A first course in stochastic processes

Performance comparison of intrusion detection systems and application of machine learning to Snort system

Implementation of deep packet inspection in smart grids and industrial Internet of Things: Challenges and opportunities

The linguistic Pythagorean fuzzy set (LPFS) is an important implement for modeling the uncertain and imprecise information. In this paper, a novel TOPSIS (Technique for Order of Preference by Similarity to Ideal Solution) method is proposed for LPFSs based on correlation coefficient and entropy measure. To this end, the correlation coefficient is proposed for the relationship measurement between LPFSs. Afterwards, two entropy measures are developed to calculate the attribute weight information. Then, a novel linguistic Pythagorean fuzzy TOPSIS (LPF-TOPSIS) method is proposed to solve multiple attribute decision-making problems. Finally, the LPF-TOPSIS method is applied to handle a case concerning the selection of firewall productions, and then, a case concerning the security evaluation of computer systems is given to conduct the comparative analysis between the proposed LPF-TOPSIS method and previous decision-making methods for validating the superiority of the proposed LPF-TOPSIS method.

/pdf/topsis-method-based-on-correlation-coefficient-and-entropy-1lh2niqkbm.pdf

TOPSIS Method Based on Correlation Coefficient and Entropy Measure for Linguistic Pythagorean Fuzzy Sets and Its Application to Multiple Attribute Decision Making

Vulnerability retrospection of security solutions for software-defined Cyber–Physical System against DDoS and IoT-DDoS attacks

This paper presents a mechanism to improve firewall packet filtering time through optimizing the order of security policy filtering fields for early packet rejection. The proposed mechanism is based on the optimization of the filtering fields order according to traffic statistics. Furthermore, the mechanism uses multilevel packet filtering, and in each level unwanted packets are rejected as early as possible. So, the proposed mechanism can be considered also as a device protection mechanism against denial of service (DoS) attacks targeting the default policy rule. In addition, early packet acceptance is done through using the splay tree data structure which changes dynamically according to traffic flows. So, repeated packets will have less memory accesses and therefore reducing the overall packets matching time. The proposed technique aims to overcome some of the performance limitations of the previous technique, named Self Adjusting Binary Search on Prefix Length [1] (SA-BSPL). The numerical results obtained by simulations demonstrate that the proposed mechanism is able to significantly improve the firewall performance in terms of cumulative packet processing time compared to SA-BSPL technique.

Multilevel early packet filtering technique based on traffic statistics and splay trees for firewall performance improvement

A novel approach is presented to improve firewall packet filtering through optimising the order of firewall rules for early packet acceptance as well as the order of rule-fields for early packet rejection. The proposed approach is based on the calculation of the histograms of packet matching rules and of packet not matching rule-fields. These histograms are able to effectively monitor firewall performance in real-time and to predict the patterns of packet filtering in terms of rules order and rule-fields order. Furthermore, the proposed approach becomes even more significant when firewall is heavily loaded with burst traffic. A comparison of the proposed approach and the other conventional approaches, including static rule order approach and dynamic rule order approach is presented. The numerical results obtained by simulations demonstrate that the proposed approach is able to significantly improve the firewall efficiency in terms of cumulative processing time compared to other conventional approaches. Furthermore, the proposed scheme also has the capability to significantly reduce the effect of many common network attacks on firewall performance.

Dynamic rule and rule-field optimisation for improving firewall performance and security

Stateful firewalls keep track of the state of network connections. The performance of stateful firewalls depends mainly on the processing of session tables and the mechanism used for packet filtering. This paper presents a stateful session table architecture for a splay tree firewall. A splay tree firewall organizes firewall rules in a designated prefix length splay tree data structure, combined with a collection of hash tables grouped by a prefix length. When using a splay tree firewall, packet filtering time is essentially reduced through multilevel filtering paths, where unwanted packets are rejected as early as possible. The proposed session table architecture reduces memory space consumption and packet filtering time, as it uses one hash slot per connection. Keeping information related to each connection in one session entry produces additional processing time, particularly for processing session timeouts. The proposed session architecture separates session state and timeout information into different data structures. Under DoS attacks, the proposed architecture compares non-first packets directly with a splay tree firewall. Consequently, packets are rejected early on, and thus avoiding the extra computational overhead caused by hash function calculation and session table processing.

Safaa Zeidan

Papers

Multilevel early packet filtering technique based on traffic statistics and splay trees for firewall performance improvement

Dynamic rule and rule-field optimisation for improving firewall performance and security

Improved Session Table Architecture for Denial of Stateful Firewall Attacks

Statistical dynamic splay tree filters towards multilevel firewall packet filtering enhancement

Dynamic traffic awareness statistical model for firewall performance enhancement