Journal articles: 'Firewall Performance'

1

Mohammed, Raya Kahtan, and Yoichiro UENO. "An FPGA-based Network Firewall with Expandable Rule Description." Indonesian Journal of Electrical Engineering and Computer Science 10, no. 3 (June 1, 2018): 1310. http://dx.doi.org/10.11591/ijeecs.v10.i3.pp1310-1318.

Full text

Abstract:

With the rapid growth of communications via the Internet, the need for an effective firewall system which has not badly affect the overall network performances has been increased. In this paper, a Field Programmable Gate Array (FPGA) -based firewall system with high performance has been implemented using Network FPGA (NetFPGA) with Xilinx Kintex-7 XC7K325T FPGA. Based on NetFPGA reference router project, a NetFPGA-based firewall system was implemented. The hardware module performs rule matching operation using content addressable memory (CAM) for higher speed data processing. To evaluate system performance, throughput, latency, and memory utilization were measured for different cases using different tools, also the number of rules that an incoming packet is subjected to was varied to get more readings using both software and hardware features. The results showed that the designed firewall system provides better performance than traditional firewalls. System throughput was doubled times of the one with Linux-Iptables firewalls.

APA, Harvard, Vancouver, ISO, and other styles

2

Konikiewicz, Wojciech, and Marcin Markowski. "Analysis of Performance and Efficiency of Hardware and Software Firewalls." Journal of Applied Computer Science Methods 9, no. 1 (June 1, 2017): 49–63. http://dx.doi.org/10.1515/jacsm-2017-0003.

Full text

Abstract:

Abstract Firewalls are key elements of network security infrastructure. They should guarantee the proper level of security and, at the same time, the satisfying performance in order to not increase the packet delay in the network. In the paper, we present the comparative study on performance and security of a few firewall technologies including hardware, software and virtual solutions. Three important criteria are considered: the maximal throughput of firewall, the introduced delay and the ability to resist Denial of Service attacks. We report results of experiments, present analysis and formulate a few practical conclusions.

APA, Harvard, Vancouver, ISO, and other styles

3

Telkar, Prajwal S., and Dr Kiran V. "Implementation of Threat policies and Routing process in Firepower Threat Defense." Journal of University of Shanghai for Science and Technology 23, no. 06 (June 18, 2021): 833–39. http://dx.doi.org/10.51201/jusst/21/05344.

Full text

Abstract:

A firewall is a guard of the network which inspects the packets based on the rules adopted to be executed in the threat environment. This is used to block the flow of undesirable content, forbids unauthorized remote access, and impedes immoral contents, assures security based on protocol and IP address, insulates seamless activity in Enterprise networks, shields conversation and coordination contents and thus this cybersecurity tool secures the system when administering on the internet with humongous amount of malicious data threatening the performance and data of the network structure. Cisco’s next-generation firewalls are equipped to combat the menace and in this project, initially, it is focused on the working of the FTD and analyzes the steps carried out in the processes. FMC is the graphical user interface to control FTD which is connected through the management interface. Various policies such as file policy, Prefilter policy, malware policies, provide the firewall to work more efficiently on the firewall. Additionally, these firewalls are equipped with a routing process to uphold the efficiency of the firewall which behaves as a router to establish a connection between the network nodes. The routing process is implemented using the firewall which is an IP routing software suite that provides a robust facility to adapt the firewall for routing conditions.

APA, Harvard, Vancouver, ISO, and other styles

4

Azzam, Ahmad Thoriq, Rendy Munadi, and Ratna Mayasari. "Performance Analysis Of Firewall As Virtualized Network Function On VMware ESXi Hypervisor." JURNAL INFOTEL 11, no. 1 (March 25, 2019): 29. http://dx.doi.org/10.20895/infotel.v11i1.425.

Full text

Abstract:

Virtualization technology is slowly being used to build network infrastructure called Network Function Virtualization (NFV). It takes network functions such as firewall, load balancer, IPS out of its hardware then use its software to be run on high specification server. It helps reduce vendor lock-in and help create a multiplatform network function environment. It has a lot of benefits compared to a traditional network. One of them is it can reduce the number of hardware that is used in the telecom industry. This technology runs on the hypervisor that is used for the management of hardware. One of the important components from NFV is Virtualized Network Function (VNF). In NFV, network devices are run on a server so that a firewall is needed because if an attack occurs on the network it will interfere with existing network components. This paper focuses on analyzing the performance of two firewall system, pfSense, and FortiGate. Both firewalls will run on the VMware ESXi hypervisor. It aims to determine the firewall performance comparison in normal conditions without attacks and under SYN DoS attacks. We also evaluate firewall failover capabilities. Based on the results of testing obtained that overall FortiGate has better performance. It has better ability in handling DoS SYN attack because it has lower throughput performance degradation and better FTP performance compare to pfSense. We conclude that FortiGate has best performance compare with pfSense

APA, Harvard, Vancouver, ISO, and other styles

5

Prajapati, Gourishankar, and Nilay Khare. "A Comparative Study of Software Firewall on Windows and Linux Platform." INTERNATIONAL JOURNAL OF COMPUTERS & TECHNOLOGY 14, no. 8 (June 2, 2015): 5967–78. http://dx.doi.org/10.24297/ijct.v14i8.1868.

Full text

Abstract:

Nowadays, the communication through World Wide Web (WWW) is growing rapidly. All the gadgets, computer and handheld devices are connected via wire or wireless media and communicated to each others. Thus, network security is the essential requirement of an organization or individuals. Organizations are protecting their communication from unauthorized access by introducing network firewalls. A Firewall is an application program which runs on any platform such as windows, Linux, Solaris, Macintosh etc and protected the networks or systems via implementing policies and rules. In this paper, the performance of firewall is measured and compared on Windows and Linux platform individual. To evaluate the performance, a private network has been setup in which three machines are connected via a switch; one Windows machine running windows firewall, one Linux machine running Linux firewall (IPTable) and one more machine that acting as a client. On both the platforms, the performance is measured in two situations: first when network is traffic free and second network with traffic. When network is traffic free then both the platforms reflect the common normal processing behavior in context of time and packet received per second; and when packets are pumped at a very high speed in the network then the processing time and packet received per second increases exponentially in both the platforms.

APA, Harvard, Vancouver, ISO, and other styles

6

Xuan, Shichang, Dapeng Man, Jiangchuan Zhang, Wu Yang, and Miao Yu. "Mathematical Performance Evaluation Model for Mobile Network Firewall Based on Queuing." Wireless Communications and Mobile Computing 2018 (2018): 1–13. http://dx.doi.org/10.1155/2018/8130152.

Full text

Abstract:

While mobile networks provide many opportunities for people, they face security problems huge enough that a firewall is essential. The firewall in mobile networks offers a secure intranet through which all traffic is handled and processed. Furthermore, due to the limited resources in mobile networks, the firewall execution can impact the quality of communication between the intranet and the Internet. In this paper, a performance evaluation mathematical model for firewall system of mobile networks is developed using queuing theory for a multihierarchy firewall with multiple concurrent services. In addition, the throughput and the package loss rate are employed as performance evaluation indicators, and discrete-event simulated experiments are conducted for further verification. Lastly, experimental results are compared to theoretically obtained values to identify a resource allocation scheme that provides optimal firewall performance and can offer a better quality of service (QoS) in mobile networks.

APA, Harvard, Vancouver, ISO, and other styles

7

Cho, Sung-Ho, Sung-Uk Choi, and . "A Study on Comparison of Network Location Efficiency of Web Application Firewall." International Journal of Engineering & Technology 7, no. 3.33 (August 29, 2018): 183. http://dx.doi.org/10.14419/ijet.v7i3.33.21009.

Full text

Abstract:

This paper proposes a method to optimize the performance of web application firewalls according to their positions in large scale networks. Since ports for web services are always open and vulnerable in security, the introduction of web application firewalls is essential. Methods to configure web application firewalls in existing networks are largely divided into two types. There is an in-line type where a web application firewall is located between the network and the web server to be protected. This is mostly used in small scale single networks and is vulnerable to the physical obstruction of web application firewalls. The port redirection type configured with the help of peripheral network equipment such as routers or L4 switches can maintain web services even when physical obstruction of the web application firewall occurs and is suitable for large scale networks where several web services are mixed. In this study, port redirection type web application firewalls were configured in large-scale networks and there was a problem in that the performance of routers was degraded due to the IP-based VLAN when a policy was set for the ports on the routers for web security. In order to solve this problem, only those agencies and enterprises that provide web services of networks were separated and in-line type web application firewalls were configured for them. Internet service providers (ISPs) or central line-concentration agencies can apply the foregoing to configure systems for web security for unit small enterprises or small scale agencies at low costs.

APA, Harvard, Vancouver, ISO, and other styles

8

Tsuchiya, Akihiro, Francisco Fraile, Ichiro Koshijima, Angel Ortiz, and Raul Poler. "Software defined networking firewall for industry 4.0 manufacturing systems." Journal of Industrial Engineering and Management 11, no. 2 (April 6, 2018): 318. http://dx.doi.org/10.3926/jiem.2534.

Full text

Abstract:

Purpose: In order to leverage automation control data, Industry 4.0 manufacturing systems require industrial devices to be connected to the network. Potentially, this can increase the risk of cyberattacks, which can compromise connected industrial devices to acquire production data or gain control over the production process. Search engines such as Sentient Hyper-Optimized Data Access Network (SHODAN) can be perverted by attackers to acquire network information that can be later used for intrusion. To prevent this, cybersecurity standards propose network architectures divided into several networks segments based on system functionalities. In this architecture, Firewalls limit the exposure of industrial control devices in order to minimize security risks. This paper presents a novel Software Defined Networking (SDN) Firewall that automatically applies this standard architecture without compromising network flexibility. Design/methodology/approach: The proposed SDN Firewall changes filtering rules in order to implement the different network segments according to application level access control policies. The Firewall applies two filtering techniques described in this paper: temporal filtering and spatial filtering, so that only applications in a white list can connect to industrial control devices. Network administrators need only to configure this application-oriented white lists to comply with security standards for ICS. This simplifies to a great extent network management tasks. Authors have developed a prototype implementation based on the OPC UA Standard and conducted security tests in order to test the viability of the proposal.Findings: Network segmentation and segregation are effective counter-measures against network scanning attacks. The proposed SDN Firewall effectively configures a flat network into virtual LAN segments according to security standard guidelines.Research limitations/implications: The prototype implementation still needs to implement several features to exploit the full potential of the proposal. Next steps for development are discussed in a separate section.Practical implications: The proposed SDN Firewall has similar security features to commercially available application Firewalls, but SDN Firewalls offer additional security features. First, SDN technology provides improved performance, since SDN low-level processing functions are much more efficient. Second, with SDN, security functions are rooted in the network instead of being centralized in particular network elements. Finally, SDN provides a more flexible and dynamic, zero configuration framework for secure manufacturing systems by automating the rollout of security standard-based network architectures. Social implications: SDN Firewalls can facilitate the deployment of secure Industry 4.0 manufacturing systems, since they provide ICS networks with many of the needed security capabilities without compromising flexibility. Originality/value: The paper proposes a novel SDN Firewall specifically designed to secure ICS networks. A prototype implementation of the proposed SDN Firewall has been tested in laboratory conditions. The prototype implementation complements the security features of the OPC UA communication standard to provide a holistic security framework for ICS networks.

APA, Harvard, Vancouver, ISO, and other styles

9

Bateni, Shirin, and Ali Asghar Khavasi. "DESIGN A SECURITY FIREWALL POLICY TO FILTER INCOMING TRAFFIC IN PACKET SWITCHED NETWORKS USING CLASSIFICATION METHODS." Ciência e Natura 38, no. 2 (May 31, 2016): 821. http://dx.doi.org/10.5902/2179460x21530.

Full text

Abstract:

Firewalls are core elements in network security. However, managing firewall rules, especially for enterprise networks, has become complex and error-prone. Firewall filtering rules have to be carefully written and organized in order to correctly implement the security policy. In addition, inserting or modifying a filtering rule requires to overcome and filter a range of special attacks or issues in network. In this paper, we present a machine learning based algorithm that filter Denial of Service (DoS) attacks in networks. This filtering algorithm has been designed by using a classification algorithm based on principal component and correlation based filters. We show good quality and performance of our algorithm experimentally by executing our algorithm on a several packet flow data sets.

APA, Harvard, Vancouver, ISO, and other styles

10

Parfenov, Denis I., Irina P. Bolodurina, and Vadim A. Torchin. "Development and Study of Algorithms for the Formation of Rules for Network Security Nodes in the Multi-Cloud Platform." Modeling and Analysis of Information Systems 26, no. 1 (March 15, 2019): 90–100. http://dx.doi.org/10.18255/1818-1015-2019-1-90-100.

Full text

Abstract:

As part of the study, existing solutions aimed at ensuring the security of the network perimeter of the multi-cloud platform were considered. It is established that the most acute problem is the effective formation of rules on firewalls. Existing approaches do not allow optimizing the list of rules on nodes that control access to the network. The aim of the study is to increase the effectiveness of firewall tools by conflict-free optimization of security rules and the use of a neural network approach in software-defined networks. The proposed solution is based on the sharing of intelligent mathematical approaches and modern technologies of virtualization of network functions. In the course of experimental studies, a comparative analysis of the traditional means of rule formation, the neural network approach, and the genetic algorithm was carried out. It is recommended to use the multilayer perceptron neural network classifier for automatic construction of network security rules since it gives the best results in terms of performance. It is also recommended to reduce the size of the firewall security rule list using the Kohonen network, as this tool shows the best performance. A conflict-free optimization algorithm was introduced into the designed architecture, which produces finite optimization by ranking and deriving the most common exceptions from large restrictive rules, which allows increasing protection against attacks that are aimed at identifying security rules at the bottom of the firewall list. On the basis of the proposed solution, the adaptive firewall module was implemented as part of the research.

APA, Harvard, Vancouver, ISO, and other styles

11

Hasan, Mohamed Yousuf, Poornima V.P, Sujendran S, and Karthikraja D. "FPGA Based Firewall using Embedded Processor for Vulnarability Packet Detection." International Journal of Reconfigurable and Embedded Systems (IJRES) 3, no. 1 (March 1, 2014): 31. http://dx.doi.org/10.11591/ijres.v3.i1.pp31-38.

Full text

Abstract:

This paper describes the design of high performance packet filtering firewall using embedded system. An FPGA (field programmable gate array) platform has been used for implementation and analysing the network firewall. It is capable of accepting real time changes. This network security application has an ability to perform powerful protection against unwanted data packets such as virus attack, spam in e-mails, hackers, worms, spyware unauthorized contents. However the firewalls don’t address the difficulty of unwanted data packets intrusion. The ultimate aim of this work is to create a systematic way of approach for unwanted packets discard in a network system. We use a specially trained algorithms such as Wu-manber algorithms (high performance, multi-pattern matching), bloom filter algorithm (space efficient data structure for testing an element in the set.Our design is mainly based on machine learning and artificial intelligence. This gives a high efficiency, improved performance and high ability of packet detection with less contribution of time in an effective way.

APA, Harvard, Vancouver, ISO, and other styles

12

Xing, Wen Qi, Qian Zhong Zhang, and Zi Wei Feng. "A Kind of Embedded Firewall Mechanism for ARM Processors." Applied Mechanics and Materials 556-562 (May 2014): 1757–60. http://dx.doi.org/10.4028/www.scientific.net/amm.556-562.1757.

Full text

Abstract:

The traditional firewall is a protect mechanism usually between the internal and external network, through the input and output of data packets in real-time network monitoring, it will make protective response immediately if it find security threats. With short data processing time and high efficiency, it can satisfy most procedures of application, but it has high cost and is difficult to achieve. In this paper, in view of these problems, embedded firewall security protection mechanisms set based AMR processor innovation, given the overall framework of embedded firewall hardware and the design for software architecture ,I selected good performance S3C2410X embedded chip, the embedded firewall network card drivers, key technologies of application research in detail, based on the embedded firewall performance of AMR processor through the contrast test ,the communication rate can reach 15.5Mpbs, 2.15times higher than that of general processor communication performance.

APA, Harvard, Vancouver, ISO, and other styles

13

Di, Xiao Qiang, Hua Min Yang, and Jin Qing Li. "Intrusion Response Mobile Firewall Design in Ad Hoc Networks and Based on SMP Performance Analysis." Applied Mechanics and Materials 496-500 (January 2014): 1909–14. http://dx.doi.org/10.4028/www.scientific.net/amm.496-500.1909.

Full text

Abstract:

According to the characteristics of Ad Hoc networks, distributed intrusion response mobile firewall system is designed based on mobile Agent. Surveillance agent monitors neighbors communication behavior, and reports to the control agent. Control agent is in charge of judging, and activates tracing agent and blocking agent. Defensive agent is set up in system to keep the firewall mobile features. Depending on semi-Markov process (SMP) theory, we have created a dynamic behavior model of the mobile firewall system and analyze the performance of network security.

APA, Harvard, Vancouver, ISO, and other styles

14

Yang, Fan, Xinlei Yang, Wei Wang, Peng Du, Jifeng Shi, Feng Li, and Hong Hu. "Research and implementation on high-speed transmission performance optimization technology of ten gigabit firewall UDP multicast." MATEC Web of Conferences 309 (2020): 01012. http://dx.doi.org/10.1051/matecconf/202030901012.

Full text

Abstract:

Under the development trend of high throughput, large capacity and strong time effective data security transmission of the second generation data relay system in China, the high-performance processing requirements for the firewall of the backbone network security protection equipment are constantly improving. Focusing on the characteristics of the second generation data relay system, the key technologies of the transmission processing of the 10 Gigabit firewall based on the x86 architecture for different data flows are researched, the optimization design of the CPU allocation and scheduling mode, the function judgment mechanism of the network card characteristics and the kernel state write operation function of the 10 Gigabit firewall are completed. The test results show that the optimized 10 Gigabit firewall gives full play to its maximum transmission performance, and provides a better security transmission service guarantee for the integrated data relay users.

APA, Harvard, Vancouver, ISO, and other styles

15

Shi, Leyi, Yang Li, and Haijie Feng. "Performance Analysis of Honeypot with Petri Nets." Information 9, no. 10 (September 30, 2018): 245. http://dx.doi.org/10.3390/info9100245.

Full text

Abstract:

As one of the active defense technologies, the honeypot deceives the latent intruders to interact with the imitated systems or networks deployed with security mechanisms. Its modeling and performance analysis have not been well studied. In this paper, we propose a honeypot performance evaluation scheme based on Stochastic Petri Nets (SPN). We firstly set up performance evaluation models for three types of defense scenarios (i.e., firewall; firewall and Intrusion Detection System (IDS); firewall, IDS and honeypot) based on SPN. We then theoretically analyze the SPN models by constructing Markov Chains (MC), which are isomorphic to the models. With the steady state probabilities based on the MC, the system performance evaluation is done with theoretical inference. Finally, we implement the proposed three SPN models on the PIPE platform. Five parameters are applied to compare and evaluate the performance of the proposed SPN models. The analysis of the probability and delay of three scenarios shows that the simulation results validate the effectiveness in security enhancement of the honeypot under the SPN models.

APA, Harvard, Vancouver, ISO, and other styles

16

Xu, Jun, and Mukesh Singhal. "Design of a high-performance ATM firewall." ACM Transactions on Information and System Security 2, no. 3 (August 1999): 269–94. http://dx.doi.org/10.1145/322510.322520.

Full text

APA, Harvard, Vancouver, ISO, and other styles

17

LY, SUNG, and ABBAS BIGDELI. "EXTENDABLE AND DYNAMICALLY RECONFIGURABLE MULTI-PROTOCOL FIREWALL." International Journal of Software Engineering and Knowledge Engineering 15, no. 02 (April 2005): 363–71. http://dx.doi.org/10.1142/s0218194005001926.

Full text

Abstract:

Security issues within a networking environment are critical, as attacks or intrusions can come from many different sources. Firewalls are an effective tool used for intrusion detection and provide protection against attacks on a system or network. In the past, protection barriers for a local network have been provided using software solutions. Emerging multi-gigabit networking technology and the high uptake of gigabit Ethernet has rendered these solutions inefficient as it cannot cope with the high data rate. In this paper, a new approach using reconfigurable hardware such as Field Programmable Gate Arrays is proposed to provide the flexibility and performance required for a gigabit firewall. The solution is extendable, has low cost and is capable of scanning multiple protocols. The design approach will allow it to be easily ported over to another family of chips with no or minor modification.

APA, Harvard, Vancouver, ISO, and other styles

18

Barznji, Ammar O., Tarik A. Rashid, and Nawzad K. Al-Salihi. "Computer Network Simulation of Firewall and VoIP Performance Monitoring." International Journal of Online Engineering (iJOE) 14, no. 09 (September 30, 2018): 4. http://dx.doi.org/10.3991/ijoe.v14i09.8508.

Full text

Abstract:

Fast growing in communication technology has influenced global changes and challenges appear in the field of network security issues. Security solutions must be efficient and operate in a way to deal with threats, reject and stop the network intruders and Trojans. The simulated network of Salahaddin university new campus is planned to build on an area of (3000X3000) meter square. The network consists of many main and secondary devices. The network is mainly consisted of one core switch that provides a very high data transfer through connecting all the collected positions by a variety of cable medias to the entire network switches which are installed in each college location. The department of academic administration (presidency) of the university design is similar to the network designed in each college. The mentioned switch obtains the services from a router that isolates the network from the cloud which supports the services of internet to the network. The firewall is connected to the switch that connects the main server and cloud together. This paper focuses on undertaking a simulation to analyze and examine the performance of the whole network when two scenarios are implemented, the first is if firewall devices is used, the second is when firewall is not used, since the project of building Salahaddin University new campus is at the initial stage, therefore, the researchers think that, it is very important to figure out the drawbacks and deadlocks of using firewall upon each branch of the network and overall network performance before the submitting the final networks design that going to be implemented and installed, because this will indicate many differences on the construction, for example, the network panels ways, the cable collecting locations, network channels and many other device fixing things depending on the media types in addition of the demand of future expansion capabilities. The results show that the using or adding of firewall device to the university campus computer network, will improve the overall network performance though increasing the data stream on many network sections and sectors, also better results are obtained.

APA, Harvard, Vancouver, ISO, and other styles

19

Y. Ameen, Siddeeq, and Shayma Wail Nourildean. "Firewall and VPN Investigation on Cloud Computing Performance." International Journal of Computer Science & Engineering Survey 5, no. 2 (April 30, 2014): 15–25. http://dx.doi.org/10.5121/ijcses.2014.5202.

Full text

APA, Harvard, Vancouver, ISO, and other styles

20

Khairi, Mutaz Hamed Hussien, Sharifah H. S. Ariffin, N. M. Abdul Latiff, Kamaludin Mohamad Yusof, M. K. Hassan, and Mohammad Rava. "The impact of firewall on TCP and UDP throughput in an openflow software defined network." Indonesian Journal of Electrical Engineering and Computer Science 20, no. 1 (October 1, 2020): 256. http://dx.doi.org/10.11591/ijeecs.v20.i1.pp256-263.

Full text

Abstract:

Software Defined Networking (SDN) is an emerging networking paradigm that provides more flexibility and adaptability in terms of network definition and control. However, SDN is a logically centralized technology. Therefor the control plane (i.e. controller) scalability in SDN in particular, is also one of the problems that needs further focus. OpenFlow is one of the protocol standards in SDN, which allow the separation of the controller from the forwarding plane. The control plane has an SDN embedded firewall and is able to enforce and monitor the network activity. This firewall can be used to control the throughput. However, it may affect SDN performance. In this paper, throughput will be used as a performance metric to evaluate and assess the firewall impact on two protocols; Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) that passes through the forwarding planes. The evaluations have been verified through simulating the SDN OpenFlow network using MININET. The results show that an implementation of firewall module in SDN creates a significant 36% average drop for TCP and 87% average drop for UDP in the bandwidth which eventually affect the quality of the network and applications.

APA, Harvard, Vancouver, ISO, and other styles

21

Wang, Shun Qing, and Hai Yan Chen. "Research on ASIC Firewall Based on State Detection Technology." Applied Mechanics and Materials 644-650 (September 2014): 3283–86. http://dx.doi.org/10.4028/www.scientific.net/amm.644-650.3283.

Full text

Abstract:

Being important in the field of network security, it is essential to study the firewall technology that has been an indispensable part of computer networks. This paper describes a new design and implementation of ASIC firewall architecture based on the state detection technology. Implementation and measurements in a real network show that the proposed system can provide high performance with reliability, flexibility, and security.

APA, Harvard, Vancouver, ISO, and other styles

22

Varun Kumar, K. A., and D. Arivudainambi. "Performance analysis of security framework for software defined network architectures." International Journal of Advances in Applied Sciences 8, no. 3 (September 1, 2019): 232. http://dx.doi.org/10.11591/ijaas.v8.i3.pp232-242.

Full text

Abstract:

Software defined data centers (SDDC) and software defined networking (SDN) are two emerging areas in the field of cloud data centers. SDN based centrally controlled services takes a global view of the entire cloud infrastructure between SDDC and SDN, whereas Network Function Virtualization (NFV) is widely used for providing virtual networking between host and Internet Service Providers (ISP’s). Some Application as a Service used in NFV data centers have a wide range in building security services like Virtual firewalls, Intrusion Detection System (IDS), load balancing, bandwidth allocation and management. In this paper, a novel security framework is proposed to combat SDDC and SDN based on NFV security features. The proposed framework consists of a Virtual firewall and an efficient bandwidth manager to handle multiple heterogeneous application requests from different ISPs. Real time data were taken from an experiment for a week and A new simulation based proof of concept is admitted in this paper for validation of the proposed framework which was deployed in real time SDNs using Mininet and POX controller.

APA, Harvard, Vancouver, ISO, and other styles

23

Šimon, M., L. Huraj, and M. Čerňanský. "Performance Evaluations of IPTables Firewall Solutions under DDoS attacks." Journal of Applied Mathematics, Statistics and Informatics 11, no. 2 (December 1, 2015): 35–45. http://dx.doi.org/10.1515/jamsi-2015-0010.

Full text

Abstract:

Abstract The paper presents design, background and experimental results of the IPTables applied in IPv4 and IP6Tables applied in IPv6 network compared through several tested parameters. The experimental testbed environment is based on P2P grid utilized for DDoS attacks. IPTables tool is used for packet filtering and consequently for preventing DoS/DDoS attacks. It allows a system administrator to configure the tables, the chains and rules it stores in order to manage the incoming and outgoing packets. The packets are treated according to the rules’ results provided by the packet processing. A rule in a chain can be bound with another chain in the table etc. We employ the P2P grid environment to carry out as well as to coordinate DDoS attack on the availability of services to simulate real DDoS attack launched indirectly through many compromised computing systems. The same routing protocols as well as the same firewall rules were used for IPv4 and for IPv6 network. The main aim was to analyse pros and cons of new IP6Tables tool compared with IPTables in IPv4 networks in light of the resistance to DDoS attacks which is still one of the most significant threats in the IPv6 networks.

APA, Harvard, Vancouver, ISO, and other styles

24

Trabelsi, Zouheir, Liren Zhang, Safaa Zeidan, and Kilani Ghoudi. "Dynamic traffic awareness statistical model for firewall performance enhancement." Computers & Security 39 (November 2013): 160–72. http://dx.doi.org/10.1016/j.cose.2013.07.001.

Full text

APA, Harvard, Vancouver, ISO, and other styles

25

Obiniyi, Afolayan A., Ezugwu E. Absalom, and Mohammed Dikko. "Network Security and Firewall Technology." International Journal of Dependable and Trustworthy Information Systems 2, no. 2 (April 2011): 40–60. http://dx.doi.org/10.4018/jdtis.2011040103.

Full text

Abstract:

With the explosion of the public Internet, corporate networks connected to the Internet, if not adequately secured, are vulnerable to damaging attacks. Hackers, viruses, worms, Trojan horses, and spyware try to invade privacy. This research examines how these threats affect the corporate network and ways to reduce them. MikroTik routerOS was configured as the router to examine these threats. Network Address Translation and packet filtering where the key features configured to make the network hidden for unauthorized users and filter unwanted traffics that might reflect malicious acts. The configuration and test were carried out at Iya Abubakar Computer Center, Ahamdu Bello University, Zaria, Nigeria. At the onset, the targeted network was full of virus, worms, Trojan horses, spyware, and vulnerable to unauthorized users. The signal strength of the network was usually very poor due to the effect from the threats affecting the bandwidth. The firewall was configured to filter out inherently dangerous services, exposing the network to fewer risks. After the research, the performance and efficiency of the network was improved tremendously.

APA, Harvard, Vancouver, ISO, and other styles

26

Nahar, Nivedita, Prerna Dewan, and Rakesh Kumar. "An Approach to Mitigate Malware Attacks Using Netfilter's Hybrid Frame in Firewall Security." International Journal of Open Source Software and Processes 9, no. 1 (January 2018): 32–61. http://dx.doi.org/10.4018/ijossp.2018010103.

Full text

Abstract:

With the steady advancements in the technology, the network security is really important these days to protect information from attackers. In this research, the main focus is on designing strong firewall filtering rules so that detection of malicious code is achieved to an optimal level. A proposed framework is introduced to improve the performance parameters such as Server response time, Web content analysis, Bandwidth, and the performance of the Network traffic load. This research work defines a new set of IPtable rules achieved by modifying the kernel source code. This is done using OpenBSD kernel source code, which results in the formation of a mini-firewall. Therefore, a new hybrid approach is proposed by adding packet filtering rules and SNORT technology in mini-firewall for malicious activity detection. It is an efficient and practical technique which will be helpful to mitigate the malware attacks and secure LAMP server. Experimental analysis has been done to conclude that around 70-75% malicious activity can be reduced by using the proposed technique.

APA, Harvard, Vancouver, ISO, and other styles

27

Cheminod, Manuel, Luca Durante, Lucia Seno, and Adriano Valenzano. "Performance Evaluation and Modeling of an Industrial Application-Layer Firewall." IEEE Transactions on Industrial Informatics 14, no. 5 (May 2018): 2159–70. http://dx.doi.org/10.1109/tii.2018.2802903.

Full text

APA, Harvard, Vancouver, ISO, and other styles

28

Kiesel, Sebastian, and Michael Scharf. "Modeling and performance evaluation of transport protocols for firewall control." Computer Networks 51, no. 11 (August 2007): 3232–51. http://dx.doi.org/10.1016/j.comnet.2006.11.031.

Full text

APA, Harvard, Vancouver, ISO, and other styles

29

Khamdamov, Rustam Kh, and Komil F. Kerimov. "DATABASE PROTECTION BASED ON WEB APPLICATION FIREWALL." Journal of Automation and Information sciences 1 (January 1, 2021): 84–90. http://dx.doi.org/10.34229/0572-2691-2021-1-7.

Full text

Abstract:

Web applications are increasingly being used in activities such as reading news, paying bills, and shopping online. As these services grow, you can see an increase in the number and extent of attacks on them, such as: theft of personal information, bank data and other cases of cybercrime. All of the above is a consequence of the openness of information in the database. Web application security is highly dependent on database security. Client request data is usually retrieved by a set of requests that request the application user. If the data entered by the user is not scanned very carefully, you can collect a whole host of types of attacks that use web applications to create security threats to the database. Unfortunately, due to time constraints, web application programmers usually focus on the functionality of web applications, but only few worry about security. This article provides methods for detecting anomalies using a database firewall. The methods of penetration and types of hacks are investigated. A database firewall is proposed that can block known and unknown attacks on Web applications. This software can work in various ways depending on the configuration. There are almost no false positives, and the overhead of performance is relatively small. The developed database firewall is designed to protect against attacks on web application databases. It works as a proxy, which means that requests for SQL expressions received from the client will first be sent to the developed firewall, rather than to the database server itself. The firewall analyzes the request: requests that are considered strange are blocked by the firewall and an empty result is returned to the client.

APA, Harvard, Vancouver, ISO, and other styles

30

Ali, Ali A., Saad M. Darwish, and Shawkat K. Guirguis. "An Approach for Improving Performance of a Packet Filtering Firewall Based on Fuzzy Petri Net." Journal of Advances in Computer Networks 3, no. 1 (2015): 67–74. http://dx.doi.org/10.7763/jacn.2015.v3.144.

Full text

APA, Harvard, Vancouver, ISO, and other styles

31

Rafamantanantsoa, Fontaine, and Haja Louis Rabetafika. "Performance Comparison and Simulink Model of Firewall Free BSD and Linux." Communications and Network 10, no. 04 (2018): 180–95. http://dx.doi.org/10.4236/cn.2018.104015.

Full text

APA, Harvard, Vancouver, ISO, and other styles

32

Kaur, Kirandeep. "Automation the Process of Unifying the Change in the Firewall Performance." International Journal of Computer Applications 164, no. 11 (April 19, 2017): 42–45. http://dx.doi.org/10.5120/ijca2017913545.

Full text

APA, Harvard, Vancouver, ISO, and other styles

33

Lu, Na, and Ying Yang. "Application of evolutionary algorithm in performance optimization of embedded network firewall." Microprocessors and Microsystems 76 (July 2020): 103087. http://dx.doi.org/10.1016/j.micpro.2020.103087.

Full text

APA, Harvard, Vancouver, ISO, and other styles

34

Sami Hasan, Amer, and Zaid Hashim Jaber. "FPKIN: Firewall Public Key Infrastructure for NEMO." International Journal of Engineering & Technology 7, no. 3.20 (September 1, 2018): 422. http://dx.doi.org/10.14419/ijet.v7i3.20.20585.

Full text

Abstract:

Network mobility (NEMO) is an important requirement for internet networks to reach the goal of ubiquitous connectivity. With NEMO basic support protocols, correspondent entities suffer from a number of limitations and problems that prevent route-optimization procedures to be established between the correspondent nodes and mobile network nodes associated with NEMO. The goal is to alleviate the signaling load and execute the route-optimization steps on behalf of the correspondent entities that are not sophisticated enough to support route optimization. This paper introduces a new architecture that uses firewall as a new entity with new mobility filtering rules and acts as root certificate server supporting PKI infrastructure. The PKI-firewall executes the route-optimization procedure on behalf of these correspondent entities depends on CA distributed to its mobile end nodes. User entities is reachable via optimized path approved by mobile node or user CA As a result of completing the above procedure, performance degradation will be reduced, especially when signaling storm occurs; applying these modifications will increase the security, availability and scalability of NEMO optimization and enable wider NEMO deployment. An analytical model is used to validate the new proposed framework and understand the behavior of this framework under different network scenarios.

APA, Harvard, Vancouver, ISO, and other styles

35

Trabelsi, Zouheir, Liren Zhang, and Safaa Zeidan. "Dynamic rule and rule-field optimisation for improving firewall performance and security." IET Information Security 8, no. 4 (July 1, 2014): 250–57. http://dx.doi.org/10.1049/iet-ifs.2011.0146.

Full text

APA, Harvard, Vancouver, ISO, and other styles

36

Kimmy, Kimmy, and Shivani Khurana. "Performance Evaluation of Dynamic Routing Protocols using Firewall and VPN_Firewall under Cloud Computing." International Journal of Computer Applications 90, no. 10 (March 26, 2014): 31–36. http://dx.doi.org/10.5120/15759-4419.

Full text

APA, Harvard, Vancouver, ISO, and other styles

37

Prabakaran, Senthil, and Ramalakshmi Ramar. "Stateful firewall-enabled software-defined network with distributed controllers: A network performance study." International Journal of Communication Systems 32, no. 17 (October 30, 2019): e4237. http://dx.doi.org/10.1002/dac.4237.

Full text

APA, Harvard, Vancouver, ISO, and other styles

38

Jun Xu and M. Singhal. "Design and evaluation of a high-performance ATM firewall switch and its applications." IEEE Journal on Selected Areas in Communications 17, no. 6 (June 1999): 1190–200. http://dx.doi.org/10.1109/49.772457.

Full text

APA, Harvard, Vancouver, ISO, and other styles

39

Ariyanto, Y., B. Harijanto, V. A. H. Firdaus, and S. N. Arief. "Performance analysis of Proxmox VE firewall for network security in cloud computing server implementation." IOP Conference Series: Materials Science and Engineering 732 (January 27, 2020): 012081. http://dx.doi.org/10.1088/1757-899x/732/1/012081.

Full text

APA, Harvard, Vancouver, ISO, and other styles

40

Mohan, Ratish, Anis Yazidi, Boning Feng, and John Oommen. "On optimizing firewall performance in dynamic networks by invoking a novelswapping window-based paradigm." International Journal of Communication Systems 31, no. 15 (July 24, 2018): e3773. http://dx.doi.org/10.1002/dac.3773.

Full text

APA, Harvard, Vancouver, ISO, and other styles

41

Yeasmin, Mahbuba, Nahida Akter, Mohammed Humayun Kabir, Javed Hossain, and Kuei-Ping Shih. "Performance evaluation of multi-cloud compared to the single-cloud under varying firewall conditions." Cogent Engineering 5, no. 1 (January 1, 2018): 1471974. http://dx.doi.org/10.1080/23311916.2018.1471974.

Full text

APA, Harvard, Vancouver, ISO, and other styles

42

Guo, Zhen Hong, Lin Li, Qing Wang, Meng Lin, and Rui Pan. "FMPC: A Fast Multi-Dimensional Packet Classification Algorithm." Applied Mechanics and Materials 644-650 (September 2014): 3365–70. http://dx.doi.org/10.4028/www.scientific.net/amm.644-650.3365.

Full text

Abstract:

With the rapid development of the Internet, the number of firewall rules is increasing. The enormous quantity of rules challenges the performance of the packet classification that has already become a bottleneck in firewalls. This dissertation proposes a rapid and multi-dimensional algorithm for packet classification based on BSOL(Binary Search On Leaves), which is named FMPC(FastMulti-dimensional Packet Classification). Different from BSOL, FMPC cuts all dimensions at the same time to decompose rule spaces and stores leaf spaces into hash tables; FMPC constructs a Bloom Filter for every hash table and stores them into embedded SRAM. When classifying a packet, FMPC performs parallel queries on Bloom Filters and determines how to visit hash tables according to the results. Algorithm analysis and the result of simulations show: the average number of hash-table lookups of FMPC is 1 when classifying a packet, which is much smaller than that of BSOL; inthe worst case, the number of hash-table lookups of FMPCisO(logwmax+1⁡), which is also smaller than that of BSOL in multi-dimensional environment, where wmax is the length, in bits, of the dimension whose length is the longest..

APA, Harvard, Vancouver, ISO, and other styles

43

Chen, Shuming, Dengfeng Wang, Tianze Shi, and Jing Chen. "Multi-Objective Optimization of Vehicle Sound Package in Middle Frequency Using Gray Relational Analysis Coupled with Principal Component Analysis." Fluctuation and Noise Letters 14, no. 01 (December 25, 2014): 1550010. http://dx.doi.org/10.1142/s0219477515500108.

Full text

Abstract:

This research studies optimization design of the thickness of sound packages for a passenger car. The major characteristics indexes for performance determined to evaluate the process are sound pressure level of the interior middle frequency noise and weight of the sound package. Three kinds of materials of sound packages are selected for the optimization process. The corresponding parameters of the sound packages are the thickness of the insulation plate for outer side of the firewall, thickness of the sound absorbing wool for inner side of the firewall, thickness of PU foam for the front floor, and thickness of PU foam for the rear floor, respectively. In this paper, the optimization procedure is a multi-objective optimization. Therefore, gray relational analysis (GRA) is applied to decide the optimal combination of sound package parameters. Furthermore, the principal component analysis (PCA) is used to calculate the weighting values which are corresponding to multiple performance characteristics. Then, the results of the confirmation tests uncover that GRA coupled with principal analysis methods can effectively be applied to find the optimal combination of the thickness of the sound packages at different positions for a passenger car. Thus, the proposed method can be a useful tool to improve the automotive interior middle frequency noise and lower the weight of the sound packages. Additionally, it will also be useful for automotive manufactures and designers in other fields.

APA, Harvard, Vancouver, ISO, and other styles

44

Li, Junnan, Zhigang Sun, Jinli Yan, Xiangrui Yang, Yue Jiang, and Wei Quan. "DrawerPipe: A Reconfigurable Pipeline for Network Processing on FPGA-Based SmartNIC." Electronics 9, no. 1 (December 31, 2019): 59. http://dx.doi.org/10.3390/electronics9010059.

Full text

Abstract:

In the public cloud, FPGA-based SmartNICs are widely deployed to accelerate network functions (NFs) for datacenter operators. We argue that with the trend of network as a service (NaaS) in the cloud is also meaningful to accelerate tenant NFs to meet performance requirements. However, in pursuit of high performance, existing work such as AccelNet is carefully designed to accelerate specific NFs for datacenter providers, which sacrifices the flexibility of rapidly deploying new NFs. For most tenants with limited hardware design ability, it is time-consuming to develop NFs from scratch due to the lack of a rapidly reconfigurable framework. In this paper, we present a reconfigurable network processing pipeline, i.e., DrawerPipe, which abstracts packet processing into multiple “drawers” connected by the same interface. NF developers can easily share existing modules with other NFs and simply load core application logic in the appropriate “drawer” to implement new NFs. Furthermore, we propose a programmable module indexing mechanism, namely PMI, which can connect “drawers” in any logical order, to perform distinct NFs for different tenants or flows. Finally, we implemented several highly reusable modules for low-level packet processing, and extended four example NFs (firewall, stateful firewall, load balancer, IDS) based on DrawerPipe. Our evaluation shows that DrawerPipe can easily offload customized packet processing to FPGA with high performance up to 100 Mpps and ultra-low latency (<10 µs). Moreover, DrawerPipe enables modular development of NFs, which is suitable for rapid deployment of NFs. Compared with individual NF development, DrawerPipe reduces the line of code (LoC) of the four NFs above by 68%.

APA, Harvard, Vancouver, ISO, and other styles

45

Fotiadou, Konstantina, Terpsichori-Helen Velivassaki, Artemis Voulkidis, Dimitrios Skias, Sofia Tsekeridou, and Theodore Zahariadis. "Network Traffic Anomaly Detection via Deep Learning." Information 12, no. 5 (May 19, 2021): 215. http://dx.doi.org/10.3390/info12050215.

Full text

Abstract:

Network intrusion detection is a key pillar towards the sustainability and normal operation of information systems. Complex threat patterns and malicious actors are able to cause severe damages to cyber-systems. In this work, we propose novel Deep Learning formulations for detecting threats and alerts on network logs that were acquired by pfSense, an open-source software that acts as firewall on FreeBSD operating system. pfSense integrates several powerful security services such as firewall, URL filtering, and virtual private networking among others. The main goal of this study is to analyse the logs that were acquired by a local installation of pfSense software, in order to provide a powerful and efficient solution that controls traffic flow based on patterns that are automatically learnt via the proposed, challenging DL architectures. For this purpose, we exploit the Convolutional Neural Networks (CNNs), and the Long Short Term Memory Networks (LSTMs) in order to construct robust multi-class classifiers, able to assign each new network log instance that reaches our system into its corresponding category. The performance of our scheme is evaluated by conducting several quantitative experiments, and by comparing to state-of-the-art formulations.

APA, Harvard, Vancouver, ISO, and other styles

46

Mohammed, Sarah Hashim, and Ammar Dawood Jasim. "Evaluation of Firewall and Load balance in Fat-Tree Topology Based on Floodlight Controller." Indonesian Journal of Electrical Engineering and Computer Science 17, no. 3 (March 1, 2020): 1157. http://dx.doi.org/10.11591/ijeecs.v17.i3.pp1157-1164.

Full text

Abstract:

Today it has become important to reconfigure the networks in to new form to be more manageable, scalable, dynamic and programmable. The networks recently are so inflexible and failing to deal with the required changes for the Information Technology. Software Defined Networking (SDN) is a modern paradigm that focused to change the main idea of current network infrastructure (traditional network) by breaking the chain between the data forwarding and the control planes to introduce flexible programmability network. This paper makes comparison between the performance of traditional fat-tree network and SDN fat-tree network, which found that average Round Tripe Time (RTT) in SDN fat-tree topology will decrease by 8.96% than traditional fat-tree topology. Then shows the basic operation of OpenFlow protocol that can be applied on fat-tree topology by using SDN technology and how that can be effect on the performance of network and make it more flexible to enable the SDN module applications, like load balancer and firewall for optimizing the SDN network. In this paper the physical switches are replaced by software switches in a virtual network environment and display the SDN structure in GUI, also Floodlight controller is chosen to use as the network operating system for SDN network.

APA, Harvard, Vancouver, ISO, and other styles

47

S, Kendaganna Swamy, Anand Jatti, and Uma B. V. "Reconfigurable High Performance Secured NoC Design Using Hierarchical Agent-based Monitoring System." International Journal of Electrical and Computer Engineering (IJECE) 8, no. 6 (December 1, 2018): 4164. http://dx.doi.org/10.11591/ijece.v8i6.pp4164-4174.

Full text

Abstract:

With the rapid increase in demand for high performance computing, there is also a significant growth of data communication that leads to leverage the significance of network on chip. This paper proposes a reconfigurable fault tolerant on chip architecture with hierarchical agent based monitoring system for enhancing the performance of network based multiprocessor system on chip against faulty links and nodes. These distributed agents provide healthy status and congestion information of the network. This status information is used for further packet routing in the network with the help of XY routing algorithm. The functionality of Agent is enhanced not only to work as information provider but also to take decision for packet to either pass or stop to the processing element by setting the firewall in order to provide security. Proposed design provides a better performance and area optimization by avoiding deadlock and live lock as compared to existing approaches over network design.

APA, Harvard, Vancouver, ISO, and other styles

48

Huang, Yi, Shah Nazir, Xinqiang Ma, Shiming Kong, and Youyuan Liu. "Acquiring Data Traffic for Sustainable IoT and Smart Devices Using Machine Learning Algorithm." Security and Communication Networks 2021 (June 19, 2021): 1–11. http://dx.doi.org/10.1155/2021/1852466.

Full text

Abstract:

Billions of devices are connected via the Internet which has produced various challenges and opportunities. The increase in the number of devices connected to the Internet of things (IoT) is nearly beyond imagination. These devices are communicating with each other and facilitating human life. The connection of these devices has provided opening directions for the smart applications which are one of the growing areas of research. Among these opportunities, security and privacy are considered to be one of the major issues for researchers to tackle. Proper security measures can prevent attackers from interrupting the security of IoT network inside the smart city for secure data traffic. Keeping in view the security consideration of data traffic for smart devices and IoT, the proposed study presented machine learning algorithms for securing the data traffic based on a firewall for smart devices and IoT network. The study has used the dataset of “Firewall” for validation purposes. The experimental results of the approach show that the hybrid deep learning model (based on convolution neural network and support vector machine) outperforms than decision1 rules and random forest by generating a recognition rate of 95.5% for the hybrid model, 68.5% for decision rules, and 78.3% accuracy for random forest. The validity of the proposed model is also tested based on other performance metrics such as f score, error rate, recall, and precision. This high accuracy rate and other performance values show the applicability of the proposed hybrid model to secure data traffic purposes in smart devices. This can be used in many research areas of the smart city for security purposes.

APA, Harvard, Vancouver, ISO, and other styles

49

Feng, Guohui, Xing Sheng, and Xiaolong Xu. "Thermal Performance Analysis of Combined Heating of Phase Change Kang and Firewall for Village Room under Winter Condition." Procedia Engineering 146 (2016): 541–48. http://dx.doi.org/10.1016/j.proeng.2016.06.395.

Full text

APA, Harvard, Vancouver, ISO, and other styles

50

Melkov, Dmitrij, and Šarūnas Paulikas. "ANALYSIS OF LINUX OS SECURITY TOOLS FOR PACKET FILTERING AND PROCESSING." Mokslas - Lietuvos ateitis 13 (August 24, 2021): 1–5. http://dx.doi.org/10.3846/mla.2021.15180.

Full text

Abstract:

Open-source software and its components are widely used in various products, solutions, and applications, even in closed-source. Majority of them are made on Linux or Unix based systems. Netfilter framework is one of the examples. It is used for packet filtering, load-balancing, and many other manipulations with network traffic. Netfilter based packet filter iptables has been most common firewall tool for Linux systems for more than two decades. Successor of iptables – nftables was introduced in 2014. It was designed to overcome various iptables limitations. However, it hasn’t received wide popularity and transition is still ongoing. In recent years researchers and developers around the world are searching for solution to increase performance of packet processing tools. For that purpose, many of them trying to utilize eBPF (Extended Berkeley Packet Filter) with XDP (Express Data Path) data path. This paper focused on analyzing Linux OS packet filters and comparing their performances in different scenarios.

APA, Harvard, Vancouver, ISO, and other styles

Journal articles on the topic 'Firewall Performance'

Create a spot-on reference in APA, MLA, Chicago, Harvard, and other styles