Hidden Markov model quantifies security risk of the node through indirect risks caused by the direct risks and correlations of nodes. Combined the security risk and the importance of the node, the overall risk of the target network is calculated. This method can evaluate network security risk more accurately and provide basis for the formulation of network security policy.

Hybrid firefly bat algorithm (HFBA)–based network security policy enforcement for PSA

SummaryNetwork operators heavily depend on security services to secure their information technology infrastructures. On the other hand, due to the complexity of security policies, it is not appropriate to straightforwardly use previous pathwise enforcement approaches. In this paper, the enforcement problem of the security policy on middleboxes is formulated as a weighted K set covering problem that requires a policy space analysis tool. This tool is intended to be supported on range‐represented hyperrectangles, which are tagged using a prioritized R‐tree. This methodological work initially evaluates the topological features of diverse types of policies. Hybrid firefly bat algorithm–supported heuristic information shows the inherent difficulties of security policies and provides direction for the design of the enforcement algorithm. At the same time, a scopewise policy enforcement procedure is proposed, which requires a moderate number of enforcement network nodes for organizing the various policy subsets in a greedy manner. Our results demonstrate that the proposed hybrid firefly bat algorithm with policy space analysis offer greatly improved outcomes in terms of the rule overhead, network security, packet delivery ratio, packet loss ratio, and time efficiency above the set operations of the security policy.

Building a Trust Model for Social Network

The revolution in information technology and the use of the internet changed the lifestyle of people. A major change was in the way of shopping. Companies started to offer their products online using social network s and people started to buy from the internet. Using social network has many benefits to the users starting from exploring a large variety of products to the very first way of ordering and the availability of the products 24 hours a day. One of the main problems that is found in using a social network is trusting the using social network social network s. the student concern about trusting to buy from the using social network social network s. Trust is a major concern for the merchant too; his concern is how to gain the student trust and to keep it. Many factors play a major role in acquiring the student trust in the online market. These factors rely on the social network characteristics such as design, interactivity and age and other factors vary from the social network quality, service quality, security policy of the social network, the privacy policy, the guarantee offered, the satisfaction of the user, the ease of use, the risk aversion and the culture factors. This study introduces the trusting affecting factors mentioned above and their effect on the trustworthiness factors (ability, benevolence, and integrity) a trust model has been built to show the relation between these factors and the trustworthiness factors.

Contribution au dialogue entre la psychanalyse, la psychiatrie et les neurosciences dans la recherche clinique actuelle individuelle et sociale, par l’étude des phénomènes d’automatisme

Computer network security is the first line of protection for guaranteeing information reliability. A computer network can be threatened when it does not have a well-designed or properly implemented network security policy. The major issue is that network operators cannot always support their network security strategy. Network operators often depend on security facilities to defend their Information Technology (IT) organizations. Different forms of security policies concerned with the network are distinct and circulated among various security middleboxes (MBs) organized into networks. Conversely, due to the inherent sophistication of security policies, it is not appropriate to use recent path-wise implementation algorithms. The present study solves the problem of policy implementation with MBs relatively faster compared to existing methods. In particular, this research models security policy implementation as a Weighted K Set Covering Problem (WKSCP) and employs a computational-geometry-based Policy Space Analysis (PSA) tool for a set of procedures as the security mechanism. Using the PSA tool leads to a Non-Dominated Multi-Objective Genetic Algorithm (NDMGA), which reveals the inherent complexities involved in a security policy and informs implementation of the policy enforcement algorithm. The resolution to this issue is to determine a collection of enforcement network nodes for an MB to execute on-datapath examination with globally distinct security policies. Therefore, the chosen policy enforcement nodes should be initially positioned on paths that are related to security strategies. Compared to the scope-wise strategy enforcement mechanism, where the procedures are executed over the objects of the network path, the scheme in this present work is implemented over the objects pertaining to the network nodes. A secure node may contain multiple paths, thus storing a large possible flow space that preserves the distribution and circumvents the ineffective usage of network bandwidth due to random traffic steering. Compared to current methodologies, the suggested NDMGA-based PSA tool yielded a 95% decrease in policy implemented nodes and a 93% decline in implemented rules.

Non‐dominated sorting particle swarm optimization (NSPSO) and network security policy enforcement for Policy Space Analysis

SummaryNetwork operators depend on security services with the aim of safeguarding their IT infrastructure. Various types of network security policies are employed on a global scale and are disseminated among several security middleboxes implemented in networks. But, owing to the complications in security policies, it is not quite efficient to directly use the path‐wise enforcement schemes that are prevalent. The major motivation of this work is to improve security levels and solve the policy enforcement problem. For the first time, this work reports the issue of policy enforcement on middleboxes. The major contribution of this work is to design security policy enforcement as a Weighted K Set Covering Problem, and we designed a Policy Space Analysis (PSA) tool intended for a group of operations in the security policy. This PSA tool was developed based on range‐signified hyper‐rectangles, which are indexed by the Hilbert R‐tree. Leveraging the PSA, we first investigated the topological features of various kinds of policies. Balancing the PSA tool in a non‐dominated sorting particle swarm optimization technique exposes the intrinsic difficulties of this security strategy and provides guidance for designing the enforcement approach. In addition, in this research, a new fuzzy rule‐based classification system is introduced for packet classification. A scope‐wise policy enforcement algorithm was proposed, which chooses a moderate number of enforcement network nodes for deploying multiple policy subsets in a greedy manner. This scheme is much quicker compared with the first one and therefore has found its application in real‐time deployments.

Methods and technologies for computer networks protection (network, transport and application layers)

Standard solutions that are supported by manufacturers of equipment for computer networks (switches the 2nd and 3rd levels, routers), implemented in the operating systems and protocols, and can be used for the development and implementation of integrated corporate network protection systems are considered in this article. The article is the second of a series of articles devoted to the analysis of methods and technologies of protection. The typical threats to computer network at the network (substitution the IP addresses of the nodes, imposing the wrong route, intercepting the IP address range and receiving information about the logical structure of the network, DDoS attacks on external channels), transport (Interception of information and connection to open ports of transport layer protocols) and application (Information interception, viruses and spyware) layers of OSI model are given and the features of methods and technologies to protect at are analyzed. Technology of Network Address Translation and Access Control Lists are analyzed to prevent threats to the network level. Features of using the “Blackhole” BGP function for protection against DDoS attacks on external channels are considered. The features of the protocol Secure Socket Layer / Transport Layer Security to protect against threats to the transport layer are analyzed. Approaches of “Statefull” Inspection and content filtering that allow implementing control of connection, data control between specific applications and performing filtering unwanted information are considered at the application level. Also, features of network security providing in heterogeneous virtual computing environments such as GRID-systems and cloud computing are noted. The approaches to protection which ware considered in work allow to effectively counter acting, first of all, external violation of information security. In the previous article of the cycle the methods and technologies of the physical and channel levels that were aimed at protecting against internal attacks on computer networks were considered. Analysis of methods and protection technologies at various levels of the OSI model which was conducted in work allows making informed decisions about choosing methods to protect networks for different purposes and with different requirements regarding data protection. Configuring the proper functionality on the network equipment allows carrying out the monitoring of compliance with network security policies and implement protection as close to possible sources of violations. Ref. 16, tabl. 1.

User-oriented Network Security Policy Specification

User-oriented Network Security Policy Specification

Analysis Of Using Firewall And Single Honeypot In Training Attack On Wireless Network

Security issues become one of the important aspects of a network, especially a network security on the server. These problems underlie the need to build a system that can detect threats from parties who do not have access rights (hackers) that are by building a security system honeypot. A Honeypot is a diversion of intruders' attention, in order for intruders to think that it has managed to break down and retrieve data from a network, when in fact the data is not important and the location is isolated. A way to trap or deny unauthorized use of effort in an information system. One type of honeypot is honeyd. Honeyd is a low interaction honeypot that has a smaller risk compared to high interaction types because the interaction with the honeypot does not directly involve the real system. The purpose of the implementation of honeypot and firewall, firewall is used on Mikrotik. Can be used as an administrative tool to view reports of Honeyd generated activity and administrators can also view reports that are stored in the logs in order to assist in determining network security policies.

The Relationship between Network Security Policies and Audit Evidence Documentation: The Accounting Information Security Culture as a Mediator

The purpose of this study is to explore the relationship between network security policies (the department policy, system director policy, user policy, information security officer policy) on the one hand, and audit evidence documenting on the other hand. As the security, culture of accounting information has been introduced as a variable mediating that relationship. The researcher sent (450) questionnaires to all the companies listed on the Amman Stock Exchange in Jordan equivalent to (228) company until 2015. The study found that there is a significant relationship between networks (the department policy, system director policy, user policy, information security officer policy) and documentation of the audit evidence. While the respondents said that, there is not a significant relationship between information security officer and policy and documentation of the audit evidence. Besides, the value of the correlation coefficient between network security policies and documentation of audit evidence had increased from (0.56) to (0.62), after entering the variable of security culture of accounting information systems to demonstrate its impact as a variable rate of the regression model and this result demonstrates the importance of awareness of security culture of the companies. These results will be very useful for those are interested, especially auditors to help them to appreciate the importance of documenting the audit evidence of network security and their implementation on the ground.

Security Issues of Firewall

The need of Network Security is accelerating at the same pace as that of increased Internet usage. Network Security prevents from illegitimate admittance, hacking andauthentic data transportation. Network Security consist of provisions and policies adopted by a network administrator to preclude and monitor unauthorized access, alterations, perversion, declination of a computer network and network-accessible resources. Network Security is achieved by Firewall. Firewall is a hardware or software device which is designed to permit or refuse network transmissions based upon certain protocols. Firewall is a locus at the endpoints of the system which strains out all illegitimate traffic and users. But conventional or traditional firewalls rely stricly on the restricted topology and restrained entry points to function; which results in difficulty in filtering certain protocols, end-to-end encryption problem etc. Hence, it resulted in the evolution of Distributed Firewall which strengthens the network security policies without delimitating its topology from inside or outside. Distributed Firewall is a host-resident security software application that protects the enterprise network’s servers and end-user machines against unwanted intrusion. This paper is a literature review paper focusing on traditional firewalls, it evolution, security issues various policies and the concept of distributed firewall.

Statistical models for the number of successful cyber intrusions

We propose several generalized linear models (GLMs) to predict the number of successful cyber intrusions (or “intrusions”) into an organization’s computer network, where the rate at which intrusions occur is a function of the following observable characteristics of the organization: (i) domain name system (DNS) traffic classified by their top-level domains (TLDs); (ii) the number of network security policy violations; and (iii) a set of predictors that we collectively call the “cyber footprint” that is comprised of the number of hosts on the organization’s network, the organization’s similarity to educational institution behavior, and its number of records on scholar.google.com . In addition, we evaluate the number of intrusions to determine whether these events follow a Poisson or negative binomial (NB) probability distribution. We reveal that the NB GLM provides the best fit model for the observed count data, number of intrusions per organization, because the NB model allows the variance of the count data to exceed the mean. We also show that there are restricted and simpler NB regression models that omit selected predictors and improve the goodness-of-fit of the NB GLM for the observed data. With our model simulations, we identify certain TLDs in the DNS traffic as having a significant impact on the number of intrusions. In addition, we use the models and regression results to conclude that the number of network security policy violations is consistently predictive of the number of intrusions.

Radio Frequency Traffic Classification Over WLAN

Network traffic classification is the process of analyzing traffic flows and associating them to different categories of network applications. Network traffic classification represents an essential task in the whole chain of network security. Some of the most important and widely spread applications of traffic classification are the ability to classify encrypted traffic, the identification of malicious traffic flows, and the enforcement of security policies on the use of different applications. Passively monitoring a network utilizing low-cost and low-complexity wireless local area network (WLAN) devices is desirable. Mobile devices can be used or existing office desktops can be temporarily utilized when their computational load is low. This reduces the burden on existing network hardware. The aim of this paper is to investigate traffic classification techniques for wireless communications. To aid with intrusion detection, the key goal is to passively monitor and classify different traffic types over WLAN to ensure that network security policies are adhered to. The classification of encrypted WLAN data poses some unique challenges not normally encountered in wired traffic. WLAN traffic is analyzed for features that are then used as an input to six different machine learning (ML) algorithms for traffic classification. One of these algorithms (a Gaussian mixture model incorporating a universal background model) has not been applied to wired or wireless network classification before. The authors also propose a ML algorithm that makes use of the well-known vector quantization algorithm in conjunction with a decision tree—referred to as a TRee Adaptive Parallel Vector Quantiser. This algorithm has a number of advantages over the other ML algorithms tested and is suited to wireless traffic classification. An average F-score (harmonic mean of precision and recall) > 0.84 was achieved when training and testing on the same day across six distinct traffic types.

A formal basis for the design and analysis of firewall security policies

A firewall is the core of a well defined network security policy. This paper presents an automata-based method to study firewall security policies. We first propose a procedure that synthesizes an automaton that describes a security policy given as a table of rules. The synthesis procedure is then used to develop procedures to detect: incompleteness, anomalies and discrepancies in security policies. A method is developed to represent the automaton by a policy qualified as mixable and that has practical utilities, such as ease to determine the whitelist and the blacklist of the policy. The developed procedures have been deeply evaluated in terms of time and space complexities. Then, a real case study has been investigated. The obtained results confirm that the developed procedures have reasonable complexities and that their actual execution times are of the order of seconds. Finally, proofs of all results are provided.

Efficient Network Security Policy Enforcement With Policy Space Analysis

Network operators rely on security services to protect their IT infrastructures. Different kinds of network security policies are defined globally and distributed among multiple security middleboxes deployed in networks. However, due to the complexity of security policy, it is inefficient to directly employ existing path-wise enforcement approaches. This paper models the enforcement of network security policy as the set-covering problem, and designs a computational-geometry-based policy space analysis (PSA) tool for set operations of security policy. Leveraging the PSA, this paper first investigates the topological characteristics of different types of policies. This heuristic information reveals intrinsic complexities of security policy and guides the design of our enforcement approach. Then the paper proposes a scope-wise policy enforcement algorithm that selects a modest number of enforcement network nodes to deploy multiple policy subsets in a greedy manner. This approach can be employed on network topologies of both datacenter and service provider. The efficiencies of the PSA tool and the enforcement algorithm are also evaluated. Compared with the header space analysis, the PSA achieves much better memory and time efficiencies on set operations of security policy. Additionally, the proposed enforcement algorithm is able to guarantee network security within a reasonable number of enforcement network nodes, without introducing many extra rules.

The Network Security Policies of Telecommunication Industries in Sudan

The Network Security Policies of Telecommunication Industries in Sudan