TY - GEN
T1 - A study on application layer classification for firewalls using regular expression matching
AU - Marpaung, Jonathan A.P.
AU - Bhakti, M. Agni Catur
AU - Yazid, Setiadi
PY - 2014/1/1
Y1 - 2014/1/1
N2 - Traditional network level firewalls, based on port and IP addresses, are inadequate for dealing with the development of applications and protocols that do not follow the conventions of port services established by IANA (Internet Assigned Numbers Authority). Therefore firewalls capable of accurately classifying and filtering connections based on application information are needed. This paper studies one such firewall using Netfilter/Iptables with the L7-filter packet classifier to perform application layer filtering. This packet classifier uses regular expressions to match applications with a protocol definition database. We analyze a video streaming protocol, the Adobe Real Time Messaging Protocol (RTMP), to produce a protocol definition. Analysis of the performance of the protocol definition and L7-filter usage in general in a simulated network environment shows that this implementation functions well and does not disrupt network performance.
AB - Traditional network level firewalls, based on port and IP addresses, are inadequate for dealing with the development of applications and protocols that do not follow the conventions of port services established by IANA (Internet Assigned Numbers Authority). Therefore firewalls capable of accurately classifying and filtering connections based on application information are needed. This paper studies one such firewall using Netfilter/Iptables with the L7-filter packet classifier to perform application layer filtering. This packet classifier uses regular expressions to match applications with a protocol definition database. We analyze a video streaming protocol, the Adobe Real Time Messaging Protocol (RTMP), to produce a protocol definition. Analysis of the performance of the protocol definition and L7-filter usage in general in a simulated network environment shows that this implementation functions well and does not disrupt network performance.
KW - Application Layer Classification
KW - Firewall
KW - L7-filter
KW - Netfilter/Iptables
KW - Real Time Messaging Protocol
UR - http://www.scopus.com/inward/record.url?scp=84904162349&partnerID=8YFLogxK
U2 - 10.1109/ACSAT.2013.88
DO - 10.1109/ACSAT.2013.88
M3 - Conference contribution
SN - 9781479927586
T3 - Proceedings - 2013 International Conference on Advanced Computer Science Applications and Technologies, ACSAT 2013
SP - 417
EP - 422
BT - Proceedings - 2013 International Conference on Advanced Computer Science Applications and Technologies, ACSAT 2013
PB - IEEE Computer Society
T2 - 2nd International Conference on Advanced Computer Science Applications and Technologies, ACSAT 2013
Y2 - 23 December 2013 through 24 December 2013
ER -