Design for Firewall Integrating with Intrusion Detection

Jian Xie

2004-01-01

Abstract:It is hard for single- functioned secure products to meet the current demand,and the trend begin to change towards Integration.A frame of firewall based on Linux is discussed as to improve the ability of security control.

What problem does this paper attempt to address?

A Reference Model And System Architecture For Database Firewall

L Cai,Xh Yang

DOI: https://doi.org/10.1109/ICSMC.2005.1571196

2005-01-01

Abstract:More and more network attacks are focusing on application level vulnerabilities. Recently, several examples of this trend have been highly publicized such as the SQL Slammer and SQL Snake attacks. Traditional firewalls, used for protecting the database, only prevent attacks searching for vulnerabilities. Database firewalls take defense deep into the organization by providing full syntax control and audit of the SQL AN stream before it reaches the database, and enforcing content-driven access to database. This paper proposes a layered reference model for database firewalls by enhancing the capability of COAST Laboratory's model. It separates a database firewall into three layers (network layer, schematic layer and semantic layer) according to the knowledge, computation target, and the control granularity of each layer. Based on this model, a database firewall product had been prototyped It can greatly improve the database security by introducing self-controlled authentication principal mapping, object mapping, and mandatory access control modules.
Research And Design Of Nids Based On Linux Firewall

Jia Zongpu,Liu Shufen,Wang Guowei

DOI: https://doi.org/10.1109/SPCA.2006.297482

2006-01-01

Abstract:Firewall has many shortages, such as it cannot keep away interior attacks, it cannot provide a consistent security strategy, and it has a single bottleneck spot and invalid spot, etc. Intrusion Detection System (IDS) also has many defects, such as low detection ability, lack of effective response mechanism, poor manageability, etc. If firewall and IDS are integrated, the cooperation of them can implement the network security to a great extent: on the one hand, IDS monitors the network, provides a real-time detection of attacks from the interior and exterior, and automatically informs firewall and dynamically alters the rules of firewall once an attack is found; on the other hand, firewall loads dynamic rules to hold up the intrusion, controls the data traffic of IDS and provides the security protection of IDS. Based on constructing firewall with Iptables in the environment of Linux OS, the respective characters of firewall and IDS are analyzed. Then, the viewpoint of integrating firewall and IDS to realize the network security is proposed, and the application and algorithm of intrusion detection are systemically analyzed and designed.
ForCES-Based Firewall with Stateful Packet Inspection

Ligang Dong,Feng Luo,Weiming Wang,Ke Chen

DOI: https://doi.org/10.4028/www.scientific.net/amr.216.440

2011-01-01

Advanced Materials Research

Abstract:In order to meet the extensibility and flexibility requirement of next generation network, ForCES working group of IETF proposes an architecture with the separation of Forwarding Element and Control Element. A firewall with ForCES architecture will have enough flexibility on security function extensibility. This paper not only designs the ForCES architecture of status package inspection firewall and related LFB (Logic Functional Block), but also implements a prototype system and carries out tests and analysis. The experiment result testifies the feasibility of ForCES specification and provides the important technical parameter for the ForCES security application.
A Design of Firewall Based on Feedback of Intrusion Detection System in Cloud Environment

Xiaoyu Ma,Xiao Fu,Bin Luo,Xiaojiang Du,Mohsen Guizani

DOI: https://doi.org/10.1109/globecom38437.2019.9013771

2019-01-01

Abstract:Security is critical to cloud services, this paper introduces a design of firewall, which based on IDS's feedback t change rules in order to detect attack flexible. It combines firewall and Intrusion Detection Systems(IDS) by using Intrusion Detection Systems, which detects ICMP, TCP, UDP attacks. Usually, a cloud service is a service built on a virtual machine. The virtual device is virtualized to achieve the purpose of multiplexing. Therefore, if you want to implement cloud security detection, you can listen to the physical device's network card. There are two types of Intrusion Detection System, one is host-based intrusion detection system(HIDS) and another is network intrusion detection system(NIDS). What's more, in order to highlight the importance of the firewall, the IDS monitoring data is analyzed and added to the firewall's defense strategy automatically. Finally, we measure the effectiveness of the system by False Negative(FN) and False Positive(FP), and verify that feedback plays a crucial role in improving the effectiveness of the system, improving the efficiency of the entire system filtering attacks.
The Fire Wall Based on Linux

Xiaorong Gao

2003-01-01

Abstract:With the constant development of the application of computer network, the network security is more and more important. This paper discusses the key techniques of network security and shows how to build a firewall based on Linux. Besides, it gives prospects for the development of future firewall.
Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

Qiumei Cheng,Chunming Wu,Haifeng Zhou,Yuhang Zhang,Rui Wang,Wei Ruan

DOI: https://doi.org/10.1109/hpcc/smartcity/dss.2018.00149

2018-01-01

Abstract:Guarding the perimeter of cloud-based enterprise networks is a challenge due to massive traffic with dynamic nature. Current firewalls of enterprise networks in cloud are largely based on static security rule configuration or simple rule matching, which makes them inflexible, error-prone and poorly effective, bringing about severe security risks. In this paper, we propose an artificial intelligence-based software-defined networks firewall (AI-SDNF) for solving the above problems. Compared with existing SDN firewalls, AI-SDNF is able to extract and analyze the payload of data packets based on machine learning technologies rather than simply match with flow tables according to several header fields (e.g., source and destination IP/MAC addresses). Considering deciding whether a packet is benign or malicious is able to be formulated as a typical binary classification problem, we employ logistic regression for training an intelligent SDN firewall under supervised machine learning. We implement a prototype of AI-SDNF on the OpenDaylight controller and the OpenStack platform. Based on the prototype, we evaluate its performance and overheads with real dataset. The experimental results indicate that AI-SDNF achieves a relatively high detection accuracy of 96.79% with an average of 0.2ms latency.
Hybrid Intrusion Detection System for Complicated Network

Baojun Zhang,Xuezeng Pan,Jiebing Wang

DOI: https://doi.org/10.1109/fskd.2007.348

2007-01-01

Abstract:The current network is complicated due to the high- throughput and the multiformity of actions. A hybrid intru- sion detection system (HIDSFCN) is proposed in this study to satisfy the current network. It combines the advantages of all kinds of IDS and put forwards our own solvents to those key problems in current research. Experiment results demonstrate that our HIDSFCN is of high performance and good practicability.
Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

Qiang Wu,Ran Wang,Xincheng Yan,Chunming Wu,Rongxing Lu

DOI: https://doi.org/10.1109/MWC.001.2100251

IF: 12.777

2022-01-01

IEEE Wireless Communications

Abstract:Opening-up sharing has prompted the multi-tenancy architecture, whereby different vendors (including outsourcees) work together with network operators to form a vibrant service ecosystem, resulting in several advantages as well as risks. In particular, the static nature of existing architectures in network functions virtualization-based (NFV-based) clouds facilitate hacking. Thus, much attention has been focused on determining how to avoid the uncontrollable cloud security induced by complex production relations and non-trustworthy software/hardware sources when the two sets of security risks intersect. In this article, we investigate latent persistent threats against cloud environments and determine a high degree of complementarity and consistency between the NFV-based cloud environment and the dynamic defense concept. More specifically, new NFV-based cloud features provide an effective implementation for dynamic defense, while the generalized robustness of dynamic defense theory allows for high security gains. Intrinsic cloud security (iCS) is then proposed to align NFV-based clouds, mimicking defense and the moving target defense (MTD) paradigm to implement a seamless integration and symbiosis evolution between security and NFV-based clouds. We quantify the impact on system overhead to account for efficiency and cost issues. The simulation analysis demonstrates that the enhanced mode is able to consistently obtain a more beneficial and stable defense compared with the counterparts.
Intrusion Detection And Simulation For High-Speed Networks

Fei Yu,XiaoPing Dai,Yue Shen,Huang Huang,Miaoliang Zhu

DOI: https://doi.org/10.1109/ICSSSM.2005.1500110

2005-01-01

Abstract:The problem in network security presently is how to get real-time intrusion detection and alert. In the paper, we design Intrusion Detection System architecture and arithmetic again, meanwhile put forward an improved pattern matching arithmetic based on protocol analysis and theorization machine on Frete. New architecture can use network processor to collect and analyze data in network bottom, which enhance the speed and efficiency in Detection System.
Design and Implementation of Enterprise Network Security System Based on Firewall

Hui Yuan,Lei Zheng,Shuang Qiu,Xiangli Peng,Yuan Liang,Yaodong Hu,Guoru Deng

DOI: https://doi.org/10.1007/978-3-030-15235-2_142

2019-04-25

Abstract:With the rapid development of the network, in recent years, the Internet has greatly improved people’s lives, and the real-time, sharing and distance-removing characteristics of network information transmission have made the operation and management of enterprises more efficient and coordinated. The basis of refinement. At the same time, various network security incidents have followed, such as hacker attacks on computer network systems, and various types of viruses, Trojans and other active attacks emerge one after another. In this regard, this paper analyzes the enterprise network security system of firewall from the perspective of enterprise network security, briefly summarizes the background, advantages and disadvantages of firewall technology, and designs and implements a client software according to the actual needs of users. The network performs real-time intelligent security monitoring. After the system design is completed, the security is tested by building a simulation platform, including qualitative testing and quantitative testing, which are divided into security and performance to verify whether the system can achieve and guarantee performance.
EXAMINATION OF MODERN CONCEPTS FOR FIREWALLS AND COLLABORATIVE INTRUSION DETECTION

Andriy Luntovskyy,Mykhailo Klymash

DOI: https://doi.org/10.20535/2411-2976.22017.44-48

2017-12-28

Information and Telecommunication Sciences

Abstract:Background. Modern firewall systems are compared to classical concepts. The filtering rules are analyzed on the examples of the leading solutions (presented by Gartner Inc.). The collaborative intrusion detection systems and networks as well as the threats based on the insider attacks on CIDN are examined. A common CIDN functionality catalogue is discussed. The aspects of the application of modern systems of network intrusion detection and prevention by the peculiarities of their implementation at different levels are considered in accordance with the model of ISO/OSI. Brief recommendations on the use of known network security solutions in the construction of modern infocommunication networks to overcome various types of threats, in particular DoS type, virus and social engineering, are given. Objective. The aim of the paper is to study the implementation and application of modern concepts of firewalls and collaborative network intrusion detection systems. Methods. The research was carried out based on analysis of a large number of literary sources, the theory of building information security systems and avenues of manufacturers of systems for detecting and preventing network intrusion. Results. The advanced firewalls like SMLIF, IPS, the collaborative intrusion detection systems gain in importance increasingly nowadays. They can be also deployed within the scenarios of NFC and IoT (Internet of Things). The FW and IDS are often combined into individual participating peers (LAN, WLAN, 2G-4G, NFC and Bluetooth) with possibility of collaboration and better prevention of both external and insider attacks. Conclusions. The conducted research indicates the need to improve the implementation of modern network architecture with the use of integrated systems for detecting and counteracting network attacks. Despite the wide variety of network security solutions, this area of research remains relevant and suggests that the development of new concepts for protecting network architectures meets the current state of the industry, is timely and relevant, given the wide range of capabilities and scenarios for malicious intrusions and network system impacts. Keywords: firewall; network attacks; intrusion detection systems; intrusion prevention systems; CIDN.
Design and Implementation of a Firewall IPS Module

Xiang-dong QIAO,Tong YANG,Jing-wei ZHANG

DOI: https://doi.org/10.3969/j.issn.1009-3516.2007.04.018

2007-01-01

Abstract:Two different design schemes about firewall IPS module are brought up.In the first scheme snot-inline technique and the QUEUE action of netfilter are used to achieve dropping of attack data packet.In the second one,IPS about Denial of Service attack is achieved with the benefit of combination of synccokies,the new netfilter fuzzy match,PSD match,U32 match with an improvement on the firewall kernel.After comprehensive comparison,the module is developed according to the second scheme.The experiment shows that the designed module works well in defending main DOS attack.
Internet Firewall and its Linux Implementation

Huafeng Lü,Qiufeng Wu

DOI: https://doi.org/10.3321/j.issn:1002-8331.2001.08.015

2001-01-01

Abstract:This paper explains the basic theory of the Interbet firewall technology,introduces the architectures of several kinds of firewall,and gives out some firewall softwares under Linux operating system and their applications.
On the Implementation of a Firewall Based on Linux Platform

范训礼,景广军

DOI: https://doi.org/10.3969/j.issn.1000-2758.2002.03.011

2002-01-01

Xibei Gongye Daxue Xuebao/Journal of Northwestern Polytechnical University

Abstract:This paper presents a firewall system based on Linux - L-Firewall, which combines packet filter and proxy technology. Proxy and authentication are implemented on B1 level operating system. The paper emphasizes on the L-Firewall frame, especially on the implementation of packet filter module. L-Firewall provides not only HTTP, FTP proxy and packet filter, but also content filter, network address translation to protect network from IP spoofing and IP source route spoofing. L-Firewall tallies with GB/T17900-1999 and GB/T18020-1999.
IPSec-based Distributed Firewall Security Architecture

崔伟,齐竞艳,蔡圣闻,黄皓

DOI: https://doi.org/10.3969/j.issn.1000-3428.2004.16.051

2004-01-01

Abstract:The paper introduces the basic notion of distributed firewall, analyses the security threatens. Then it introduces IPSec protocols,and presents an IPSec-based distributed firewall security architecture including the internal design and external design.This architecture combines IPSec and some other secure measures with distribtued firewall so as to give distributed firewall stronger security.
Firewall Fingerprinting and Denial of Firewalling Attacks.

Alex X. Liu,Amir R. Khakpour,Joshua W. Hulst,Zihui Ge,Dan Pei,Jia Wang

DOI: https://doi.org/10.1109/TIFS.2017.2668602

2017-01-01

Abstract:Firewalls are critical security devices handling all traffic in and out of a network. Firewalls, like other software and hardware network devices, have vulnerabilities, which can be exploited by motivated attackers. However, just like any other networking and computing devices, firewalls often have vulnerabilities that can be exploited by attackers. In this paper, first, we investigate some possible firewall fingerprinting methods and surprisingly found that these methods can achieve quite high accuracy. Second, we study what we call denial of firewalling (DoF) attacks, where attackers use carefully crafted traffic to effectively overload a firewall. To the best of our knowledge, this paper represents the first study of firewall fingerprinting and DoF attacks.
Architecture Of A Identity Based Firewall System

Nenad Stojanovski,Marjan Gusev

DOI: https://doi.org/10.5121/ijnsa

2011-08-05

Abstract:Classic firewall systems are built to filter traffic based on IP addresses, source and destination ports and protocol types. The modern networks have grown to a level where the possibility for users' mobility is a must. In such networks, modern firewalls may introduce such complexity where administration can become very frustrating since it needs the intervention of a firewall administrator. The solution for this problem is an identity based firewall system. In this paper we will present a new design of a firewall system that uses the user's identity to filter the traffic. In the design phase we will define key points which have to be satisfied as a crucial milestone for the functioning of the whole Identity based firewall system.

Cryptography and Security
The research of firewall technology in computer network security

Wei Chen,Yantao Wang,Xin Yue

DOI: https://doi.org/10.1109/PACIIA.2009.5406566

2009-11-01

Abstract:This paper analyzes the computer network security features and the main threat, synthesis the firewall technology of current domestic and international, on the basis of various firewalls' principles, advantages and shortcomings. Through the synthesis and compare of various techniques, in-depth study of the main factors affection firewall performance, combined with the network status quo of Heilongjiang Provincial Center, this paper researches the firewall technology of the actual application in the computer network security, then refers the new technique called tight coupling firewall, finally the article leads to a lack of firewall technology and the direction of its development.

Computer Science
Comprehensive Security Framework: Integrating Intrusion Detection, Fire Safety, and Environmental Monitoring in Network Infrastructure

Amusa Afolarin,Omeje Raphael,Akewusola Misimi,Adelowo Opeyemi Joshua

DOI: https://doi.org/10.51584/ijrias.2024.904018

2024-01-01

International Journal of Research and Innovation in Applied Science

Abstract:Intrusion detection systems aim to capture security attacks & use analysers to determine details. Local wireless IDSs track all local wireless traffic and produce warnings based on signatures or abnormalities. Intrusion detection mechanisms can be configured to render unwanted access to the region easier. This paper aims to design a system to defend from intruders, human beings, through traditional surveillance devices, which cannot function in real-time, by utilising cameras fitted with infrared sensors. The aforementioned components comprise an interface program development system, intrusion detector sensors, wireless sensors, a programmable microcontroller, a controlled power supply device, Proteus relays, a GSM modem, and a cell phone. In reaction to adjustments in the atmosphere the controller activates a sensor to monitor and report input to the PIR’s wireless network. When the fire alarm device senses smoke, it can transmit a brief text message to the building’s owners. The system which uses an LM35 sensor to determine the temperature of food products, preventing fires from spreading throughout buildings without the tenants’ knowledge was produced. It is inexpensive, simple to install, and applicable to a variety of locations, including hotels, warehouses, and the automotive industry. This research study incorporates comprehensive tactics for monitoring environmental elements and fire safety, going beyond traditional intrusion detection methodologies. In doing so, this study offers a comprehensive strategy for protecting network infrastructures against various threats. The goal of integrating these essential components is to offer a more complete and reliable security solution.
Firewall fingerprinting

Amir R. Khakpour,Joshua W. Hulst,Zihui Ge,Alex X. Liu,Dan Pei,Jia Wang

DOI: https://doi.org/10.1109/INFCOM.2012.6195544

2012-01-01

Abstract:Firewalls are critical security devices handling all traffic in and out of a network. Firewalls, like other software and hardware network devices, have vulnerabilities, which can be exploited by motivated attackers. However, because firewalls are usually placed in the network such that they are transparent to the end users, it is very hard to identify them and use their corresponding vulnerabilities to attack them. In this paper, we study firewall fingerprinting, in which one can use firewall decisions on TCP packets with unusual flags and machine learning techniques for inferring firewall implementation.

Design for Firewall Integrating with Intrusion Detection

A Reference Model And System Architecture For Database Firewall

Research And Design Of Nids Based On Linux Firewall

ForCES-Based Firewall with Stateful Packet Inspection

A Design of Firewall Based on Feedback of Intrusion Detection System in Cloud Environment

The Fire Wall Based on Linux

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

Hybrid Intrusion Detection System for Complicated Network

Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

Intrusion Detection And Simulation For High-Speed Networks

Design and Implementation of Enterprise Network Security System Based on Firewall

EXAMINATION OF MODERN CONCEPTS FOR FIREWALLS AND COLLABORATIVE INTRUSION DETECTION

Design and Implementation of a Firewall IPS Module

Internet Firewall and its Linux Implementation

On the Implementation of a Firewall Based on Linux Platform

IPSec-based Distributed Firewall Security Architecture

Firewall Fingerprinting and Denial of Firewalling Attacks.

Architecture Of A Identity Based Firewall System

The research of firewall technology in computer network security

Comprehensive Security Framework: Integrating Intrusion Detection, Fire Safety, and Environmental Monitoring in Network Infrastructure

Firewall fingerprinting