A Formal Approach To Firewalls Testing Techniques

Alexander Barabanov,Alexey Markov,Valentin Tsirlov

DOI: https://doi.org/10.48550/arXiv.1306.1953

2013-06-08

Cryptography and Security

Abstract:Traditional technologies of firewall testing are overlooked. A new formalized approach is presented. Recommendations on optimization of test procedures are given.

What problem does this paper attempt to address?

A Reference Model And System Architecture For Database Firewall

L Cai,Xh Yang

DOI: https://doi.org/10.1109/ICSMC.2005.1571196

2005-01-01

Abstract:More and more network attacks are focusing on application level vulnerabilities. Recently, several examples of this trend have been highly publicized such as the SQL Slammer and SQL Snake attacks. Traditional firewalls, used for protecting the database, only prevent attacks searching for vulnerabilities. Database firewalls take defense deep into the organization by providing full syntax control and audit of the SQL AN stream before it reaches the database, and enforcing content-driven access to database. This paper proposes a layered reference model for database firewalls by enhancing the capability of COAST Laboratory's model. It separates a database firewall into three layers (network layer, schematic layer and semantic layer) according to the knowledge, computation target, and the control granularity of each layer. Based on this model, a database firewall product had been prototyped It can greatly improve the database security by introducing self-controlled authentication principal mapping, object mapping, and mandatory access control modules.
Systematic Structural Testing of Firewall Policies

JeeHyun Hwang,Tao Xie,Fei Chen,Alex X. Liu

DOI: https://doi.org/10.1109/srds.2008.34

2012-01-01

IEEE Transactions on Network and Service Management

Abstract:Firewalls are the mainstay of enterprise security and the most widely adopted technology for protecting private networks. As the quality of protection provided by a firewall directly depends on the quality of its policy (i.e., configuration), ensuring the correctness of firewall policies is important and yet difficult. To help ensure the correctness, we propose a systematic structural testing approach for firewall policies. We define structural coverage (based on coverage criteria of rules, predicates, and clauses) on the firewall policy under test. To achieve high structural coverage effectively, we have developed four automated packet generation techniques: the random packet generation, the one based on local constraint solving (considering individual rules locally in a policy), the one based on global constraint solving (considering multiple rules globally in a policy), and the one based on boundary values.We have conducted an experiment on a set of real policies and a set of faulty policies to detect faults with generated packet sets. Generally, our experimental results show that a packet set with higher structural coverage has higher fault-detection capability (i.e., detecting more injected faults). Our experimental results show that a reduced packet set (maintaining the same level of structural coverage with the corresponding original packet set) maintains similar fault-detection capability with the original set.
Formal Checking of Multiple Firewalls

Nihel Ben Youssef Ben Souayeh,Adel Bouhoula

DOI: https://doi.org/10.48550/arXiv.1207.3691

2012-07-16

Abstract:When enterprises deploy multiple firewalls, a packet may be examined by different sets of firewalls. It has been observed that the resulting complex firewall network is highly error prone and causes serious security holes. Hence, automated solutions are needed in order to check its correctness. In this paper, we propose a formal and automatic method for checking whether multiple firewalls react correctly with respect to a security policy given in a high level declarative language. When errors are detected, some useful feedback is returned in order to correct the firewall configurations. Furthermore, we propose a priority-based approach to ensure that no incoherencies exist within the security policy. We show that our method is both correct and complete. Finally, it has been implemented in a prototype of verifier based on a satisfiability solver modulo theories. Experiment conducted on relevant case studies demonstrates the efficiency of our approach.

Cryptography and Security
Automated firewall configuration in virtual networks

Daniele Bringhenti,Guido Marchetto,Riccardo Sisto,Fulvio Valenza,Jalolliddin Yusupov

DOI: https://doi.org/10.1109/tdsc.2022.3160293

2022-01-01

IEEE Transactions on Dependable and Secure Computing

Abstract:The configuration of security functions in computer networks is still typically performed manually, which likely leads to security breaches and long re-configuration times. This problem is exacerbated for modern networks based on network virtualization, because their complexity and dynamics make a correct manual configuration practically unfeasible. This article focuses on packet filters, i.e., the most common firewall technology used in computer networks, and it proposes a new methodology to automatically define the allocation scheme and configuration of packet filters in the logical topology of a virtual network. The proposed method is based on solving a carefully designed partial weighted Maximum Satisfiability Modulo Theories problem by means of a state-of-the-art solver. This approach formally guarantees the correctness of the solution, i.e., that all security requirements are satisfied, and it minimizes the number of needed firewalls and firewall rules. This methodology is extensively evaluated using different metrics and tests on both synthetic and real use cases, and compared to the state-of-the-art solutions, showing its superiority.

computer science, information systems, software engineering, hardware & architecture
Autonomous Attack Mitigation Through Firewall Reconfiguration

Daniele Bringhenti,Francesco Pizzato,Riccardo Sisto,Fulvio Valenza

DOI: https://doi.org/10.1002/nem.2307

2024-10-22

International Journal of Network Management

Abstract:This graphical abstract shows the workflow of the proposed approach for autonomous attack mitigation through firewall reconfiguration. Packet filtering firewalls represent a main defense line against cyber attacks that target computer networks daily. However, the traditional manual approaches for their configuration are no longer applicable to next‐generation networks, which have become much more complex after the introduction of virtualization paradigms. Some automatic strategies have been investigated in the literature to change that old‐fashioned configuration approach, but they are not fully autonomous and still require several human interventions. In order to overcome these limitations, this paper proposes an autonomous approach for firewall reconfiguration where all steps are automated, from the derivation of the security requirements coming from the logs of IDSs to the deployment of the automatically computed configurations. A core component of this process is React‐VEREFOO, which models the firewall reconfiguration problem as a Maximum Satisfiability Modulo Theories problem, allowing the combination of full automation, formal verification, and optimization in a single technique. An implementation of this proposal has undergone experimental validation to show its effectiveness and performance.

computer science, information systems,telecommunications
The Formal Metabasis For Conformity Assessment of Information Security Software and Hardware

Alexander Barabanov,Maxim Grishin,Alexey Markov

DOI: https://doi.org/10.48550/arXiv.1306.1955

2013-06-08

Cryptography and Security

Abstract:An approach to the development of security test procedures for information security controls is presented. The recommendations for optimizing the test procedure are obtained
ForestFirewalls: Getting Firewall Configuration Right in Critical Networks (Technical Report)

Dinesha Ranathunga,Matthew Roughan,Paul Tune,Phil Kernick,Nick Falkner

DOI: https://doi.org/10.48550/arXiv.1902.05689

2019-02-15

Abstract:Firewall configuration is critical, yet often conducted manually with inevitable errors, leaving networks vulnerable to cyber attack [40]. The impact of misconfigured firewalls can be catastrophic in Supervisory Control and Data Acquisition (SCADA) networks. These networks control the distributed assets of industrial systems such as power generation and water distribution systems. Automation can make designing firewall configurations less tedious and their deployment more reliable. In this paper, we propose ForestFirewalls, a high-level approach to configuring SCADA firewalls. Our goals are three-fold. We aim to: first, decouple implementation details from security policy design by abstracting the former; second, simplify policy design; and third, provide automated checks, pre and post-deployment, to guarantee configuration accuracy. We achieve these goals by automating the implementation of a policy to a network and by auto-validating each stage of the configuration process. We test our approach on a real SCADA network to demonstrate its effectiveness.

Cryptography and Security
Firewall Fingerprinting and Denial of Firewalling Attacks.

Alex X. Liu,Amir R. Khakpour,Joshua W. Hulst,Zihui Ge,Dan Pei,Jia Wang

DOI: https://doi.org/10.1109/TIFS.2017.2668602

2017-01-01

Abstract:Firewalls are critical security devices handling all traffic in and out of a network. Firewalls, like other software and hardware network devices, have vulnerabilities, which can be exploited by motivated attackers. However, just like any other networking and computing devices, firewalls often have vulnerabilities that can be exploited by attackers. In this paper, first, we investigate some possible firewall fingerprinting methods and surprisingly found that these methods can achieve quite high accuracy. Second, we study what we call denial of firewalling (DoF) attacks, where attackers use carefully crafted traffic to effectively overload a firewall. To the best of our knowledge, this paper represents the first study of firewall fingerprinting and DoF attacks.
Fault Localization for Firewall Policies.

JeeHyun Hwang,Tao Xie,Fei Chen,Alex X. Liu

DOI: https://doi.org/10.1109/srds.2009.38

2009-01-01

Abstract:Firewalls are the mainstay of enterprise security and the most widely adopted technology for protecting private networks. Ensuring the correctness of firewall policies through testing is important. In firewall policy testing, test inputs are packets and test outputs are decisions. Packets with unexpected (expected) evaluated decisions are classified as failed (passed) tests. Given failed tests together with passed tests, policy testers need to debug the policy to detect fault locations (such as faulty rules). Such a process is often time-consuming.To help reduce effort on detecting fault locations, we propose an approach to reduce the number of rules for inspection based on information collected during evaluating failed tests. Our approach ranks the reduced rules to decide which rules should be inspected first. We performed experiments on applying our approach. The empirical results show that our approach can reduce 56% of rules that are required for inspection in fault localization.
Firewall fingerprinting

Amir R. Khakpour,Joshua W. Hulst,Zihui Ge,Alex X. Liu,Dan Pei,Jia Wang

DOI: https://doi.org/10.1109/INFCOM.2012.6195544

2012-01-01

Abstract:Firewalls are critical security devices handling all traffic in and out of a network. Firewalls, like other software and hardware network devices, have vulnerabilities, which can be exploited by motivated attackers. However, because firewalls are usually placed in the network such that they are transparent to the end users, it is very hard to identify them and use their corresponding vulnerabilities to attack them. In this paper, we study firewall fingerprinting, in which one can use firewall decisions on TCP packets with unusual flags and machine learning techniques for inferring firewall implementation.
EXAMINATION OF MODERN CONCEPTS FOR FIREWALLS AND COLLABORATIVE INTRUSION DETECTION

Andriy Luntovskyy,Mykhailo Klymash

DOI: https://doi.org/10.20535/2411-2976.22017.44-48

2017-12-28

Information and Telecommunication Sciences

Abstract:Background. Modern firewall systems are compared to classical concepts. The filtering rules are analyzed on the examples of the leading solutions (presented by Gartner Inc.). The collaborative intrusion detection systems and networks as well as the threats based on the insider attacks on CIDN are examined. A common CIDN functionality catalogue is discussed. The aspects of the application of modern systems of network intrusion detection and prevention by the peculiarities of their implementation at different levels are considered in accordance with the model of ISO/OSI. Brief recommendations on the use of known network security solutions in the construction of modern infocommunication networks to overcome various types of threats, in particular DoS type, virus and social engineering, are given. Objective. The aim of the paper is to study the implementation and application of modern concepts of firewalls and collaborative network intrusion detection systems. Methods. The research was carried out based on analysis of a large number of literary sources, the theory of building information security systems and avenues of manufacturers of systems for detecting and preventing network intrusion. Results. The advanced firewalls like SMLIF, IPS, the collaborative intrusion detection systems gain in importance increasingly nowadays. They can be also deployed within the scenarios of NFC and IoT (Internet of Things). The FW and IDS are often combined into individual participating peers (LAN, WLAN, 2G-4G, NFC and Bluetooth) with possibility of collaboration and better prevention of both external and insider attacks. Conclusions. The conducted research indicates the need to improve the implementation of modern network architecture with the use of integrated systems for detecting and counteracting network attacks. Despite the wide variety of network security solutions, this area of research remains relevant and suggests that the development of new concepts for protecting network architectures meets the current state of the industry, is timely and relevant, given the wide range of capabilities and scenarios for malicious intrusions and network system impacts. Keywords: firewall; network attacks; intrusion detection systems; intrusion prevention systems; CIDN.
Denial of Firewalling

Amir R. Khakpour,Joshua W. Hulst,Zhihui Ge,Alex X. Liu,Dan Pei,Jia Wang

2011-01-01

Abstract:Firewalls are critical security devices handling all traffic in and out of a network. When under heavy load of both malicious and legitimate traffic, firewalls may be overloaded and start discarding or permitting packets without checking firewall rules, which can cause huge revenue losses or security breaches. In this paper, we study Denial of Firewalling attacks, where attackers use well-crafted traffic to effectively overwhelm a firewall. We first investigate firewall implementation characteristics that can be exploited for such attacks while treating the firewall as a black box. We conducted our studies on a testbed with three popular firewall devices. Second, given a remote firewall, we propose methods for attackers to infer the implementation of the firewall. We develop firewall fingerprinting techniques based on firewall decisions on a sequence of TCP packets with unusual flags and machine learning techniques for inferring firewall implementation. Finally, we present methods that attackers can use to generate the traffic that can effectively overload an identified remote firewall. We show that some firewalls can be easily overloaded by a small volume of carefully crafted traffic.
The Fire Wall Based on Linux

Xiaorong Gao

2003-01-01

Abstract:With the constant development of the application of computer network, the network security is more and more important. This paper discusses the key techniques of network security and shows how to build a firewall based on Linux. Besides, it gives prospects for the development of future firewall.
A new formal test method for networked software integration testing

Shuai Wang,Yindong Ji,Wei Dong,Shiyuan Yang

DOI: https://doi.org/10.1007/978-3-642-12165-4_37

2010-01-01

Abstract:This paper considers the integration testing for networked software that is built by assembling several distributed components in an interoperable manner. Using the traditional single automata-based test approaches, we suffer from the state combinatorial explosion problem. Moreover, several generated test cases may not be executable. This paper proposed a test method based on the automata net which is the extension of communication automata. The state/transition path (S/T-Path) is defined to describe the execution of the software under test. The test cases are constructed through combining the atomic S/T-Paths and all executable. The test cases are calculated from the local transition structures and the interaction procedure between components, so the state combinatorial explosion problem will not be encountered. The generation of test cases for certain software and the benefits for the problems are discussed. Results show that our method has better properties.
Applying Formal Methods to Networking: Theory, Techniques and Applications

Junaid Qadir,Osman Hasan

DOI: https://doi.org/10.1109/COMST.2014.2345792

2013-11-18

Abstract:Despite its great importance, modern network infrastructure is remarkable for the lack of rigor in its engineering. The Internet which began as a research experiment was never designed to handle the users and applications it hosts today. The lack of formalization of the Internet architecture meant limited abstractions and modularity, especially for the control and management planes, thus requiring for every new need a new protocol built from scratch. This led to an unwieldy ossified Internet architecture resistant to any attempts at formal verification, and an Internet culture where expediency and pragmatism are favored over formal correctness. Fortunately, recent work in the space of clean slate Internet design---especially, the software defined networking (SDN) paradigm---offers the Internet community another chance to develop the right kind of architecture and abstractions. This has also led to a great resurgence in interest of applying formal methods to specification, verification, and synthesis of networking protocols and applications. In this paper, we present a self-contained tutorial of the formidable amount of work that has been done in formal methods, and present a survey of its applications to networking.

Networking and Internet Architecture,Software Engineering
A Formal Approach for Passive Testing of Protocol Data Portions

D Lee,DL Chen,RB Hao,RE Miller,JP Wu,X Yin

DOI: https://doi.org/10.1109/icnp.2002.1181393

2002-01-01

Abstract:Passive testing is a process of detecting faults in a system under test by passively observing its input/output behaviors only without interrupting its normal operations, and proves to be a promising technique for network fault management. We study passive testing of data portions of network protocols and present two algorithms, using an Event-driven Extended Finite State Machine model. Experimental results on the Internet routing protocol OSPF are reported.
A Survey on Network Verification and Testing With Formal Methods: Approaches and Challenges

Yahui Li,Xia Yin,Zhiliang Wang,Jiangyuan Yao,Xingang Shi,Jianping Wu,Han Zhang,Qing Wang

DOI: https://doi.org/10.1109/COMST.2018.2868050

IF: 35.6

2019-01-01

IEEE Communications Surveys & Tutorials

Abstract:Networks have grown increasingly complicated. Violations of intended policies can compromise network availability and network reliability. Network operators need to ensure that their policies are correctly implemented. This has inspired a research field, network verification and testing, that enables users to automatically detect bugs and systematically reason their network. Furthermore, techniques ranging from formal modeling to verification and testing have been applied to help operators build reliable systems in electronic design automation and software. Inspired by its success, network verification has recently seen increased attention in the academic and industrial communities. As an area of current interest, it is an interdisciplinary subject (with fields including formal methods, mathematical logic, programming languages, and networks), making it daunting for a nonprofessional. We perform a comprehensive survey on well-developed methodologies and tools for data plane verification, control plane verification, data plane testing and control plane testing. This survey also provides lessons gained from existing solutions and a perspective of future research developments.
Verified iptables Firewall Analysis and Verification

Cornelius Diekmann,Lars Hupel,Julius Michaelis,Maximilian Haslbeck,Georg Carle

DOI: https://doi.org/10.1007/s10817-017-9445-1

2018-01-03

Journal of Automated Reasoning

Abstract:This article summarizes our efforts around the formally verified static analysis of iptables rulesets using Isabelle/HOL. We build our work around a formal semantics of the behavior of iptables firewalls. This semantics is tailored to the specifics of the filter table and supports arbitrary match expressions, even new ones that may be added in the future. Around that, we organize a set of simplification procedures and their correctness proofs: we include procedures that can unfold calls to user-defined chains, simplify match expressions, and construct approximations removing unknown or unwanted match expressions. For analysis purposes, we describe a simplified model of firewalls that only supports a single list of rules with limited expressiveness. We provide and verify procedures that translate from the complex iptables language into this simple model. Based on that, we implement the verified generation of IP space partitions and minimal service matrices. An evaluation of our work on a large set of real-world firewall rulesets shows that our framework provides interesting results in many situations, and can both help and out-compete other static analysis frameworks found in related work.

computer science, artificial intelligence
First Step Towards Automatic Correction of Firewall Policy Faults

Fei Chen,Alex X. Liu,Jeehyun Hwang,Tao Xie

DOI: https://doi.org/10.1145/2240166.2240177

2010-01-01

Abstract:Firewalls are critical components of network security and have been widely deployed for protecting private networks. A firewall determines whether to accept or discard a packet that passes through it based on its policy. However, most real-life firewalls have been plagued with policy faults, which either allow malicious traffic or block legitimate traffic. Due to the complexity of firewall policies, manually locating the faults of a firewall policy and further correcting them are difficult. Automatically correcting the faults of a firewall policy is an important and challenging problem. In this article, we first propose a fault model for firewall policies including five types of faults. For each type of fault, we present an automatic correction technique. Second, we propose the first systematic approach that employs these five techniques to automatically correct all or part of the misclassified packets of a faulty firewall policy. Third, we conducted extensive experiments to evaluate the effectiveness of our approach. Experimental results show that our approach is effective to correct a faulty firewall policy with three of these types of faults.
Architecture Of A Identity Based Firewall System

Nenad Stojanovski,Marjan Gusev

DOI: https://doi.org/10.5121/ijnsa

2011-08-05

Abstract:Classic firewall systems are built to filter traffic based on IP addresses, source and destination ports and protocol types. The modern networks have grown to a level where the possibility for users' mobility is a must. In such networks, modern firewalls may introduce such complexity where administration can become very frustrating since it needs the intervention of a firewall administrator. The solution for this problem is an identity based firewall system. In this paper we will present a new design of a firewall system that uses the user's identity to filter the traffic. In the design phase we will define key points which have to be satisfied as a crucial milestone for the functioning of the whole Identity based firewall system.

Cryptography and Security

A Formal Approach To Firewalls Testing Techniques

A Reference Model And System Architecture For Database Firewall

Systematic Structural Testing of Firewall Policies

Formal Checking of Multiple Firewalls

Automated firewall configuration in virtual networks

Autonomous Attack Mitigation Through Firewall Reconfiguration

The Formal Metabasis For Conformity Assessment of Information Security Software and Hardware

ForestFirewalls: Getting Firewall Configuration Right in Critical Networks (Technical Report)

Firewall Fingerprinting and Denial of Firewalling Attacks.

Fault Localization for Firewall Policies.

Firewall fingerprinting

EXAMINATION OF MODERN CONCEPTS FOR FIREWALLS AND COLLABORATIVE INTRUSION DETECTION

Denial of Firewalling

The Fire Wall Based on Linux

A new formal test method for networked software integration testing

Applying Formal Methods to Networking: Theory, Techniques and Applications

A Formal Approach for Passive Testing of Protocol Data Portions

A Survey on Network Verification and Testing With Formal Methods: Approaches and Challenges

Verified iptables Firewall Analysis and Verification

First Step Towards Automatic Correction of Firewall Policy Faults

Architecture Of A Identity Based Firewall System