Network Security Policy Research Articles

A Knowledge Graph-Based Consistency Detection Method for Network Security Policies

Network security policy is regarded as a guideline for the use and management of the network environment, which usually formulates various requirements in the form of natural language. It can help network managers conduct standardized network attack detection and situation awareness analysis in the overall time and space environment of network security. However, in most cases, due to configuration updates or policy conflicts, there are often differences between the real network environment and network security policies. In this case, the consistency detection of network security policies is necessary. The previous consistency detection methods of security policies have some problems. Firstly, the detection direction is single, only focusing on formal reasoning methods to achieve logical consistency detection and solve problems. Secondly, the detection policy field is not comprehensive, focusing only on a certain type of problem in a certain field. Thirdly, there are numerous forms of data structures used for consistency detection, and it is difficult to unify the structured processing and analysis of rule library carriers and target information carriers. With the development of intelligent graph and data mining technology, the above problems have the possibility of optimization. This article proposes a new consistency detection approach for network security policy, which uses an intelligent graph database as a visual information carrier, which can widely connect detection information and achieve comprehensive detection across knowledge domains, physical devices, and detection methods. At the same time, it can also help users grasp the security associations with the real network environment based on the graph algorithm of the knowledge graph and intelligent reasoning. Furthermore, these actual network situations and knowledge bases can help managers improve policies more tailored to local conditions. This article also introduces the consistency detection process of typical cases of network security policies, demonstrating the practical details and effectiveness of this method.

A bibliometric analysis of the of cybersecurity policy research

The cybersecurity policy is a fundamental framework for developing a robust defense strategy for an organization's digital landscape. It involves various critical steps, including classifying information based on sensitivity, implementing strict access control, encrypting data in transit and at rest, continuous security awareness training, an incident response plan for addressing security breaches, deploying network security measures such as firewalls and intrusion detection systems, and physical security protocols to protect data centers and infrastructure. The purpose of this study is to answer the following questions: How are articles on Cybersecurity Policy classified? What are the latest study trends in Cybersecurity Policy analysis? What are the most frequently published research topics? What are the potential areas for future research in Cybersecurity Policy analysis? This research used a quantitative-descriptive technique. This bibliometric analysis explores the extensive and dynamic domain of cybersecurity policy, examining academic outputs from various dimensions. Utilizing standardized methodologies, including Mendeley software, VOSviewer, and PoP, this study navigates the complex terrain of academic literature. The findings reveal major topics such as 'Cybersecurity policy,' 'Network security policy,' and 'Cybersecurity' emerge, illuminating both well-explored areas and less developed fields such as 'National cybersecurity' and 'Cyberspace.' These unexplored aspects present intriguing avenues for future research.

Security Methods to Improve Quality of Service

INTRODUCTION: Security and Quality of Service (QoS) are two of the most critical aspects of communication networks. Security measures are implemented to protect the network from unauthorized access and malicious attacks, whereas QoS measures are implemented to ensure that the network is reliable, efficient, and can meet the demands of users. 
 OBJECTIVES: This paper examines various methods of network security and their impact on the quality of service (QoS) in computer networks. The study analyses different types of network attacks, such as denial of service (DoS), distributed denial of service (DDoS), and intrusion attempts, and their impact on QoS. The paper also explores various security mechanisms, such as intrusion detection and prevention systems (IDPS), firewalls, virtual private networks (VPNs), and techniques for encryption, that can help mitigate network security threats while maintaining QoS.METHODS: The study evaluates the strengths and weaknesses of the security mechanisms in terms of their ability to provide protection against network attacks while minimizing the impact on QoS. 
 RESULTS: The paper provides recommendations for organizations to enhance their network security posture while improving the QoS, such as implementing robust network security policies, investing in advanced security tools, and training employees to recognize and respond to network security incidents.
 CONCLUSION: This paper offers a comprehensive analysis of network security methods and their impact on QoS, providing insights and recommendations for organizations to improve their network security posture and maintain a high level of QoS.hese are the conclusions of this paper.

A Novel Administration Model for Managing and Organising the Heterogeneous Information Security Policy Field

Information security policy (ISP) plays a crucial role in maintaining the availability, confidentiality, and integrity of sensitive data. However, it is of high complexity and heterogeneity due to the variety and redundancy of security policy practices and complexity of organisational systems. Various and duplicate ISP models and frameworks have been offered in the literature. The duplicate security policy practices, procedures, and processes in the existing models have made ISP disorganised, unstructured, and unclear to organisational users. As a result, there is still a need for a standardised and integrated model to make it simpler to share, manage, and reuse ISP practices amongst the organisations. The main objective of this study is to construct a metamodel to unify, organise, and structure ISP practices. By identifying, recognising, extracting, and combining the common information security policy practices from various ISP models in a built ISP metamodel called ISPM, we seek to make it simple for users and field specialists to derive/instantiate security policy models for their organisations. The development and validation process of the ISPM is based on the common security frameworks such as ISO 27001 frameworks. The developed ISPM consists of 19 common security practices: organisation, risk management, access control policy, edit, review, compliance, business management, backup and recovery, incident response, SETA program, security awareness, security training, security education, email security policy, cloud security policy, network security policy, website security policy, physical security policy, and privacy security policy. Each common security practice consists of several operations and attributes. The performance of the developed ISPM was compared to that of other models to evaluate its completeness and logicalness. Using ISO 27001 as a framework, the findings confirmed the comprehensiveness of ISPM. Therefore, it can contribute to organisations’ security by helping them to develop their own security policy models.

4MIDable: Flexible Network Offloading For Security VNFs

The ever-growing volume of network traffic and widening adoption of Internet protocols to underpin common communication processes augments the importance of network security. In order to enforce network security policies, network managers adopt a widening set of middleboxes and network appliances to improve traffic monitoring and processing capabilities. The resource requirements to support network security appliances are constantly increasing, making efficiency of these systems an essential aspect. The move toward Software-Defined Networking and programmable data planes offers a mean to offload traffic processing functionalities to within the network itself. To this end, we present the 4MIDable framework: a platform that facilitates the integration of existing middleboxes and monitoring appliances with an SDN (P4) network infrastructure. We also present P4Protect, a 4MIDable agent that protects the network from control plane DoS attacks with negligible impact on control plane latency, and P4ID (P4-Enhanced Intrusion Detection), a 4MIDable agent that offers stateful processing and feedback to unmodified Intrusion Detection System middleboxes and reduces traffic processing by over 80% without affecting threat detection rates.

Detection Optimization of Rare Attacks in Software-Defined Network using Ensemble Learning

Software-defined networking (SDN) is a highly flexible architecture that automates and facilitates network configuration and management. Intrusion detection systems (IDS) are becoming essential components in the network to detect malicious attacks and suspicious activities by continuously monitoring network traffic. Integration between SDN and machine learning (ML) techniques is extensively used to build an effective IDS against all potential cyber-attacks that aim at breaking the network security policy and stealing valuable data. Implementing an IDS based on SDN and ML has the advantage of managing traffic dynamically and fully autonomously to provide high protection against security threats. The main objective of this paper is to propose an IDS based on SDN that integrates adaptive boosting and cost-sensitive techniques to improve the detection rates of rare attacks without compromising the detection accuracy of familiar attacks. Cost matrix values for various attacks are optimized using grid search and genetic algorithms. The integration of AdaBoost and cost-sensitive aims to build a classification model that minimizes the total number of high-cost errors caused by incorrectly classifying attacks. Experiments were conducted on the CSE-CIC-IDS2017 and CSE-CIC-IDS2018 datasets to simulate the network. The proposed algorithm's performance is evaluated using the macro F1-score and the geometric average of the recall (G-mean). Simulation results prove that the proposed algorithm enhances the detection performance of rare intrusions compared to current techniques, where it achieves the macro F1-score of 0.99 and the G-mean of 0.992 using CIC-IDSC-IDS2017, while for CIC-IDSC-IDS2018 the macro F1-score is 0.993 and the G-mean is 0.994.

Detection of Denial of Service Attack in Cloud Based Kubernetes Using eBPF

Kubernetes is an orchestration tool that runs and manages container-based workloads. It works as a collection of different virtual or physical servers that support multiple storage capacities, provide network functionalities, and keep all containerized applications active in a desired state. It also provides an increasing fleet of different facilities, known as microservices. However, Kubernetes’ scalability has led to a complex network structure with an increased attack vector. Attackers can launch a Denial of service (DoS) attack against servers/machines in Kubernetes by producing fake traffic load, for instance. DoS or Distributed Denial of service (DDoS) attacks are malicious attempts to disrupt a targeted service by flooding the target’s service with network packets. Constant observation of the network traffic is extremely important for the early detection of such attacks. Extended Berkeley Packet Filter (eBPF) and eXpress Datapath (XDP) are advanced technologies in the Linux kernel that perform high-speed packet processing. In the case of Kubernetes, eBPF and XDP can be used to protect against DDoS attacks by enabling fast and efficient network security policies. For example, XDP can be used to filter out traffic that is not authorized to access the Kubernetes cluster, while eBPF can be used to monitor network traffic for signs of DDoS attacks, such as excessive traffic from a single source. In this research, we utilize eBPF and XDP to build a detection and observation mechanism to filter out malicious content and mitigate a Denial of Service attack on Kubernetes.

Models of Trust and Trusted Computations to an Ad-hoc Network Security

Ad-hoc networks have unique properties, making it impossible to execute the current existing network security policy successfully. Based on studying the Ad-hoc network, the Cloud Security theory will be applied to it. We apply Direct Blind Authentication theory and trusted computing platform hardware modules to optimize the Ad-hoc networks' authentication links. The program successfully addresses the security concerns of Ad-hoc nodes, strengthening the Ad-hoc network's defenses.

Software-Defined Security-by-Contract for Blockchain-Enabled MUD-Aware Industrial IoT Edge Networks

To ensure the proper functioning and performance of Industrial grade Internet of Things devices (IIoT) in Industry 4.0 networks, it is critical to identify the capabilities and malfunctions of their component devices (e.g., sensors, actuators, and controllers) and detect potential misbehavior arising due to cyber-attacks, and misconfiguration. We envision future IoT devices embed behavioral profiles through <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Security-by-Contract</i> (S×C) that are easy to validate and verify against network security policies; manufacturers to provide manufacturer usage description (MUD) profiles as a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">manifest</i> for the devices to signal to the network what sort of access and network functionality they require to properly function. We design authentication in the IoT onboarding process, employ blockchains to a verifiable and immutable repository to store this network manifests, that is signed and verifiable with S×C based <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">smart contracts</i> by the device manufacturer, or industry authority. The integrated framework combines blockchains and S×C security contracts, MUD-based behavioral fingerprinting, and software-defined-networking for managing the security of IIoT ecosystems. Finally, the proposed scheme is validated in a simulated IoT environment on various performance parameters.

Optimizing distributed firewall reconfiguration transients

The flexibility and dynamism brought over by softwarization for network management have increased the frequency of configuration changes. In this context, when a distributed security function is subject to a series of configuration changes, a problem that arises is the preservation of the security. The transient from the application of the first change to the last one may present unsecure temporary states, where the required security protection is missing. Establishing a safe scheduling of the configuration changes can significantly limit the number of unsecure states and decrease the time period where the network may be at risk. However, the literature challenged this problem only for centralized firewalls or SDN switches, and without applying formal methods to ensure the correctness of the computed scheduling. In order to overcome these limitations, this paper addresses the problem for distributed firewalls, aiming to satisfy the largest number of user-specified network security policies in each transient state. To this end, it proposes a formal methodology relying on the combination of three main features: automation, formal verification and optimization. This combination is achieved by pursuing a correctness-by-construction approach, based on the formulation of a Maximum Satisfiability Modulo Theories problem. A framework has been developed on the basis of this methodology, so that validation tests have been experimentally executed to assess the feasibility, efficacy and scalability of the approach.

A Novel Approach of BRELU RESNET Based Cyber Attack Detection System with BAIT Based Approach for Mitigation

Purpose: Industrial Control Systems become more vulnerable to digital attacks by merging communication groups and the Internet of Things, which could have severe implications. An Intrusion Detection System is essential in IoT businesses for identifying and stopping assaults. To ensure data privacy and security in the face of digital attacks, legislation and large enterprises should develop network security policies today. As people-based full frameworks have become more vital in today's society, they've also become targets for hostile activities, compelling both industry and research to concentrate more on dealing with local area disruption recognition issues. Contraption reviewing techniques have shown to be effective tools for resolving in-network interruption location issues. Design/Methodology/Approach: This investigation yielded a very unique strategy for tackling hub moderation utilizing a Classification and Encryption method. The UNSW-NB15 dataset is acquired and divided into Data for preparation and testing from the start. The information is pre-handled and included are eliminated right away within the preparation time frame. The TWM Algorithm is then used to determine the relevant highlights from that moment onward. The BRELU-RESNET classifier then sorts the input into went after and non-went after categories. The compromised information is then saved in the security log record, and the typical data is encrypted using the ESHP-ECC computation. The shortest path distance is then calculated using Euclidean distance. Finally, the data is available. Finally, using the DSHP-ECC computation, the information is decrypted. If the information is available in the log document during testing, it is regarded as the sought-after data and is prevented from the transmission. If it is not present, then the process of digital assault recognition begins. Findings/Result: The research is based on the UNSW-NB 15 dataset, which shows that the proposed method achieves an unreasonable awareness level of 98.34 percent, particularity level of 77.54 percent, exactness level of 96.6 percent, Precision level of 97.96 percent, review level of 98.34 percent, F-proportion of 98.15 percent, False Positive Rate of 22.46 percent, False Negative Rate of 1.66 percent, and Matthew's connection coefficient of 77.38 Originality/Value: This experimental-based research article examines the malicious activities in the cyberspace using BRELU-RESNET approach and mitigated by using BAIT based approach mechanism. Paper Type: Research Analysis.

Layer 7 Packet Filtering Implementation on Actual Kernels

The use of Application layer packet classifier and optimization of bandwidth towards QoS in Linux using netfilter, iproute2 and layer-7 Filter. As seen in the statistics the huge amount of data flows through the network, so it is necessity to apply packet-filtering rules in order to control the traffic and add firewall rules. Some services are inherently insecure and impossible to secure on individual hosts. Packet filtering tools can help you segment and contain parts of your network to increase security. A packet filtering tools can help you enforce your network security policies by selectively allowing network services. Because a packet filtering tools must examine all inbound/outbound network traffic, it can help you log network activity. We are looking at packet filtering tools like Netfilters and iproute2, who examine the IP packets for filtering and using the queuing disciplines for traffic control.

Multi-Attribute Decision Making Method for Node Importance Metric in Complex Network

Correctly measuring the importance of nodes in a complex network is critical for studying the robustness of the network, and designing a network security policy based on these highly important nodes can effectively improve security aspects of the network, such as the security of important data nodes on the Internet or the hardening of critical traffic hubs. Currently included are degree centrality, closeness centrality, clustering coefficient, and H-index. Although these indicators can identify important nodes to some extent, they are influenced by a single evaluation perspective and have limitations, so most of the existing evaluation methods cannot fully reflect the node importance information. In this paper, we propose a multi-attribute critic network decision indicator (MCNDI) based on the CRITIC method, considering the H-index, closeness centrality, k-shell indicator, and network constraint coefficient. This method integrates the information of network attributes from multiple perspectives and provides a more comprehensive measure of node importance. An experimental analysis of the Chesapeake Bay network and the contiguous USA network shows that MCNDI has better ranking monotonicity, more stable metric results, and is highly adaptable to network topology. Additionally, deliberate attack simulations on real networks showed that the method exhibits high convergence speed in attacks on USAir97 networks and technology routes networks.

Threat Diagnostic Checklists of Security Service in 5G Communication Network Virtualization Environment

The purpose of this paper is to review the direction of the slicing security policy, which is a major consideration in the context of standardization in 5G communication network security, to derive security vulnerability diagnosis items, and to present about analyzing and presenting the issues of discussion for 5G communication network virtualization. As for the research method, the direction of virtualization security policy of 5G communication network of ENISA (European Union Agency for Cybersecurity), a European core security research institute, and research contents such as virtualization security policy and vulnerability analysis of 5G communication network from related journals were used for analysis. In the research result of this paper, the security structure in virtualization security of 5G communication network is arranged, and security threats and risk management factors are derived. In addition, vulnerability diagnosis items were derived for each security service in the risk management area. The contribution of this study is to summarize the security threat items in 5G communication network virtualization security that is still being discussed, to be able to gain insights of the direction of European 5G communication network cybersecurity, and to derive vulnerabilities diagnosis items to be considered for virtualization security of 5G communication network. In addition, the results of this study can be used as basic data to develop vulnerability diagnosis items for virtualization security of domestic 5G communication networks. In the future, it is necessary to study the detailed diagnosis process for the vulnerability diagnosis items of 5G communication network virtualization security.

An adapting soft computing model for intrusion detection system

AbstractNetwork security in smart cities has become a key problem in the rapid development of computer networks over the past few years. Intrusion detection systems play a fundamental part in the integrity, confidentiality, and resource accessibility among the multiple network security policies. The classification of the genuineness of packets is main object of the presents research work, the soft computing has applied to classify the genuineness of packets. The complexity of soft computing is greatly reduced if the numbers of features in a dataset are reduced. Managing and analysis of the dimensionality reduction is novelty of the proposed model. The existence of uncertainty and the imprecise nature of the intrusions appear to create suitable fuzzy logic systems for such structures. The neural‐fuzzy algorithm is one of the effective methods that incorporate fuzzy logic systems into adaptive and analysis capacities. In this research work, soft computing fuzzy logic system is proposed to enhance network security through intrusion detection. Three network datasets are demonstrated to test and estimate the proposed system. Feature selection has used to remove irrelevant features from entire network data which are obstacle classification processes. The Information Gain method was applied to select importance features for detection intrusion. Adaptive Neuro‐Fuzzy Inference System (ANFIS) is further used to process the significant features of the classification network data as normal or attacks packets. Two functions named Jang's Neuro‐fuzzy and faster‐scaled conjugate gradient (SCG) based on the ANFIS system. Obviously, the experimental results demonstrate the proposed system has attained higher precision in detecting normal or attack. The experimental results have suggested that the proposed system results are better in accuracy and time process for classification compared with the existing models. The Overall Results show that the proposed system can be able to detect various intrusions efficiently and effectively.

Computer Network Security Maintenance and Management in the Era of Big Data

With the development of information technology, the big data network has been initially formed. However, the network security problem is becoming more and more serious in this environment. China has put the network security in an important position of national security. This paper analyzes the text of China's network security governance policy from the perspective of big data, builds an analysis framework based on big data, analyzes the relevant provisions of China's network security governance policy, analyzes the existing problems and puts forward optimization suggestions, in order to provide reference for the formulation of China's network security governance policy and improve China's network security governance policy system. This paper collects the information of network security incidents and policies in 2020 from Google data analysis platform. After preliminary collection and sorting, 195 relevant policies on network security governance are obtained. In order to ensure the accuracy and pertinence of the materials, all policies are analyzed. The research results show that the application of some big data of network security governance is concentrated on the regulatory level, lacking specific implementation rules and methods. There are 183 policies involving regulatory control, accounting for 31.6%. Therefore, the national network information department should cooperate with the legislative department to formulate policies for the problems in the network ecosystem. Network is not only the extension of people's daily life, but also an important part of economic and social life.

Defending against insider threats with network security's eighth layer

It would be an understatement to say 2020 was a year of change, but here we are in March 2021, a world away from March 2020. As the UK Government juggles the socio-economic impacts of Covid-19 and now Brexit, daily news briefings are announcing new guidelines and initiatives to tackle a whole host of problems old and new yet it feels like the growing cyber security threat has been pushed to the bottom of the importance list. With the changes in work practices brought about by the pandemic, security teams have found themselves going back to basics. One area that needs special attention is the so-called ‘layer eight’ – the user. Organisations need to look at how they can reduce deliberate or inadvertent threats from insiders as working from home becomes the new normal. Businesses must implement strict network security policies, as well as looking at the role that the entire organisation plays in network security strategies, argues Phil Chapman of Firebrand Training.

Network Security Policy for Higher Education Institutions based on ISO Standards

Computer network plays a very important role in any organizations or institutions. It becomes a necessary tool, useful for communications, and can be utilized in storing data in various forms and at various locations. However, it intrinsically at risk to breaches from both internal and external attacks, and because of that, there should be an appropriate implementation and management of the network and its security. The study aimed to assess the employed network security of the higher education institutions (HEIs) and check if they conform to the six parts of ISO 27033 international standards. Standardized ISO 27033 assessment questionnaire was the main tool in gathering the data and the respondents were the network security team members of the five (5) HEIs. Results showed that HEIs did not mostly conform to the ISO 27033 requirements. Hence, to have a better guide and implementation of the institutions network security, a network security management policy based on ISO 27033 must be in place.

Anomaly traffic detection and correlation in Smart Home automation IoT systems

AbstractSmart building automation systems are increasingly the target of hacking attacks. Moreover, they may be used as a tool for attacks against targets located out of the native Home Area Network (HAN). These attacks are often resulted in changes in traffic volume, damaged packets, increased message traffic, and so on. Symptoms of attacks can be detected as anomalies in traffic model and recognized by a software agent run on Home Gateway. Although these anomalies are detected locally, it may help network provider to protect his resources as well as other resources of his clients. For that purpose, network operator should be able to recognize anomalies and correlate them on the network level. In this way, the network operator has the ability to protect both its own network and HANs of its clients. This article shows that Smart Home security might be coupled with the providers' network security policy. For that reason, security tasks should be performed both in HAN and providers' data center. This article describes a novel strategy for anomaly detection that provides shared responsibility between a service client and the network provider. It uses a machine learning approach for classifying the monitoring data and correlation in searching suspicious behavior across the network resources at the service provider's data center.

Research on Computer Network Security Policy of Cloud Computing

Cloud computing is a special computing model, which provides growth, use, and delivery services for internet data. In the application of cloud computing technology, the security problems of the computer network in some cloud computing environments gradually appear, resulting in the security troubles of computer network applications. This paper attempts to study the computer network security problems in the cloud computing environment, and proposes the corresponding computer network security strategy, to promote the computer network security, reduce the adverse effects of security problems, for the relevant personnel to provide a reference.