Improved Session Table Architecture for Denial of Stateful Firewall Attacks

Trabelsi, Zouheir; Zeidan, Safaa; Shuaib, Khaled

doi:10.1109/access.2018.2850345

Cited by 13 publications

(4 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A stateful session table design for a splay tree rewall is presented by Trabelsi et al in [12]. A splay tree rewall group hash tables by pre x length with a set of pre x length-designated splay trees to manage rewall rules.…”

Section: Tree Rule Firewallmentioning

confidence: 99%

Modified Tree Rule Firewall for Removing Redundant and Shadowing Rules in Cloud Firewall Policy

Hakani

Mann

2023

Preprint

View full text Add to dashboard Cite

Most private networks are secured by firewalls, which are crucial for safety. A firewall aims to inspect each incoming and outgoing packet before deciding whether to allow it. Among conventional firewalls, rule-based ones are the most frequently used. However, traditional Listed-Rule firewalls have limits when it comes to task performance and is ineffective when used with some networks that have very large firewall rule sets. This paper suggests a model firewall design, "Tree-Rule Firewall," which has advantages and works with expansive networks like "cloud". This paper proposes a modified tree rule firewall (MTRFcloud) for removing redundant and shadowing rules, improving cloud network security. This work first generates a tree rule firewall for the corresponding firewall policy. The suggested modified tree rule firewall does not produce redundant rules and efficiently finds the shadow rules. Then, a modified Tree-Rule firewall that manages firewall rules was tested in a cloud setting. It is shown that the updated Tree-Rule firewall provides faster processing and greater network security. With a big network, like a cloud network, the modified Tree-Rule firewall is simpler to construct and efficiently removes the redundant and shadow rules.

show abstract

Section: Tree Rule Firewallmentioning

confidence: 99%

Modified Tree Rule Firewall for Removing Redundant and Shadowing Rules in Cloud Firewall Policy

Hakani

Mann

2023

Preprint

View full text Add to dashboard Cite

show abstract

“…e firewall refers to a security gateway that protects the computer networks from malicious intrusions [60][61][62]. ere are many kinds of firewall productions in the market, which have different advantages and disadvantages.…”

Section: Case Study: E Selection Of Firewall Productionsmentioning

confidence: 99%

TOPSIS Method Based on Correlation Coefficient and Entropy Measure for Linguistic Pythagorean Fuzzy Sets and Its Application to Multiple Attribute Decision Making

2019

View full text Add to dashboard Cite

The linguistic Pythagorean fuzzy set (LPFS) is an important implement for modeling the uncertain and imprecise information. In this paper, a novel TOPSIS (Technique for Order of Preference by Similarity to Ideal Solution) method is proposed for LPFSs based on correlation coefficient and entropy measure. To this end, the correlation coefficient is proposed for the relationship measurement between LPFSs. Afterwards, two entropy measures are developed to calculate the attribute weight information. Then, a novel linguistic Pythagorean fuzzy TOPSIS (LPF-TOPSIS) method is proposed to solve multiple attribute decision-making problems. Finally, the LPF-TOPSIS method is applied to handle a case concerning the selection of firewall productions, and then, a case concerning the security evaluation of computer systems is given to conduct the comparative analysis between the proposed LPF-TOPSIS method and previous decision-making methods for validating the superiority of the proposed LPF-TOPSIS method.

show abstract

“…This may dramatically increase CPU and session table utilization, such as in TCP SYN flood mechanism [29]. In [30], a mechanism is proposed to defend against DoF attacks targeting session table. The mechanism used the natural properties of the splay tree firewall, and a session table architecture that is based on session attributes separation to deal with costly timeout attribute.…”

Section: Related Workmentioning

confidence: 99%

Thwarting ICMP Low-Rate Attacks Against Firewalls While Minimizing Legitimate Traffic Loss

et al. 2020

Self Cite

View full text Add to dashboard Cite

Low-rate distributed denial of service (LDDoS) attacks pose more challenging threats that disrupt network security devices and services. Such type of attacks is difficult to detect and mitigate. In LDDoS attacks, attacker uses low-volume of malicious traffic that looks alike legitimate traffic. Thus, it can enter the network in silence without any notice. However, it may have severe effect on disrupting network services, depleting system resources, and degrading network speed to a point considering them as one of the most damaging attack types. There are many types of LDDoS such as application server and ICMP error messages based LDDoS. This paper is solely concerned with the ICMP error messages based LDDoS. The paper proposes a mechanism to mitigate low-rate ICMP error message attacks targeting security devices, such as firewalls. The mechanism is based on triggering a rejection rule to defend against corresponding detected attack as early as possible, in order to preserve firewall resources. The rejection rule has certain adaptive activity time, during which the rule continues to reject related low-rate attack packets. This activity time is dynamically predicted for the next rule activation period according to current and previous attack severity and statistical parameters. However, the rule activity time needs to be stabilized in a manner in order to prevent any additional overhead to the system as well as to prevent incremental loss of corresponding legitimate packets. Experimental results demonstrate that the proposed mechanism can efficiently defend against incremental evasion cycle of low-rate attacks, and monitor rejection rule activity duration to minimize legitimate traffic loss. INDEX TERMS Low-rate attacks, BlackNurse attack, Stateful firewall, session table, attack probabilistic modeling.

show abstract

Improved Session Table Architecture for Denial of Stateful Firewall Attacks

Cited by 13 publications

References 35 publications

Modified Tree Rule Firewall for Removing Redundant and Shadowing Rules in Cloud Firewall Policy

Modified Tree Rule Firewall for Removing Redundant and Shadowing Rules in Cloud Firewall Policy

TOPSIS Method Based on Correlation Coefficient and Entropy Measure for Linguistic Pythagorean Fuzzy Sets and Its Application to Multiple Attribute Decision Making

Thwarting ICMP Low-Rate Attacks Against Firewalls While Minimizing Legitimate Traffic Loss

Contact Info

Product

Resources

About