This paper describes some of the key efforts done by the research community to prevent attacks on network infrastructures, mainly by using Firewall and Intrusion Detection Systems. We also cover some of the protection models in Cloud Computing. This paper is the second phase of our previous paper about Network Protection Security Threats and Attacks.
The research community investigated the cyber attack prevention models heavily. Most of the work was focused on preventing such attacks by automating Firewall rules and also improving Access Control Lists on network infrastructure devices. Alshaer et al. identified all anomalies that could exist in a single- or multi-firewall environment. They also presented a set of algorithms to detect rule anomalies within a single firewall (intra-firewall anomalies), and between inter-connected firewalls (inter-firewall anomalies) in the network.
The authors also presented the Firewall Policy Advisor which provides a number of techniques for purifying and protecting the firewall policy from rule anomalies. The administrator may use the firewall policy advisor to manage firewall policies without prior analysis of filtering rules. In this paper, they formally defined a number of firewall policy anomalies in both centralized and distributed firewalls and they proved that these are the only conflicts that could exist in firewall policies. Then they presented a set of algorithms to detect rule anomalies within a single firewall (intra-firewall anomalies), and between inter-connected firewalls (inter-firewall anomalies) in the network.
Inhaltsverzeichnis (Table of Contents)
- INTRODUCTION
- PROTECTION MODELS
- CONCLUSION
- REFERENCES
Zielsetzung und Themenschwerpunkte (Objectives and Key Themes)
This paper investigates key research efforts in network protection, focusing on methods to prevent attacks on network infrastructures, primarily using firewalls and intrusion detection systems. The paper also explores protection models in cloud computing, building upon a previous work on network protection security threats and attacks.
- Firewall rule automation and access control list optimization for network infrastructure
- Detection and resolution of firewall policy anomalies
- Efficient compression techniques for access control lists (ACLs)
- Modeling and analysis of stateful firewalls
- Data-mining techniques for detecting and preventing firewall misconfigurations
Zusammenfassung der Kapitel (Chapter Summaries)
- INTRODUCTION: This chapter introduces the paper's focus on network protection methods, particularly using firewalls and intrusion detection systems. It also highlights the paper's connection to a previous work on network security threats.
- PROTECTION MODELS: This chapter delves into various research efforts aimed at preventing cyberattacks, focusing on:
- Firewall Rule Anomalies: Discusses work by Alshaer et al. on identifying and detecting anomalies in single or multi-firewall environments. It introduces the Firewall Policy Advisor as a tool for managing firewall policies effectively.
- Firewall Rule Set Consistency: Explores approaches for maintaining consistency in firewall rule sets by addressing the local consistency problem, especially when frequent rule set updates occur.
- Firewall Anomaly Management Environment (FAME): Introduces FAME, a framework for systematic detection and resolution of firewall policy anomalies. It emphasizes the use of visualization-based tools for firewall policy analysis.
- Firewall Analysis Tool: Presents a firewall analysis tool designed for administrators to easily discover and test global firewall policies, facilitating both deployment and planning.
- Access Control List Compression: Discusses the work of Alex Liu and his team, who proposed a framework to significantly reduce the number of rules in an access control list while preserving semantics, and provide optimal solutions for compressing both one-dimensional and multidimensional ACLs.
- TCAM Razor: Introduces TCAM Razor, a systematic approach for minimizing TCAM rules for packet classifiers. It highlights the practical benefits of this approach for network administrators and ISPs.
- Stateful Firewall Modeling: Presents a model for stateful firewalls, proposed by M. Gouda et al., which leverages existing results from stateless firewall design and analysis. The model allows for backward compatibility and provides methods for analyzing stateful firewalls.
- Firewall Misconfiguration Detection: Examines the work of Lujo Bauer et al., who demonstrate how to eliminate firewall misconfigurations using association rule mining, effectively reducing access delays and improving policy prediction.
- Conflict Resolution in Firewalls: Explores a scheme proposed by B. Hari et al. that uses resolve filters to address conflicts in firewall rule databases. The scheme includes algorithms for detecting and resolving conflicts, with specific solutions for various filter types.
- Efficient IP Lookup Algorithms: Discusses an algorithm developed by M. Waldvoge et al. that combines intellectual contributions, such as binary searching on hash tables with markers and precomputation, with practical benefits, enabling fast and scalable IP lookups in both software and hardware.
- High-Performance Integrated Services Router Architecture: Presents the design and implementation of a high-performance, modular, extended integrated services router software architecture within the NetBSD operating system kernel.
- Leveraging Commodity Ethernet Switches for Cluster Bandwidth: Examines the use of commodity Ethernet switches to support the full aggregate bandwidth of large clusters, offering a cost-effective alternative to higher-end solutions.
- Automated Detection and Resolution of Firewall Anomalies: Introduces an automated process developed by M. Abedin et al. for detecting and resolving firewall anomalies. This process includes anomaly resolution and merging algorithms to create compact and anomaly-free rule sets.
- Policy Anomaly Analysis in XACML: Presents an innovative mechanism proposed by H. Hu et al. for systematic detection and resolution of anomalies in XACML (eXtensible Access Control Markup Language) policies. This mechanism utilizes a policy-based segmentation technique and includes a tool called XAnalyzer for policy anomaly analysis.
Schlüsselwörter (Keywords)
The key terms and focus topics of this paper include network protection, firewall security, intrusion detection systems, access control lists (ACLs), firewall rule anomalies, firewall policy analysis, stateful firewalls, data-mining techniques, and cloud computing.
- Citar trabajo
- Santosh Malhotra (Autor), 2018, Survey on Network Protection Models, Múnich, GRIN Verlag, https://www.grin.com/document/454913
