Adaptive early packet filtering for defending firewalls against DoS attacks

Proceedings - IEEE INFOCOM

Volumn , Issue , 2009, Pages 2437-2445

  El Atawy, Adel ^a   Al Shaer, Ehab ^a  

^a DEPAUL UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BOOLEAN EXPRESSIONS; DATA NETWORK; DEFENSE POLICY; DOS ATTACKS; FILTERING MECHANISM; FILTERING METHOD; FILTERING PROCESS; FILTERING RULES; INTERNET TRAFFIC; INTRUSION DETECTION AND PREVENTION SYSTEMS; LIGHT WEIGHT; PACKET FILTERING; PROCESSING POWER; TIME COST; TRAFFIC BEHAVIOR; WORST CASE;

ACCESS CONTROL; COMPUTER CRIME; COMPUTER SYSTEM FIREWALLS; INTRUSION DETECTION;

BINARY DECISION DIAGRAMS;

EID: 70349659341     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOM.2009.5062171     Document Type: Conference Paper

References (27)

1. Buddy: Bdd c++ package. "http://sourceforge.net/projects/ buddy", 2006.
2. David A. Applegate, Gruia Calinescu, David S. Johnson, Howard Karloff, Katrina Ligett, and Jia Wang. Compressing rectilinear pictures and minimizing access control lists. In SODA '07: Proceedings of the eighteenth annual ACM-SIAM symposium on Discrete algorithms, pages 1066-1075, 2007.
3. F. Baboescu, S. Singh, and G. Varghese. Packet classification for core routers: Is there an alternative to cams. In IEEE INFOCOM'03, 2003.
4. F. Baboescu and G. Varghese. Scalable packet classification. In ACM SIGCOMM'01, 2001.
5. Beate Bollig and Ingo Wegener. Improving the variable ordering of obdds is np-complete. IEEE Trans. Comput., 45(9):993-1002, 1996.
6. E. Cohen and C. Lund. Packet classification in large isps: design and evaluation of decision tree classifiers. In SIGMETRICS '05: Proceedings of the 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, pages 73-84, New York, NY, USA, 2005. ACM Press.
7. Qunfeng Dong, Suman Banerjee, Jia Wang, and Dheeraj Agrawal. Wire speed packet classification without tcams: a few more registers (and a bit of logic) are enough. SIGMETRICS Perform. Eval. Rev., 35(1):253-264, 2007.
8. A. El-Atawy, K. Ibrahim, H. Hamed, and E. Al-Shaer. Policy segmentation for intelligent firewall testing. In NPSec, November 2005.
9. A. El-Atawy, T. Samak, E. Al-Shaer, and H. Li. On using online traffic statistical matching for optimizing packet filtering performance. In IEEE INFOCOM'07, May 2007.
10. A. Feldmann and S. Muthukrishnan. Tradeoffs for packet classification. In IEEE INFOCOM'00, March 2000.
11. Errin W. Fulp. Optimization of network firewalls policies using directed acyclical graphs. In Proceedings of the IEEE Internet Management Conference, 2005.
12. David Goldsmith and Michael Schiffman. Firewalking: A traceroute-like analysis of ip packet responses to determine gateway access control lists, http://www.packetfactory.net/firewalk/firewalk-final.html. White paper, Cambridge Technology Partners, October 1998.
13. P. Gupta and N. McKeown. Algorithms for packet classification. IEEE Network, 15(2):24-32, 2001.
14. P. Gupta and N. McKeown. Packet classification using hierarchical intelligent cuttings. In Interconnects VII, August 1999.
15. P. Gupta, B. Prabhakar, and S. Boyd. Near optimal routing lookups with bounded worst case performance. In IEEE INFOCOM'00, 2000.
16. H. Hamed, A. El-Atawy, and E. Al-Shaer. Adaptive statistical optimization techniques for firewall packet filtering. In IEEE INFOCOM'06, April 2006.
17. Hazem Hamed and Ehab Al-Shaer. Dynamic rule-ordering optimization for high-speed firewall filtering. In ASIACCS '06: Proceedings of the 2006 ACM Symposium on Information, computer and communications security, pages 332-342, New York, NY, USA, 2006. ACM.
18. INTEL. Intel 64 and ia-32 architecture software developer's manual. "http://www.intel.com/design/processor/manuals/253666.pdf", 2007.
19. J.R. Burch, E.M. Clarke, D.E. Long, K.L. MacMillan, and D.L. Dill. Symbolic model checking for sequential circuit verification. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 13(4):401-424, 1994.
20. L. Kencl and C. Schwarzer. Traffic-adaptive packet filtering of denial of service attacks. In WOWMOM'06: The 2006 International Symposium on on World of Wireless, Mobile and Multimedia Networks, pages 485-489, Washington, DC, USA, 2006. IEEE Computer Society.
21. Karthik Lakshminarayanan, Anand Rangarajan, and Srinivasan Venkatachary. Algorithms for advanced packet classification with ternary cams. In SIGCOMM '05: Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications, pages 193-204, New York, NY, USA, 2005. ACM.
22. A. J. McAulay and P. Francis. Fast routing table lookup using CAMs. In IEEE INFOCOM'93, March 1993.
23. Derek Pao, Yiu Keung Lia, and Peng Zhoua. Efficient packet classification using tcams. Computer Networks, 50(18):3523-3535, Dec 2006.
24. T. Samak, A. El-Atawy, E. Al-Shaer, and H. Li. In IEEE ICNP'07, October 2007.
25. V. Srinivasan, Subhash Suri, and George Varghese. Packet classification using tuple space search. In Computer ACM SIGCOMM Communication Review, pages 135-146, October 1999.
26. Thomas Y. C. Woo. A modular approach to packet classification: Algorithms and results. In IEEE INFOCOM'00, pages 1213-1222, March 2000.
27. M. Yoon, S. Chen, and Z. Zhang. Reducing the size of rule set in a firewall. In ICC'07: Proceedings of the IEEE International Conference on Communications, pages 1274-1279, June 2007.