Next-generation Firewalls Research Articles

A comprehensive review of combating EDoS attacks in cloud services with deep learning and advanced network security technologies including DDoS protection and intrusion prevention systems

This comprehensive review examines the current state of research and practice in combating Economic Denial of Sustainability (EDoS) attacks in cloud services, with a focus on deep learning approaches and advanced network security technologies. The paper provides an in-depth analysis of EDoS attack characteristics, their impact on cloud economics, and the challenges faced in mitigation efforts. It explores the application of deep learning techniques in EDoS detection and prevention, highlighting recent advancements in neural network architectures and feature extraction methods. The review also covers the integration of advanced network security technologies, including next-generation firewalls, software-defined networking, and cloud-native security solutions, in the context of EDoS protection. Furthermore, it discusses the adaptation of Distributed Denial of Service (DDoS) mitigation strategies for EDoS attacks, emphasizing traffic analysis and anomaly detection techniques. The role of Intrusion Prevention Systems (IPS) in EDoS mitigation is examined, comparing signature-based and behavior-based approaches and exploring their integration with other security components. The paper concludes by identifying emerging threats, regulatory considerations, and open research problems in EDoS protection, providing valuable insights for researchers and practitioners in the field of cloud security. This review aims to serve as a comprehensive resource for understanding the current landscape of EDoS attacks and defense mechanisms, while also highlighting future directions for research and development in this critical area of cloud computing security.

Next-Gen Firewalls: Enhancing Cloud Security with Generative AI

Next-generation firewalls are available and use machine learning and generative modeling to enhance the detection of hard-to-detect cyber threats. These systems incorporate advanced security controls, policies, and protocols with Layer 7 of the OSI model. This chapter updates these steep AI-based protection systems and applications.

Next Generation Firewall (NGFW) and Datacenter Operations

Network security, in the contemporary world, is a necessity due to the magnificent growth of the word wide web and the increasing dependence of the masses on the internet for majority of their day-to-day transactions. It ensures that both the integrity and usability of the data remains protected. The Next Generation Firewall (NGFW) becomes important to ensure this requirement of remaining secured is met in a rapidly changing technological environment where cybercrimes are developing by leaps and bounds and traditional means of protection fall grossly inadequate. This article delves into the area of data center operations and highlights the way NGFW had become an integral part of data security and an absolute necessity to ensure safe and sound operations.

Security threat detection performance analysis of a distributed architecture WSN

IoT technologies are becoming more and more common in our daily activities because the networks they create are capable of collecting information, monitoring and controlling remotely. However, these devices are not exempt from security attacks, as they become vulnerable entry points to data networks. The use of traditional methods to secure networks (e.g., Next Generation Firewalls (NGFW), encryption, etc.) is not recommended because the devices used in this type of network are limited in terms of computing power and storage availability (e.g., nodeMCU). In this paper, we propose to design two intrusion detection systems in embedded systems using machine learning (ML) algorithms, Artificial Neural Networks and K-means. In a distributed architecture Wireless Sensor Network scenario (WSN), we evaluate their performance in terms of connection and response times, detection accuracy and intruder detection time. Simulation results show that both models are able to find irregularities in network traffic within milliseconds.

Toward a modern secure network based on next-generation firewalls: recommendations and best practices

The security architecture of modern networks undergoes periodic changes, given (i) the diversity of security solutions, (ii) the emergence of new attack vectors, and (iii) corporate needs in terms of access control (ZTNA: Zero Trust Network Access). The complexity of setting up a secure infrastructure lies in the design of the network architecture, on the one hand, and the choice of configurations appropriate to the company’s security policy, on the other. Indeed, misconfiguration is considered a vulnerability, which makes the task of setting up a secure network somewhat critical, given the technical skills it requires. In this paper, we will address this problem by proposing a modern security architecture applied to all sizes of enterprises: medium-sized, large, and sometimes even small companies. Therefore, we will describe the equipment required and their roles in the security layer, the security technologies adopted, and best practices for optimal deployment. To evaluate our proposal, we generated malicious traffic using the firewall inspection tester based on the “fit.py” script to study the architecture’s resilience and behavior in the face of multiple attacks.

A short survey of the capabilities of Next Generation firewalls

This article examines the history, types, capabilities, and advantages of next-generation firewall (NGFW) technology. Firewalls are an important tool for protecting network resources from various information security threats. With the development of technology and the changing nature of attacks, especially those involving artificial intelligence, firewalls have also evolved, acquiring new functions and capabilities. This work provides a short survey of the main types, capabilities and benefits of next-generation firewall (NGFW) technology, which is a modern solution for comprehensive network protection against complex and sophisticated security threats. The work also analyzes the distinct features of NGFW and differences between NGFW and previous generations of firewalls, as well as examples of NGFW from well-known vendors that dominate the market, such as Palo Alto Networks, Fortinet and Cisco. The article highlights the main trends, prospects for the development and implementation of NGFW, including the impact of artificial intelligence, machine learning, cloud technologies and the Internet of Things, advantages and disadvantages, capabilities, important aspects, purpose and sphere of application. The article also addresses the significant impact this technology will have on network security. It is emphasized that the introduction of NGFW does not replace other security technologies and tools, but effectively expands the existing arsenal of countering new security threats (primarily as an instrument of proactive countermeasures and rapid response to complex network incidents). The article may be useful for students, researchers, and information security professionals who seek to expand their competencies related to the development of modern firewall technologies and their capabilities.

Mobile Security Operation Centre (mSOC)

Attacks on the internet are becoming increasingly threatening. For naïve home users, who are poorly protected, there is always an imminent danger of getting cyber attacked. 
 This paper is aimed to design and build an IoT-based Network Security device that would run as an access point for users to connect to the Internet in a home setting. The paper discusses a standalone perimeter security solution with Incident Response (IR) life cycle management and controls through an IoT device – Raspberry PI. Enterprise-level features such as Next Generation Firewall (NGFW), Network Intrusion Detection System (NIDS), Domain Control for Ad/Spam blocking, Security Information and Event Management (SIEM) for Log Co-ran System on Chip (SoC), which can be installed anywhere and carried for mobile operations. Hence, the name, Mobile Security Operation Centre (mSOC).
 This solution intends to protect the user when browsing the internet and blocking or providing visibility to the malicious connections made to or from users. The mSOC can filter domains based on whitelist/blacklist and Regex Pattern. It can also identify the domains that are blocked or allowed. It also provides visibility to traffic, application statistics, and IP reputation. IP reputation and Malicious Domains then can act as input to the iptables for L3/L4 blocking. A Software User Interface is developed to integrate and manage multiple Open-Sourced applications like dnsmasq/ elk/ graylog/ SQlite3/ Iptables/ adminlte as a single product that could serve as a complete security solution for a home or Small Medium Business (SMB). Thus, the proposed solution secures naïve users from security exploitations.

Implementation Of Next-Generation Firewalls To Protect Applications From Malware Attacks

Based on the rapid development of technology that has a positive and negative impact; one of the negative impacts is the leakage of data, called cybercrime. To overcome this, in this study, the design of the next-generation firewall (NGFW) protects technology and information systems from threats and malware attacks on technology and information systems. In this study, the Palo Alto firewall is implemented by configuring the firewall and testing the attack using malware. This test's results aim to prevent data loss, material loss, and paralysing of public services. Moreover, it is efficient and effective in scanning for variations of attacks without affecting network performance. The results' implications are expected to solve the problems faced perfectly. NGFW takes precautions by blocking malware access to its network traffic

Intuitionistic Fuzzy Rough Aczel-Alsina Average Aggregation Operators and Their Applications in Medical Diagnoses

Managing ambiguous and asymmetric types of information is a very challenging task under the consideration of classical data. Furthermore, Aczel-Alsina aggregation operators are the new developments in fuzzy sets theory. However, when decision-makers need to use these structures in fuzzy rough structures, these operators fail to deal with such types of values, as fuzzy rough structures use lower and upper approximation spaces. Thus, an encasement of an intuitionistic fuzzy set has a chance of data loss, whereas an intuitionistic fuzzy rough set can resolve the problem of data loss. Motivated by the notion of intuitionistic fuzzy rough sets and new aggregation operators i.e., intuitionistic fuzzy Aczel-Alsina operators, this paper firstly initiates some basic Aczel-Alsina operational rules for intuitionistic fuzzy rough numbers. Secondly, based on these newly defined operational rules, we have developed some new aggregation operators, such as intuitionistic fuzzy rough Aczel-Alsina weighted average (IFRAAWA), intuitionistic fuzzy rough Aczel-Alsina ordered weighted average (IFRAAOWA), and intuitionistic fuzzy rough Aczel-Alsina hybrid average (IFRAAHA) aggregation operators. Moreover, the properties of these aggregation operators have been initiated. These operators can help in evaluating awkward and asymmetric information in real-life problems. The use of aggregation operators in medical diagnosis and MADM is an efficient method that can help in healthcare and decision-making applications. To present an effective use of these developed operators in medical diagnosis and the selection of the best next-generation firewall, we have established an algorithm along with a numerical example to provide authenticity and clarity to the established work. Furthermore, a comparative analysis of the introduced work shows the superiority of the introduced approach.

INFORMATION SECURITY POLICIES AND STRATEGIES AND PRACTICES ADOPTED IN IT: THE IMPORTANCE OF CONSULTANCY IN SMALL AND MEDIUM-SIZED COMPANIES

Objective: Companies in the cybersecurity consulting market are expanding their services in periodic training to business stakeholders and enforcement of security policies. The objective of this work is to demonstrate the importance of consulting in information security policies aimed at small and medium-sized companies. Methods: It is characterized as a narrative literature review with a qualitative approach, which does not use explicit and systematic criteria for the search and critical analysis of the selected literature. Results: Tools needed for cybersecurity include endpoint detection and response (EDR), antivirus software, next-generation firewalls, Domain Name System (DNS) protection, email gateway security, intrusion detection and prevention, logging and log monitoring, endpoint protection, authentication and virtual private network (VPN) services, cloud-based security, web application firewalls (WAFs), software-defined wide area networks (SD-WAN), enterprise password management , privileged access management (GAP), vulnerability and threat management, and threat detection. Conclusions: In summary, SMBs seem to implement some of the basic cybersecurity measures only as part of their overall IT implementation. However, it appears that unless cybersecurity controls are included as part of an IT solution, many SMBs do not realize the resulting potential risks to their business.

Study to analyse, compare and evaluate the performance of next general firewalls: Case of Palo Alto and Fortigate Firewall

The article focuses on analyzing, comparing, and evaluating the performance of the next-generation firewalls, case of Palo Alto Firewall and Fortinet Firewall in practice through the deployment of simulated situations and experimental scenarios that are: using network attacks such as TCP, UDP Flood; evaluate the function of SSL/TLS Inspection, Application Control; Check traffic, latency, packet response time and average throughput values on each network system with each separate firewall. The result shows that both types of firewalls have outstanding performance compared with older generation firewalls and Fortinet Firewall has more outstanding points than Palo Alto Firewall in particular. The research results will be necessary documents for designers, ensuring network safety and security of the network system, and for students and students majoring in Information Technology and Information Security as a reference to make appropriate decisions when using these two types of next-generation firewalls.

Research and application of next-generation firewall technique in medical network

With the rapid development of medical informatization as well as the larger quantities of information and higher integration level, it has become a severe challenge to keep the core data confidential. In this thesis, the role of next-generation firewall in the medical network has been first introduced. Then, a medical network has been designed and an overall network building scheme aimed at the medical network has been planned based on the actual demand of a hospital. Then, VLAN has been divided and IP address has been planned to each floor. Moreover, relevant protocols and important equipment to be used have been introduced in detail, including DHCP protocol, SNMP protocol, next-generation firewall safety devices. In addition, the IP address of each area has been planned, the connectivity of LAN has been tested and the simulated attack and defense test has been taken based on the deployment principle of next-generation firewall. Furthermore, a detailed introduction of deployment of security policy as well as some common security vulnerabilities on firewall has been made. At last, the attack and defense test of firewall has been taken to prove the efficient protection function of firewall in the medical network and meanwhile prove that next-generation firewall technique could help the hospital solve the network security issues to some extent.

Nunukan State Court's Computer Network Security Improvement Using Centralized Next-Generation Firewall

The Nunukan District Court currently uses technology and information systems to improve services to the community. However, the use of technology and information systems is not accompanied by the application of technology and information system security. This makes the Nunukan District Court vulnerable to attacks and threats such as viruses, phishing, DDoS and others. To overcome this, in this research, a design was made for the implementation of the Next-Generation Firewall which functions to protect information technology and systems in the Nunukan District Court from threats and attacks on technology and information systems. From the results of tests conducted at the Nunukan District Court, the Next-Generation Firewall can prevent attacks and threats carried out in testing. Not only that, this study also found an increase in network performance at the Nunukan District Court. Several features were implemented, such as web filters, antivirus, IPS and antiDDoS, which were seen to be able to prevent attacks and threats to the information system used at the Nunukan District Court. The implementation of the applied design also makes the firewall resource device at the Nunukan District Court unburdened because it offloads the security scanning function to the NGFW device in the cloud which causes an increase in internet access performance.

Session Management for Security Systems in 5G Standalone Network

As 5G telecom services evolve rapidly across a broad technological environment, network security in 5G landscape emerges as a critically challenging issue. One of typical network security tools is an intrusion prevention system (IPS) that monitors a network for malicious activity across the cyber-attack chain and takes action to prevent it. Vulnerabilities in 5G core networks become more varied and protocols become increasingly complex, whereby conventional Next Generation Firewall (NGFW) is not enough anymore to respond to cyber attacks. As a typical 5G vulnerability attack, PFCP-in-GTP and IPSec disable attack are highly complex to detect and cannot identify attackers without integrated session management. However, the 5G core network uses various protocols such as Non-Access Stratum (NAS), Hyper Text Transfer Protocol (HTTP), Packet Forwarding Control Protocol (PFCP), and GPRS Tunnelling Protocol (GTP), and packets of the interface used by each protocol are managed as identities that are difficult to identify. Analyzing the relationship of these interfaces in real time is an important key to integrated session management. In addition, unlike existing 4G, as 3rd Generation Partnership Project (3GPP) specs mandate encrypting 5G Standalone (SA) user IDs, it is much more difficult to identify from which user traffic has occurred in IPSs exclusive for cellular network. With regard to the above subject, this paper introduces an efficient session management scheme for users not affordable in conventional NFGW but necessarily useful for security systems in 5G SA. Furthermore, this study compared performances between conventional NGFWs and a 5G IPS system with the scheme employed, to ascertain that the scheme is feasibly implementable in 5G SA network. The actual test results show a detection rate of 99.7% and reasonable resource overhead (Memory usage 37.8%, CPU usage 42–44%).

Application Layer Packet Processing Using PISA Switches.

This paper investigates and proposes a solution for Protocol Independent Switch Architecture (PISA) to process application layer data, enabling the inspection of application content. PISA is a novel approach in networking where the switch does not run any embedded binary code but rather an interpreted code written in a domain-specific language. The main motivation behind this approach is that telecommunication operators do not want to be locked in by a vendor for any type of networking equipment, develop their own networking code in a hardware environment that is not governed by a single equipment manufacturer. This approach also eases the modeling of equipment in a simulation environment as all of the components of a hardware switch run the same compatible code in a software modeled switch. The novel techniques in this paper exploit the main functions of a programmable switch and combine the streaming data processor to create the desired effect from a telecommunication operator perspective to lower the costs and govern the network in a comprehensive manner. The results indicate that the proposed solution using PISA switches enables application visibility in an outstanding performance. This ability helps the operators to remove a fundamental gap between flexibility and scalability by making the best use of limited compute resources in application identification and the response to them. The experimental study indicates that, without any optimization, the proposed solution increases the performance of application identification systems 5.5 to 47.0 times. This study promises that DPI, NGFW (Next-Generation Firewall), and such application layer systems which have quite high costs per unit traffic volume and could not scale to a Tbps level, can be combined with PISA to overcome the cost and scalability issues.

Misconfiguration in Firewalls and Network Access Controls: Literature Review

Firewalls and network access controls play important roles in security control and protection. Those firewalls may create an incorrect sense or state of protection if they are improperly configured. One of the major configuration problems in firewalls is related to misconfiguration in the access control roles added to the firewall that will control network traffic. In this paper, we evaluated recent research trends and open challenges related to firewalls and access controls in general and misconfiguration problems in particular. With the recent advances in next-generation (NG) firewalls, firewall roles can be auto-generated based on networks and threats. Nonetheless, and due to the large number of roles in any medium to large networks, roles’ misconfiguration may occur for several reasons and will impact the performance of the firewall and overall network and protection efficiency.

Protecting Networks from Modern Threats with Next-Generation Firewalls

Protecting Networks from Modern Threats with Next-Generation Firewalls

An archetype for mitigating the security threats in multi-cloud environment by implementing tree-based next-generation firewalls

Cloud computing on-demand dynamicity in nature of end-user that leads towards a hybrid cloud model deployment is called a multi-cloud. Multi-cloud is a multi-tenant and multi-vendor heterogeneous cloud platform in terms of services and security under a defined SLA (service level agreement). The diverse deployment of the multi-cloud model leads to rise in security risks. In this paper, we define a multi-cloud model with hybridization of vendor and security to increase the end-user experience. The proposed model has a heterogeneous cloud paradigm with a combination of firewall tracts to overcome rising security issues. The proposed work consists of three steps, firstly, all incoming traffic from the consumer end into five major groups called ambient. Secondly, design a next-generation firewall (NGFW) topology with a mixture of tree-based and demilitarized zone (DMZ) implications. Test implementation of designed topology performed by using a simple DMZ technique in case of vendor-specific model and NGFW on hybrid vendor based multi-cloud model. Furthermore, it also defines some advantages of NGFW to overcome these concerns. The proposed work is helpful for the new consumer to define their dynamic secure cloud services under a single SLA before adopting a multi-cloud platform. Finally, results are compared in terms of throughput and CPU utilization in both cases.

Effectiveness of Paired Next Generation Firewalls in Securing Industrial Automation and Control Systems: A Case Study

Industrial automation and control systems (IACS) are oftentimes the backbone of businesses and critical infrastructure (CI) around the world. They underpin control of nuclear plants, refineries, manufacturing and distribution systems. Today, organisations are routinely targeted by cyber-attackers. Cyberattacks have been increasing in frequency and sophistication. This is especially true of those attacks directed against high-profile operations such as petrochemical refineries. Attackers invest considerable time and money to study a target and probe inherent weaknesses, which they eventually attempt, and succeed in some cases, to exploit. Historically, industrial networks were kept separate from corporate networks. However, significant efficiency gains and demands for digital interconnectivity have driven a convergence between operational technology (OT) and information technology (IT) systems. The business of cybersecurity has been evolving dramatically, posing significant challenges to management teams, across all industries and business domains. Countries within the Caribbean, such as Trinidad and Tobago (T&T), are by no means an exception given their dependence on the energy sector and supporting IACSs. This paper examines the effectiveness of next generation firewalls (NGFWs) in their defense of Process Control Networks (PCNs) against malware. It focuses on the case of a process plant complex in T&T.

A suggested testbed to evaluate multicast network and threat prevention performance of Next Generation Firewalls

Although security have to be a key issue for systems carrying intelligence such as surveillance system, it is still overshadowed by bandwidth utilization in multicast networks. Next Generation Firewalls (NGFWs), state of the art cyber security devices, can be a solution with their content awareness features for this issue. NGFWs are both security and network devices, and it is a challenge to place a NGFW in a multicast network optimally and testing NGFWs in terms of threat prevention such as web, malware and exploit attack prevention capabilities. In this study, we proposed a flexible testbed for the first time, that can evaluate NGFWs in terms of security and multicast networking performances. The most popular brand datacenter type NGFWs were also tested by using the testbed under various attacks and network designs. The results showed that NGFWs can be used as both rendezvous points in Layer 3 and bridge mode in Layer 2 in multicast networks successfully. Moreover, proposed testbed allows testing the security functions of NGFWs and benchmark them in terms of threat prevention performance.