Structured firewall design

Computer Networks

Volumn 51, Issue 4, 2007, Pages 1106-1120

  Gouda, Mohamed G ^a   Liu, Alex X ^a  

^a University of Texas at Austin   (United States)

Author keywords

Firewall; Firewall design; Firewall policy; Network security

Indexed keywords

COMPUTER SYSTEM FIREWALLS; DECISION THEORY; LOGIC PROGRAMMING; PACKET NETWORKS; PROBLEM SOLVING; SECURITY SYSTEMS;

FIREWALL DESIGN; FIREWALL POLICY; NETWORK SECURITY;

SYSTEMS ANALYSIS;

EID: 33845688273     PISSN: 13891286     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comnet.2006.06.015     Document Type: Article

References (25)

1. High level firewall language. Available from: .
2. ipchains. Available from: .
3. E. Al-Shaer, H. Hamed, Discovery of policy anomalies in distributed firewalls, in: IEEE INFOCOM'04, 2004, pp. 2605-2616.
4. Al-Shaer E., Hamed H., Boutaba R., and Hasan M. Conflict classification and analysis of distributed firewall policies. IEEE Journal on Selected Areas in Communications (JSAC) 23 10 (2005) 2069-2084
5. F. Baboescu, G. Varghese, Fast and scalable conflict detection for packet classifiers, in: Proceedings of the 10th IEEE International Conference on Network Protocols, 2002.
6. Y. Bartal, A.J. Mayer, K. Nissim, A. Wool, Firmato: a novel firewall management toolkit, in: Proceeding of the IEEE Symposium on Security and Privacy, 1999. pp. 17-31.
7. A. Begel, S. McCanne, S.L. Graham, BPF+: exploiting global data-flow optimization in a generalized packet filter architecture, in: Proceedings of ACM SIGCOMM '99, 1999.
8. Bryant R.E. Graph-based algorithms for boolean function manipulation. IEEE Transactions on Computers 35 8 (1986) 677-691
9. CERT, Test the firewall system. Available from: .
10. Dijkstra E.W. Goto statement considered harmful. Communications of the ACM 11 3 (1968) 147-148
11. D. Eppstein, S. Muthukrishnan, Internet packet filter management and rectangle geometry, in: Symposium on Discrete Algorithms, 2001, pp. 827-835.
12. Frantzen M., Kerschbaum F., Schultz E., and Fahmy S. A framework for understanding vulnerabilities in firewalls using a dataflow model of firewall internals. Computers and Security 20 3 (2001) 263-270
13. M.G. Gouda, A.X. Liu, A model of stateful firewalls and its properties, in: Proceedings of the IEEE International Conference on Dependable Systems and Networks (DSN-05), 2005, pp. 320-327.
14. Gupta P., and McKeown N. Algorithms for packet classification. IEEE Network 15 2 (2001) 24-32
15. J.D. Guttman, Filtering postures: local enforcement for global policies, in: Proceedings of IEEE Symposium on Security and Privacy, 1997, pp. 120-129.
16. A. Hari, S. Suri, G.M. Parulkar, Detecting and resolving packet filter conflicts, in: Proceedings of IEEE INFOCOM, 2000, pp. 1203-1212.
17. S. Hazelhurst, A. Attar, R. Sinnappan, Algorithms for improving the dependability of firewall and filter rule lists, in: Proceedings of the Workshop on Dependability of IP Applications, Platforms and Networks, 2000.
18. Kamara S., Fahmy S., Schultz E., Kerschbaum F., and Frantzen M. Analysis of vulnerabilities in internet firewalls. Computers and Security 22 3 (2003) 214-232
19. Liu A.X., Gouda M.G., Ma H.H., and Ngu A.H. Firewall queries. In: Higashino T. (Ed). Proceedings of the 8th International Conference on Principles of Distributed Systems, Lecture Notes in Computer Science, 3544 (2004), Springer-Verlag 124-139
20. A. Mayer, A. Wool, E. Ziskind, Fang: A firewall analysis engine, in: Proceedings of IEEE Symposium on Security and Privacy, 2000, pp. 177-187.
21. Moffett J.D., and Sloman M.S. Policy conflict analysis in distributed system management. Journal of Organizational Computing 4 1 (1994) 1-22
22. G. Patz, M. Condell, R. Krishnan, L. Sanchez, Multidimensional security policy management for dynamic coalitions, in: Proceedings of the DARPA Information Survivability Conference and Exposition (DISCEX II), 2001.
23. Quinlan J. Induction of decision trees. Machine Learning 1 1 (1986) 81-106
24. Strehl K., and Thiele L. Interval diagrams for efficient symbolic verification of process networks. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems 19 8 (2000) 939-956
25. Wool A. A quantitative study of firewall configuration errors. IEEE Computer 37 6 (2004) 62-67