Abstract:SummaryWith the rapid development of the internet, cyberspace security issues have become increasingly prominent. The importance of constructing a cyberspace security system is self‐evident, but compared with attackers, defenders in cyberspace are in a castle‐like passive defense state in most cases. Therefore, building a reliable, accurate, timely, and active defense system is challenging. The key is to accurately focus on defense priorities, the anticipation of attackers who will likely succeed, and blocking attacks in a timely manner. In this article, we propose an active defense model based on the interaction of situational awareness and firewalls. First, by biasing the integrity, confidentiality, and availability of assets to get the score of assets, and using the Common Vulnerability Scoring System to assess the threat level of assets, we combine the two to determine the maximum system damage that the asset will suffer if it is lost, and then focus on defense. Meanwhile, log analysis of the network situational awareness platform can predict successful attackers, and then the linked firewall strategy can block these attacks in time before the attackers obtain attack gains. After that, we force the attackers to give up their attacks on the target by increasing the attack cost. We compared our model with iptables auto‐blocking and nginx auto‐blocking, and our model excelled them across the board in terms of comprehensiveness and false positive rate. The experimental results verify thar our active defense model proposed in this article can better reduce the defense cost and increase the attack cost, thus achieving the relatively defense goal.

Proactive Security Mechanism and Design for Firewall

ForCES-Based Firewall with Stateful Packet Inspection

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

State Machine Based Malicious Packet Attack Detection and Security Situation Assessment

Proactive Security Defense of Dynamic Network

Design of Active Firewall Based on Safety Psychology

Research and Implementation of a Firewall System with Security Interaction Ability

S_firewall: A Firewall In Wireless Sensor Networks

System Design of Firewall Based on Deep Packet Inspection

Firewall Fingerprinting and Denial of Firewalling Attacks.

An Efficient Firewall Application Using Learned Cuckoo Filter

Research and Implement of Packet Filtering Firewall in Simulation Platform

Firewall fingerprinting

Design for Firewall Integrating with Intrusion Detection

A Reference Model And System Architecture For Database Firewall

The Design of a Security Mechanism for Distributed Firewall Systems

Design and Implementation of Enterprise Network Security System Based on Firewall

A Design of Firewall Based on Feedback of Intrusion Detection System in Cloud Environment

Distributed Firewall with Intrusion Detection System.

An Active Defense Model Based on Situational Awareness and Firewalls

Dynamic Defense Security Model for Network Perimeter