Dynamic traffic awareness statistical model for firewall performance enhancement

Trabelsi, Zouheir; Zhang, Liren; Zeidan, Safaa; Ghoudi, Kilani

doi:10.1016/j.cose.2013.07.001

Cited by 11 publications

(7 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The majority of research work that exists in the literature attempt to improve the overall firewall performance by proposing techniques to eliminate or minimize DoF attacks targeting firewall's filtering rules. These can be classified into the following categories: Firewall's Rule/rulefield reordering techniques [16]- [19], Early packet rejection techniques [20]- [23], and Tree-based decision techniques with dynamic behavior [24]- [27].…”

Section: Related Workmentioning

confidence: 99%

Thwarting ICMP Low-Rate Attacks Against Firewalls While Minimizing Legitimate Traffic Loss

et al. 2020

Self Cite

View full text Add to dashboard Cite

Low-rate distributed denial of service (LDDoS) attacks pose more challenging threats that disrupt network security devices and services. Such type of attacks is difficult to detect and mitigate. In LDDoS attacks, attacker uses low-volume of malicious traffic that looks alike legitimate traffic. Thus, it can enter the network in silence without any notice. However, it may have severe effect on disrupting network services, depleting system resources, and degrading network speed to a point considering them as one of the most damaging attack types. There are many types of LDDoS such as application server and ICMP error messages based LDDoS. This paper is solely concerned with the ICMP error messages based LDDoS. The paper proposes a mechanism to mitigate low-rate ICMP error message attacks targeting security devices, such as firewalls. The mechanism is based on triggering a rejection rule to defend against corresponding detected attack as early as possible, in order to preserve firewall resources. The rejection rule has certain adaptive activity time, during which the rule continues to reject related low-rate attack packets. This activity time is dynamically predicted for the next rule activation period according to current and previous attack severity and statistical parameters. However, the rule activity time needs to be stabilized in a manner in order to prevent any additional overhead to the system as well as to prevent incremental loss of corresponding legitimate packets. Experimental results demonstrate that the proposed mechanism can efficiently defend against incremental evasion cycle of low-rate attacks, and monitor rejection rule activity duration to minimize legitimate traffic loss. INDEX TERMS Low-rate attacks, BlackNurse attack, Stateful firewall, session table, attack probabilistic modeling.

show abstract

Section: Related Workmentioning

confidence: 99%

Thwarting ICMP Low-Rate Attacks Against Firewalls While Minimizing Legitimate Traffic Loss

et al. 2020

Self Cite

View full text Add to dashboard Cite

show abstract

“…The idea of packet filtering optimisation through early packet rejection and acceptance is introduced in [8–13]. In [8, 9], the proposed field value set cover (FVSC) technique builds a number of rejection rules that are examined before normal filtering.…”

Section: Background and Related Workmentioning

confidence: 99%

“…Thus, policy Boolean expression relaxation (PBER) technique in [10] is introduced, where binary decision diagrams is used to implement the Boolean expression of the policy acceptance space. In our previous works [11–13], we introduced the idea of early rejection through optimising the order of the rule‐fields. At the end of each traffic window, histogram statistics are collected for packet matching rules and packet not matching rule‐fields.…”

Section: Background and Related Workmentioning

confidence: 99%

“…These histograms are utilised to effectively monitor the firewall performance in real‐time and to predict the patterns of rule and rule‐fields that best suit the next traffic window. To reduce the overhead of updating the security policy structure at the end of each traffic window, we proposed the stability test in [13], where the filtering rules and rule‐fields orders are updated only if a certain threshold is reached, while maintaining the minimal filtering cost using the optimal traffic window size.…”

Section: Background and Related Workmentioning

confidence: 99%

“…This is because unwanted traffic may traverse a long path before being rejected by the default rule. It has been proven in [8, 9, 12, 13] that rejection of such unwanted traffic as early as possible would considerably speed up the filtering process. Thus, if the corresponding packet value does not match the node with minimum length in ST k , it will be rejected early by at most two memory accesses (i.e.…”

Section: Proposed Hybrid Mechanism For Utm Filtering Architecturementioning

confidence: 99%

See 2 more Smart Citations

Hybrid mechanism towards network packet early acceptance and rejection for unified threat management

Trabelsi

Zeidan

Masud

2017

IET Information Security

Self Cite

View full text Add to dashboard Cite

Artificial Intelligence Agents as Mediators of Trustless Security Systems and Distributed Computing Applications

Walker-Roberts

Hammoudeh

2018

Computer Communications and Networks

View full text Add to dashboard Cite

Dynamic traffic awareness statistical model for firewall performance enhancement

Cited by 11 publications

References 26 publications

Thwarting ICMP Low-Rate Attacks Against Firewalls While Minimizing Legitimate Traffic Loss

Thwarting ICMP Low-Rate Attacks Against Firewalls While Minimizing Legitimate Traffic Loss

Hybrid mechanism towards network packet early acceptance and rejection for unified threat management

Artificial Intelligence Agents as Mediators of Trustless Security Systems and Distributed Computing Applications

Contact Info

Product

Resources

About