Data Analysis of Network Parameters for Secure Implementations of SDN-Based Firewall

Software-Defined Networking(SDN)is a new network technology that uses programming to complement the data plane with a control plane.To enable safe connection,however,numerous security challenges must be addressed.Flooding attacks have been one of the most prominent risks on the internet for decades,and they are now becoming challenging difficulties in SDN networks.To solve these challenges,we proposed a unique firewall application built on multiple levels of packet filtering to provide a flooding attack prevention system and a layer-based packet detection system.This study offers a systematic strategy for wrapping up the examination of SDN operations.The Mininet simulator examines the effectiveness of SDN-based firewalls at various network tiers.The fundamental network characteristics that specify how SDN should operate.The three main analytical measures of the network are jitter,response time,and throughput.During regular operations,their behavior evaluates in the standard SDN conditions of Transmission Control Protocol(TCP)flooding and User Datagram Protocol(UDP)flooding with no SDN occurrences.Low Orbit Ion Cannon(LOIC)is applied to launch attacks on the transmission by the allocated server.Wireshark and MATLAB are used for the behavioral study to determine how sensitive the parameters are used in the SDN network and monitor the fluctuations of those parameters for different simulated scenarios.

一种适用于Diverse Firewall Design的规则集比较算法

随着防火墙规则数目的增多,Diverse Firewall Design设计方法越来越受到重视。在应用该方法进行规则集设计时,多个开发团队会独立地编写若干规则集。由于规则集配置的复杂性,这些规则集有可能不一致。因此,需要使用规则集比较算法,判断这些规则集是否等价,以达到检测出错误配置的目的。然而现有规则集比较算法,实现复杂且效率较低。针对这一问题,提出了一种基于规则交集运算的规则集比较算法。该算法首先使用规则冲突消除算法对规则集进行预处理,将规则集比较问题,转换成多维空间中的图形比较问题;然后利用规则交集运算,判断图形所占区域和颜色是否一致,进而确定规则集是否等价。理论分析和测试表明,算法能检测出规则集之间的不同点,且时空效率优于现有算法。

基于校园网的FireWall的构架与实现

论述了 Fire Wall的工作原理及在校园网中的架构 ,并利用共享软件 Linux实现了 Fire Wall在校园网中的架构 ;该 Fire Wall最大的优点是经济、实用、安全性高。

基于Full Proxy的NAT/Firewall的穿越

VoIP语音视频流对NAT/F irewall的穿越已经成为语音数据业务开展过程中最大的障碍。Fu ll Proxy提供了一种NAT/F irewall穿越的有效途径,具有很强的适应性和透明性。深入讨论了Fu ll Proxy的实现原理和基于Fu ll Proxy的整个呼叫流程,最后在一个嵌入式双CPU系统的基础上实现了一个Fu ll Proxy。

浅谈Firewall技术

Firewall是一种非常有效的网络安全模型。系统分析了Firewall技术中的主要技术数据包过滤和代理服务技术,同时对Firewall的基本类型进行了比较,从而为企业选择一种访问控制策略提供一定的理论依据。

基于ACE和SSL的Firewall与IDS联动系统研究

随着Internet的迅猛发展,网络攻击的方法和技术越来越智能化和多样化,网络安全需求与日俱增。传统的防火墙(Firewall)与入侵检测系统IDS已不能满足网络安全整体化需求。鉴于此,引入ACE网络通信中间件和SSL协议,采用开放接口方式,从网络安全整体性与动态性的需求考虑,设计了一种新型的基于ACE和SSL通信平台的Firewall和IDS协同联动系统模型。该系统模型融合了Firewall和IDS的优点,采用加密信息传输机制、策略管理机制和联动分析算法,确保了传输信息的可靠性、完整性和机密性。实验结果表明,该联动系统不但能够有效地检测和防御攻击,而且具有良好的协作性、通用性和可扩展性。

用IPTABLES构建LINUX FIREWALL在校园网中的应用

在校园网迅速发展的现在,服务器的安全问题成了网络管理员最为关心的问题。为了提高服务器的安全性,文章提出利用基于LINUX的IPTABLES构建防火墙,然后结合学校实际情况对外提供各种服务,例如:Web、FTP、MAIL等等;并给出了一套关于Web服务的访问进出规则。

Etrust Firewall在校园网络安全中的应用

防火墙是一个或一组系统 ,它能够过滤进入和离开校园计算机网络的数据 ,EtrustFire wall能够根据各种给定的条件来保护网络 ,这些给定的条件既可以是指定的应用程序和指定的网络服务 ,也可以是指定的源地址和目标地址等。它通常以单个规则为基础 ,为校园计算机网络提供一致的安全保护。利用EtrustFirewall可以快速和容易地保护校园计算机网络 。

One-step spraying method to construct superhydrophobic magnesium surface with extraordinary robustness and multi-functions

The robust magnesium surfaces with multi-functions are highly desirable,and the simple and scalable methods to construct such surfaces are urgently indispensable.Herein,we conducted a one-step spraying method to facilely fabricate the robust coating with multi-functions on magnesium alloys.The as-sprayed magnesium alloys surface is superhydrophobic with a static water contact angle(WCA)of 157.0°and a roll-off angle of 6.0°.Such surface has excellent mechanical,chemical and thermal stabilities,even undergoing various physical and chemical damages,including sand impact(10 gmin^(-1),≥20 min),water impact(2 impacts s^(-1),≥180 min),abrasion(1.00 kPa,≥25 cycles),peeling(≥2.15 kPa),high temperature(200°C,≥24 h),strong acidic/salty/basic media(p H=113)and organic-solvent immersion(ethanol and n-hexane,≥24 h),demonstrating brilliant robustness.Notably,the surface displays multi-functions of corrosion protection,anti-fouling and heat insulation,which will undoubtedly promote the much wider applications of magnesium alloys.

An Algorithm for Optimal Firewall Placement in IEC61850 Substations

Recently, most electric power substations have adopted production control systems, such as SCADA systems, which communicate with field devices and remotely control processes from a computer screen. However, these systems together with protection measures and additional control actions (using protocol IEC61850) seem not to be enough to free substations of security attacks (e.g. virus, intruders, forgery or unauthorized data manipulation). This paper analyzes the main features of an electric power substation together with the aspects that might be significantly affected by cyber-attacks. The paper also presents the implementation of a specific security system (i.e. firewall-wise system) intended to protect a target distribution network.

Design of Drilling and Riveting Multi-functional End Effector for CFRP and Aluminum Components in Robotic Aircraft Assembly

To fulfill the demands for higher quality,efficiency and flexibility in aviation industry,a multi-functional end effector is designed to automate the drilling and riveting processes in assembling carbon fiber reinforced polymer(CFRP)and aluminum components for a robotic aircraft assembly system.To meet the specific functional requirements for blind rivet installation on CFRP and aluminum materials,additional modules are incorporated on the end effector aside of the basic processing modules for drilling.And all of these processing modules allow for a onestep-drilling-countersinking process,hole inspection,automatic rivet feed,rivet geometry check,sealant application,rivet insertion and installation.Besides,to guarantee the better quality of the hole drilled and joints riveted,several online detection and adjustment measures are applied to this end effector,including the reference detection and perpendicular calibration,which could effectively ensure the positioning precision and perpendicular accuracy as demanded.Finally,the test result shows that this end effector is capable of producing each hole to a positioning precision within ±0.5 mm,aperpendicular accuracy within 0.3°,a diameter tolerance of H8,and a countersink depth tolerance of±0.01 mm.Moreover,it could drill and rivet up to three joints per minute,with acceptable shearing and tensile strength.

Development of a novel multi-functional integrated bioconjugate effectively targeting K-Ras mutant pancreatic cancer

Folate receptor(FR)overexpression occurs in a variety of cancers,including pancreatic cancer.In addition,enhanced macropinocytosis exists in K-Ras mutant pancreatic cancer.Furthermore,the occurrence of intensive desmoplasia causes a hypoxic microenvironment in pancreatic cancer.In this study,a novel FR-directed,macropinocytosis-enhanced,and highly cytotoxic bioconjugate folate(F)-human serum albumin(HSA)-apoprotein of lidamycin(LDP)-active enediyne(AE)derived from lidamycin was designed and prepared.F-HSA-LDP-AE consisted of four moieties:F,HSA,LDP,and AE.F-HSA-LDP presented high binding efficiency with the FR and pancreatic cancer cells.Its uptake in wild-type cells was more extensive than in K-Ras mutant-type cells.By in vivo optical imaging,F-HSA-LDP displayed prominent tumor-specific biodistribution in pancreatic cancer xenograft-bearing mice,showing clear and lasting tumor localization for 360 h.In the MTT assay,F-HSA-LDP-AE demonstrated potent cytotoxicity in three types of pancreatic cancer cell lines.It also induced apoptosis and caused G2/M cell cycle arrest.F-HSALDP-AE markedly suppressed the tumor growth of AsPc-1 pancreatic cancer xenografts in athymic mice.At well-tolerated doses of 0.5 and 1 mg/kg,(i.v.,twice),the inhibition rates were 91.2%and 94.8%,respectively(P<0.01).The results of this study indicate that the F-HSA-LDP multi-functional bioconjugate might be effective for treating K-Ras mutant pancreatic cancer.

Modeling and Global Conflict Analysis of Firewall Policy

The global view of firewall policy conflict is important for administrators to optimize the policy.It has been lack of appropriate firewall policy global conflict analysis,existing methods focus on local conflict detection.We research the global conflict detection algorithm in this paper.We presented a semantic model that captures more complete classifications of the policy using knowledge concept in rough set.Based on this model,we presented the global conflict formal model,and represent it with OBDD(Ordered Binary Decision Diagram).Then we developed GFPCDA(Global Firewall Policy Conflict Detection Algorithm) algorithm to detect global conflict.In experiment,we evaluated the usability of our semantic model by eliminating the false positives and false negatives caused by incomplete policy semantic model,of a classical algorithm.We compared this algorithm with GFPCDA algorithm.The results show that GFPCDA detects conflicts more precisely and independently,and has better performance.

The Security Technology of E-commence——Intelligent Packet-filtering Firewalls

Research has revealed that, in the next ten to twen ty years, the implementation of E-commence will become a new basis of economic in crease of China and other countries in the world. And the essence of implementin g E-commerce is the credit standing among the banks, the sellers and the custom ers. But the credit standing in the net ultimately depends on the security of th e network. Firewall is a useful network security technology to keep a network fr om being intruded. The rational use of firewalls can strengthen the security of the E-commence system. Traditional package-filtering firewalls usually rej ect the illegal accesses and admit the legal accesses according to filtering pol icy established by the administrator in advance. But the measures of attacking n etworks are increasing, so ACL (access control list) that is established in adva nce can hardly meet the needs of the rapid development of the network. And the r eal-time quality and sensitivity of traditional firewalls are not satisfied. No w a new model of implementing the expert system to the management of network sec urity is brought forward. The focus of the intelligent packet-filtering firewal l lies on the expert system. The tight combination of expert system and the filt ering method can realize the efficient detection and control of the packages tha t flow through the firewall system. By using the intelligent firewall, the secur ity of the E-commence can be strengthened indeed.

Performance Comparison and Simulink Model of Firewall Free BSD and Linux

In recent years, the number of users connected to the Internet has experienced a phenomenal growth. The security of systems and networks become essential. That is why the performance of Linux firewall and Berkeley Software Distribution (BSD) are of paramount importance in security systems and networks in all businesses. The following evaluates the firewall based tool that we have developed in Python and Scapy, which performs time measurements by serving packets traversing the firewall test. Several results were presented: the speed of the firewall under FreeBSD in terms of service time compared to the speed of the firewall under Linux as the number of rules increases;the speed of the filtering rule of a firewall stateless in terms of service time compared to the filtering rule of an active firewall gradually as the number of rules increases. Then, for care of simplicity, we have presented the queue M/M/1/K to model the performances of firewalls. The resulting model was validated using Simulink and mean squared error. The analytical model and Simulink of the firewalls are presented in the article.

配置FirewallD防火墙

FirewallD防火墙可以说取代了iptables防火墙,支持动态更新技术并加入了区域(Zone)的概念,本文对FirewallD防火墙服务组件的功能和日常使用进行了整理。

Distributed Broker-Agent Architecture for Multimedia Communications Traversing NAT/Firewall in NGN

The forthcoming Next Generation Network (NGN) is an all IP network. Multimedia communications over IP networks are a type of bundled session communications, which cannot directly traverse Network Address Translations (NATs) and firewalls even in NGN. To solve the problem that the existing traversal methods are not suitable for service providers to set up a real system in NGN, a Distributed Broker-agent Architecture (DBA) is addressed. DBA is secure and realizable for service providers and enterprises because it is easy to set up and does not need to upgrade the existing devices like Firewalls, NATs or endpoint devices of subscribers. DBA is composed of two-layer distributed agents, the server proxies and the client agents, in which all multimedia communications use shared tunnels to carry signaling messages and media data between broker-agents, and the call signaling is encrypted over Security Socket Layer (SSL) to guarantee the security of calling. Moreover, the function model and multiplexed connection messages format of DBA are designed, which lays a basis for the protocol in the future NGN. In addition, a simple implementation based on H.323 verifyies the main function of traversing firewalls and NATs.

A design and application of compound multi-functional sensor in wood-based panel processing

A compound multi-functional sensor was designed by the study on the on-line testing technology of wood-based panels, and its properties of shape, functions, size, resistance to special environment were studied in details. The operational principles of different sensors, technical flow of manufacturing, development of software systems of special functions, and the assessments of technical specification were also be introduced. This sensor adopted many new technologies, such as the applications of piezoresistant effect and heat sensitive effect can effectively measure the pressure and temperature, digital signal processing technology was used to extract and treat signals, and resist interference, encapsulation technology was used to keep the normal run of sensor under a harsh environment. Thus, the on-line compound multi-functional temperature/pressure sensor can be applied better to supervise the production of wood-based panels. All technical specifications of the compound multi-functional sensor were tested and the results met the requirements of the equipments.

Multi-functional optical fiber sensor system based on a dense wavelength division multiplexer

We propose a novel and efficient multi-functional optical fiber sensor system based on a dense wavelength division multiplexer(DWDM).This system consists of an optical fiber temperature sensor, an optical fiber strain sensor, and a 48-channel DWDM.This system can monitor temperature and strain changes at the same time.The ranges of these two sensors are from-20℃ to 100℃ and from-1000 με to 2000 με, respectively.The sensitivities of the temperature sensor and strain sensor are 0.03572 nm/℃ and 0.03808 nm/N, respectively.With the aid of a broadband source and spectrometer,different kinds and ranges of parameters in the environment can be monitored by using suitable sensors.

Quasi-distribution Appraisal about Finite Element Analysis of Multi-functional Structure Made of Honeycomb Sandwich Materials

A new appraisal method（QDA, quasi-distribution appraisal） which could be used to evaluate the finite element analysis of multi-functional structure made of honeycomb sandwich materials is developed based on sub-section Bezier curve. It is established by simulating the distribution histogram data obtained from the numerical finite element analysis values of a satellite component with sub-section Bezier curve. Being dealt with area normalization method, the simulation curve could be regarded as a kind of probability density function（PDF）, its mathematical expectation and the variance could be used to evaluate the result of finite element analysis. Numerical experiments have indicated that the QDA method demonstrates the intrinsic characteristics of the finite element analysis of multi-functional structure made of honeycomb sandwich materials, as an appraisal method, it is effective and feasible.