Distributed Firewall with Dynamic Intrusion Detection Module
Total Page:16
File Type:pdf, Size:1020Kb
International Journal of Advanced Research in Engineering and Technology (IJARET) Volume 12, Issue 4, April 2021, pp. 484-491, Article ID: IJARET_12_04_046 Available online at https://iaeme.com/Home/issue/IJARET?Volume=12&Issue=4 ISSN Print: 0976-6480 and ISSN Online: 0976-6499 DOI: 10.34218/IJARET.12.4.2021.046 © IAEME Publication Scopus Indexed DISTRIBUTED FIREWALL WITH DYNAMIC INTRUSION DETECTION MODULE Dr. Zalte S.S. Department of Computer Science, Shivaji University, Kolhapur, India Patil P.N Department of Computer Science, Vishwakarma College of Arts, Commerce and Science, Pune, India Deshmukh S.N. Department of Computer Science, Vishwakarma College of Arts, Commerce and Science, Pune, India ABSTRACT Computers and Internet, both are becoming an essential part of life. With computer networks we are sharing resources, exchanging information, and number of personal transactions which must be secured from unauthorized access, with Network Security we can prevent and detect unauthorized access. So, we can maintain integrity, confidentiality and accessibility of computer networks. One way to achieve Network Security is FIREWALL. A firewall is a system which monitors and filters traffic and gives entry/ blocks data packets based on a set of security rules. Distributed firewall is introduced to eliminate the problems which are difficult to solved in conventional firewalls. Distributed firewall is not restricted by topology and entry point as conventional firewall. Distributed firewall secure critical network endpoints, it provides unlimited Scalability and overcomes single point of failure problems. In this paper, we have proposed Distributed Firewall with Dynamic Intrusion Detection Module to achieve elevated security to the network. Key words: Network Security, Distributed Firewall, computer networks, Policy, Threats, Intrusion Detection. Cite this Article: Zalte S.S, Patil P.N and Deshmukh S.N, Distributed Firewall with Dynamic Intrusion Detection Module, International Journal of Advanced Research in Engineering and Technology, 12(4), 2021, pp. 484-491. https://iaeme.com/Home/issue/IJARET?Volume=12&Issue=4 https://iaeme.com/Home/journal/IJARET 484 [email protected] Distributed Firewall with Dynamic Intrusion Detection Module 1. INTRODUCTION In a pandemic situation, the internet network has become an essential part of our life. Every second, the number of personal transactions occurs with the use of the Internet. Rather than processing, computer networks are mostly used only for transmission of information and data. To prevent hacking of confidential data or unauthorized access or virus attack, network security is vital. With a firewall we can accomplish network security. A firewall is a hardware device or set of instructions between two networks that filters the traffic and allows or denies access to the sensitive data transmission through the network following some security rules. Firewall prevents access to unauthorized users and provides protection from outside cyber attackers by defending computers or networks from malware or unnecessary network traffic. A firewall creates a barrier between an untrusted network and a trusted network. 2. CONVENTIONAL FIREWALL A firewall is a mechanism that supervises and filters in and outgoing network traffic based on predetermined security rules [1]. There are some policies and codes to protect data from outside networks. Data may be hacked within the organization. Most destructive attacks can occur inside the network due to no restriction in the internal network. Some drawbacks of conventional firewall as follows: • Convectional firewall heavily depends on network topology [2]. • In conventional firewalls there may be risk of internal network attack. • Not all protocols are handled in conventional firewalls. • There is a single-entry point and failure of this leads to problems. • Log record is not maintained for all network activities. • Cannot enforce Password policy and its prevention from misuse. Figure 1 3. DISTRIBUTED FIREWALL DESIGN Distributed firewalls are host-resident security domain software applications that protect the enterprise network’s servers and end-user machines against unwanted Intrusion and secure the network by protecting serious points, exactly where hackers want to enter [3]. They are like private firewalls excluding they offer several important advantages like central management, logging, and in some cases, access-control granularity. These topographies are necessary to implement corporate security policies in larger enterprises. https://iaeme.com/Home/journal/IJARET 485 [email protected] Zalte S.S, Patil P.N and Deshmukh S.N Distributed firewalls solved the single point-of failure problem presented by the firewall. A feature of distributed firewalls is centralized management. To give consistent security policies helps and maximizes limited resources it gives the ability to populate Servers and end-users’ machines to configure. Distributed firewalls help in two ways. Remote end-user machines can be secured. Secondly, they secure critical network endpoints where hackers want to enter. Preventing intrusion by malicious code and detaining other such code by not letting the protected server be used as a launch pad for expanded attacks. Distributed firewall allows implementation of security policy without restricting topology in and outside point of view. 4. COMPONENTS OF DISTRIBUTED FIREWALL Policy Language: The policy language is the set of rules used to create policies for each of the firewalls., which direct the firewall in how to evaluate the network traffic. security policy language describes what connections are permitted or prohibited. After policy is getting compiled it is shipped to the end points. Policy Distribution: The system management tools are used to allocate the policy to the firewalls and to collect logging and reporting information. The policy distribution mechanism should guarantee the integrity of the policy during transfer [4]. This policy is checked before processing the incoming or outgoing messages. The distribution of the policy can be different and differs with the implementation. It can be either directly pushed to the internet host, or pulled when necessary, or it may even be provided credentials to the users when they try to communicate with the hosts. Policies are distributed according to one of the following distribution schemes: • Policies as well as authorizations can be pushed to every single end point in the policy domain. • Policies and authorizations can be pulled from a trusted repository during initialization. • Policies are pulled during initialization of the policy verifier whereas authorizations for authentication mechanisms remain on a trusted repository and are requested whenever communication traffic is reaching a node from a yet unknown host. Certificate For identification of a particular host there may be the chance of using an IP address, distributed firewalls mechanism of security is more important [2]. It is preferred to use certificates to identify hosts. IPsec provides cryptographic certificates. To secure network traffic and the transmission of policies. Source can then be uniquely verified by their certificate. It is about analyzing and constructing protocols that overcome the influence of adversaries and which are related to various aspects in information security such as data privacy, data integrity, authentication and non-repudiation. Unlike IP addresses, which can be easily spoofed, the digital certificate is much more secure and the authentication of the certificate is not easily forged. Policies are distributed by means of these certificates. In implementation of distributed firewall technology, policy languages are translated into some internal format by a compiler. This policy file is distributed to all the protected hosts by the system management software. A mechanism applies the security policy to incoming packets or connections and the incoming packet accepted or rejected by each host according to policy and the cryptographically verified identity of each sender (Ioannidis). Different variations may exist in implementation of distributed firewall technology. These variations are called a hybrid firewall, which is a combination of traditional firewall and distributed firewall. https://iaeme.com/Home/journal/IJARET 486 [email protected] Distributed Firewall with Dynamic Intrusion Detection Module 5. POLICIES The security policies transmitted from the central management server have to be applied by the user-end. The end-user part of the Distributed Firewall does give any organizational control for the network administrator to control the implementation of security policies. The end-user allows traffic based on the security rules it has implemented. A “security policy” defines the security guidelines of a system. Without a distinct security policy, there is no way to know what access is permitted or rejected. A simple example for a firewall is: a) It Allow all connections to the web server. Reject all other access. b) The distribution of the policy can be varying with the implementation. It can be either directly sent to end systems, or received when necessary. Pull Technique: Pull Technique While booting up, hosts knock to the central management server to verify whether the central management server is up and live [4]. It registers with the central management server and sends requests for its policies which it should implement. The central management server offers the host with its security policies.