Grant: Strategic Projects - Group

With the global Internet connectivity, network security has received significant attention in the research and industrial communities. Due to the increasing threat of network attacks, firewalls have become core elements not only in enterprise networks but also in small-size and home networks as frontier defense against attacks and unauthorized traffic. However, there are many challenges confronting the effective deployment of firewall security. First, inserting or modifying rules in firewall policies is a critical and complex management operation due to the sequential matching semantic of firewall filtering. Thus, a thorough and tedious analysis of the existing filtering rules relations must be performed before editing any firewall policy in order to determine the correct rule ordering in the security policy. As the number of filtering rules increases, the difficulty of writing new rules or modifying existing ones also significantly increases. Therefore, it is likely, as a result of manual management, to create policy misconfiguration (anomalies) in firewall rules such as conflicting, shadowing, duplication or correlation, which increase network vulnerability and defeat the purpose of firewall security. Second, management of distributed firewall policies is more challenging than managing single firewalls as inter-firewall policy analysis is required in all network subnets in order to ensure global firewall consistency. In addition, manual distribution of filtering rules across subnets might create improper distribution of filtering load and cause scalability problems. Third, firewalls are currently passive entities and are not capable of exchanging filtering and traffic information dynamically in order to discover and block worm and DOS attacks proactively. Our goal in the FireStone project is to develop architectures, theoritical models and techniques that address these challenges and provide prototype implementation and tools to be deployed in real-life environment.