The Experts below are selected from a list of 9279 Experts worldwide ranked by ideXlab platform

Errin W. Fulp - One of the best experts on this subject based on the ideXlab platform.

  • an independent function parallel Firewall architecture for high speed Networks short paper
    International Conference on Information and Communication Security, 2006
    Co-Authors: Errin W. Fulp
    Abstract:

    A function-parallel Network Firewall is a scalable architecture that consists of multiple Firewalls. Rules are distributed across the array such that each Firewall implements a portion of the original policy. This resutls in significantly lower delays than other parallel designs; however, the design requires Firewall intercommunication to coordinate the array which is difficult to implement and introduces additional delay. This paper describes how the performance of a function-parallel Firewall array can be increased if the individual Firewalls can operate independently, without Firewall intercommunication. By distributing rules using accept sets, the independent Firewall array and a traditional single Firewall will always arrive at the same decision (integrity is maintained). Simulation results will show the system is significantly faster than other designs and has the unique ability to provide service differentiation.

  • an independent function parallel Firewall architecture for high speed Networks
    International Conference on Information and Communications Security, 2006
    Co-Authors: Errin W. Fulp
    Abstract:

    A function-parallel Network Firewall is a scalable architecture that consists of multiple Firewalls. Rules are distributed across the array such that each Firewall implements a portion of the original policy. This resutls in significantly lower delays than other parallel designs; however, the design requires Firewall intercommunication to coordinate the array which is difficult to implement and introduces additional delay. This paper describes how the performance of a function-parallel Firewall array can be increased if the individual Firewalls can operate independently, without Firewall intercommunication. By distributing rules using accept sets, the independent Firewall array and a traditional single Firewall will always arrive at the same decision (integrity is maintained). Simulation results will show the system is significantly faster than other designs and has the unique ability to provide service differentiation.

  • Network Firewall policy tries
    2005
    Co-Authors: Errin W. Fulp, Stephen J. Tarsa
    Abstract:

    Network Firewalls remain the forefront defense for most computer systems. These critical devices filter traffic by comparing arriving packets to a list of rules, or security policy, in a sequential manner. Unfortunately packet filtering in this fashion can result in significant traffic delays, which is problematic for applications that require strict Quality of Service (QoS) guarantees. Furthermore, as Network speeds and capacities continue to increase, the processing time associated with filtering only compounds these delays. Given this demanding environment, new methods are needed to increase Network Firewall performance. This paper introduces a new technique for representing a security policy in software that maintains policy integrity and provides more efficient processing. The policy is represented as an n-ary retrieval tree, also referred to as a trie. This structure is able to quickly reach decisions based on the security policy by simultaneously eliminating multiple rules with few comparisons. As a result, the worst case processing requirement for the policy trie is a fraction compared a list representation, which only consider rules individually (1/5 the processing for TCP/IP Networks). Furthermore unlike other representations, the n-ary trie developed in this paper is proven to maintain policy integrity. The creation of policy trie structures is discussed in detail and their performance benefits are proven theoretically and validated empirically.

  • Network Firewall policy tries
    2004
    Co-Authors: Errin W. Fulp, Stephen J. Tarsa
    Abstract:

    Abstract Network Firewalls remain the forefront defense for most computer systems. These criticaldevices filter traffic by comparing arriving packets to a list of rules, or security policy, in a sequential manner. Unfortunately packet filtering in this fashion can result in significant trafficdelays, which is problematic for applications that require strict Quality of Service (QoS) guarantees. Furthermore, as Network speeds and capacities continue to increase, the processing timeassociated with filtering only compounds these delays. Given this demanding environment, new methods are needed to increase Network Firewall performance.This paper introduces a new technique for representing a security policy in software that maintains policy integrity and provides more efficient processing. The policy is represented asan n-ary retrieval tree, also referred to as a trie. This structure is able to quickly reach decisionsbased on the security policy by simultaneously eliminating multiple rules with few comparisons. As a result, the worst case processing requirement for the policy trie is a fraction compareda list representation, which only consider rules individually (1 /5 the processing for TCP/IPNetworks). Furthermore unlike other representations, the n-ary trie developed in this paper isproven to maintain policy integrity. The creation of policy trie structures is discussed in detail and their performance benefits are proven theoretically and validated empirically. Keywords: Security management, Firewalls, policy representation, and scalability

Fang Shan - One of the best experts on this subject based on the ideXlab platform.

Du Min - One of the best experts on this subject based on the ideXlab platform.

Sharad Saxena - One of the best experts on this subject based on the ideXlab platform.

  • intrusion detection system based on software defined Network Firewall
    International Conference on Next Generation Computing Technologies, 2015
    Co-Authors: Mohd Abuzar Sayeed, Mohd Asim Sayeed, Sharad Saxena
    Abstract:

    Software Defined Network is an architecture that focuses on the separation of control plane and data plane in order to make Networks programmable and scalable. Currently Openflow is the most widely used SDN protocol. It has provided flexibility to the Networking environment and had made it simpler and easy to optimize. SDN is a major area of research however; in the current scenario the field of security is relatively under exploited. The paper describes an intrusion detection mechanism for Openflow based Software defined Networks. The study focuses on developing a packet filtering Firewall over a Software Defined Network controller namely Floodlight and the application of association rules to find the patterns among the data passing through the Firewall. The patterns recorded serve as the motivation behind the development of an Anomaly based intrusion detection mechanism.

Stephen J. Tarsa - One of the best experts on this subject based on the ideXlab platform.

  • Network Firewall policy tries
    2005
    Co-Authors: Errin W. Fulp, Stephen J. Tarsa
    Abstract:

    Network Firewalls remain the forefront defense for most computer systems. These critical devices filter traffic by comparing arriving packets to a list of rules, or security policy, in a sequential manner. Unfortunately packet filtering in this fashion can result in significant traffic delays, which is problematic for applications that require strict Quality of Service (QoS) guarantees. Furthermore, as Network speeds and capacities continue to increase, the processing time associated with filtering only compounds these delays. Given this demanding environment, new methods are needed to increase Network Firewall performance. This paper introduces a new technique for representing a security policy in software that maintains policy integrity and provides more efficient processing. The policy is represented as an n-ary retrieval tree, also referred to as a trie. This structure is able to quickly reach decisions based on the security policy by simultaneously eliminating multiple rules with few comparisons. As a result, the worst case processing requirement for the policy trie is a fraction compared a list representation, which only consider rules individually (1/5 the processing for TCP/IP Networks). Furthermore unlike other representations, the n-ary trie developed in this paper is proven to maintain policy integrity. The creation of policy trie structures is discussed in detail and their performance benefits are proven theoretically and validated empirically.

  • Network Firewall policy tries
    2004
    Co-Authors: Errin W. Fulp, Stephen J. Tarsa
    Abstract:

    Abstract Network Firewalls remain the forefront defense for most computer systems. These criticaldevices filter traffic by comparing arriving packets to a list of rules, or security policy, in a sequential manner. Unfortunately packet filtering in this fashion can result in significant trafficdelays, which is problematic for applications that require strict Quality of Service (QoS) guarantees. Furthermore, as Network speeds and capacities continue to increase, the processing timeassociated with filtering only compounds these delays. Given this demanding environment, new methods are needed to increase Network Firewall performance.This paper introduces a new technique for representing a security policy in software that maintains policy integrity and provides more efficient processing. The policy is represented asan n-ary retrieval tree, also referred to as a trie. This structure is able to quickly reach decisionsbased on the security policy by simultaneously eliminating multiple rules with few comparisons. As a result, the worst case processing requirement for the policy trie is a fraction compareda list representation, which only consider rules individually (1 /5 the processing for TCP/IPNetworks). Furthermore unlike other representations, the n-ary trie developed in this paper isproven to maintain policy integrity. The creation of policy trie structures is discussed in detail and their performance benefits are proven theoretically and validated empirically. Keywords: Security management, Firewalls, policy representation, and scalability