An intrusion-tolerant firewall design for protecting SIEM systems

Abstract

Abstract-Nowadays, organizations are resorting to Security Information and Event Management (SIEM) systems to monitor and manage their network infrastructures. SIEMs employ a data collection capability based on many sensors placed in critical points of the network, which forwards events to a core facility for processing and support different forms of analysis (e.g., report attacks in near real time, inventory management, risk assessment). In this paper, we will focus on the defense of the core facility components by presenting a new firewall design that is resilient to very harsh failure scenarios. In particular, it tolerates not only external attacks but also the intrusion of some of its components. The firewall employs a two level filtering scheme to increase performance and to allow for some flexibility on the selection of fault-tolerance mechanisms. The first filtering stage efficiently eliminates the most common forms of attacks, while the second stage supports application rules for a more sophisticated analysis of the traffic. The fault tolerance mechanisms are based on a detection and recovery approach for the first stage, while the second stage uses state machine replication and voting.

PriLok: Citizen-protecting distributed epidemic tracing

“…Such complex processing engines already exist as a research prototypes, i.e. Massif project [21,22,8], but also reached maturity level where they have been adopted by industry and deployed in production, including BeepBeep-3 [5], Apache Flink and Storm [3], SQLstream [36].…”

Towards intrusion-resilient security monitoring in multi-cloud infrastructures

“…Making security services intrusion tolerant has also been the subject of previous publications, mostly focussing on rewalls. Garcia et al propose such intrusion tolerant rewall for protecting SIEM systems [6]. Sousa et al [12] propose a self-healing intrusion tolerant rewall architecture for protecting critical infrastructures.…”

The Bedrock of Byzantine Fault Tolerance: A Unified Platform for BFT Protocol Design and Implementation

“…Fault-tolerant protocols have been extensively used by distributed systems to provide robustness and high availability [42,55,61,82,94,131,180]. While cloud systems, such as Google's Spanner [82], Amazon's Dynamo [94], and Facebook's Tao [61], rely on crash fault-tolerant protocols, e.g., Paxos [149], to establish consensus, a Byzantine fault-tolerant (BFT) protocol is a key ingredient in distributed systems with non-trustworthy infrastructures, e.g., permissioned blockchains [1- 3, 24, 26, 28-30, 32, 44, 78, 115-117, 124, 147, 196, 203, 206] and even permissionless blockchains [62,139,141,167,230], distributed file systems [13,70,80], locking service [81], firewalls [53,111,112,202,213,228], certificate authority systems [234], SCADA systems [40,138,188,233], key-value datastores [51,98,114,127,202], and key management [170].…”