A Theoretical Model for Analysis of Firewalls Under Bursty Traffic Flows

Abstract

Firewalls are located at the front line of the network against outside threats. Performance modeling and analysis of network firewalls help to better understand their behavior and characteristics. Moreover, having an analytical model in hand helps firewall designers avoid developing multiple design alternatives and thus considerably reduce the design costs. Moreover, the network administrators can proactively identify the performance bottlenecks of the network and fix them before any malicious attack which targets the network or the firewall itself. In this paper, we propose a novel analytical approach for performance modeling and analysis of network firewalls based on a discrete-time queuing system in which the bursty nature of the incoming traffic is taken into account, where traditional queuing models such as M /M /1 model fails to capture peculiar characteristics of the Internet traffic. Throughput, packet loss, delay, and firewalls CPU utilization are employed as performance evaluation indicators in our proposed model. In addition, we introduce a potential DoS attack with a very low rate which can be launched against firewalls with different burstiness factors.INDEX TERMS Network firewalls, performance modeling, discrete-time queuing system, three dimensional Markov chain, burstiness factor, DoS attack.

Evaluación del rendimiento de cortafuegos basados en software libre

“…La evaluación de los firewalls se realizó mediante el método experimental en un entorno con tráfico de red simulado y se utilizaron métricas como el ancho de banda, el jitter y la tasa de pérdida de paquetes de red. La metodología y los indicadores mencionados son ampliamente utilizados en la literatura científica para evaluar el desempeño de los cortafuegos (Iriarte et al, 2018;Cheminod, Durante, Seno & Valenzano, 2018;Shahsavari et al, 2019). Estos indicadores fueron analizados mediante la herramienta iPerf3.…”

“…Agbenyegah & Asante (2017) y Konikiewicz & Markowski (2017) reportaron que los firewalls inciden de forma negativa en el rendimiento de las redes donde son implementados. El rendimiento de las redes de datos influye significativamente en la disponibilidad de los recursos digitales de las organizaciones (Shahsavari, Shahhoseini, Zhang, & Elbiaze, 2019).…”

“…En la literatura se identificaron diversas investigaciones donde se analizó el desempeño de firewalls basados en software libre en diferentes entornos simulados. Los autores Shahsavari et al (2019) plantean que el uso de las simulaciones como metodología experimental para modelar y analizar el desempeño de firewalls de red permite alcanzar una comprensión más profunda de su dinámica y comportamiento; además, posibilita identificar parámetros óptimos para la asignación de recursos en aras de mejorar el rendimiento general de la red. Los autores Arunwan, Laong & Atthayuwat (2016) compararon la capacidad de Endian y pfSense para detectar ataques de fuerza bruta, escaneo de puertos, ping de la muerte e inundación de tráfico de red.…”

Multiservice Loss Models in C-RAN Supporting Compound Poisson Traffic

“…In this paper, we extend the MC-SC and MC-MC models to include the significant (in terms of network dimensioning) scenario of having RRHs that are responsible for serving compound Poisson traffic. The idea of studying multiservice batch arrivals relies on the fact that such arrivals may well approximate the case of multiservice bursty traffic [30,[52][53][54][55][56][57][58]. The proposed models are named herein compound Poisson multi-class single-cluster (c-MC-SC) and compound Poisson multi-class multi-cluster (c-MC-MC), respectively.…”

Arterial Control Against Lane Occupancy Accidents Based on Discrete Traffic Flow Model

“…Two general control strategies can be used for the unsaturated case: one is green wave control that aims to maximize the time during which vehicles can drive the entire length of the artery without stopping [11], and the other is model control based on objective function [12]. MAXBAND [13] was proposed by Little et al to coordinate the green times of each phases based on a two-direction green wave bandwidth maximization model.…”