2026· SINTEZA· pp. 354-359· 0 citations· 8 references
TL;DR
Research results indicate that pfSense, with properly configured IDS/IPS systems, can effectively detect and block a significant percentage of attacks, making it a reliable solution for network protection, particularly in resource-constrained environments.
Abstract
: In the contemporary digital landscape, network security represents a critical challenge due to the increasing frequency and sophistication of cyberattacks. Firewall systems play a central role in protecting network infrastructure by filtering traffic and controlling access. pfSense, an open-source firewall solution based on the FreeBSD platform, offers a wide range of features, including VPN, IDS/IPS, and advanced traffic control mechanisms. This paper analyzes the effectiveness of the pfSense system in detecting and preventing various types of network attacks through experimental testing in both virtual and physical environments. The experiments encompass port scanning, brute-force attacks, and DDoS scenarios, utilizing tools such as Nmap, Hydra, and hping3. Research results indicate that pfSense, with properly configured IDS/IPS systems, can effectively detect and block a significant percentage of attacks, making it a reliable solution for network protection, particularly in resource-constrained environments.
Distributed Denial-of-Service (DDoS) attacks remain one of the most significant cyber threats faced by Software-Defined Networking (SDN) architectures, essentially because of the salient decoupling of the control and data planes. This study examines the implications of DDoS attacks on the SDN data plane and evaluates the effectiveness of Machine Learning (ML) algorithms in detecting and addressing these attacks in real time. Using the Ryu controller, Mininet network emulator, and OpenFlow protocol, a realistic experimental environment was created to provide an accurate replica of the dynamic SDN behaviour under adverse circumstances. Empirical studies have demonstrated that distributed DDoS attacks, such as SYN, UDP, and ICMP flooding, substantially degrade network performance by reducing throughput, increasing packet loss, and exhausting switch flow table resources. To mitigate these effects, a suite of supervised machine learning classifiers, including Decision Tree, Random Forest, Support Vector Machine (SVM), K-Nearest Neighbors (KNN), and Naïve Bayes (NB), was instantiated and evaluated using traffic features captured on the emulated platform. The key performance indicators used to evaluate the classifiers included accuracy, precision, recall, and F1-score. The findings indicate that the Decision Tree and KNN models achieved detection rates above the 99% mark, with strong precision and recall scores, which in turn highlights their suitability for implementation in SDN-based security systems. This study provides experimental evidence that ML-based intrusion detection mechanisms can significantly enhance the resilience of SDNs to volumetric attacks. These results promote the implementation of adaptive and responsive security modules in SDN controllers, thereby increasing network resilience, particularly in large and dynamically programmable networks.
Kamal Singh, B. Kumar· international journal of eng...· 0 citations
Although 5G networks can virtually partition resources, the flexibility provided by slicing in B5G networks raises multi-tenant security concerns, such as coordinated hijacking of resources by spoofed identities. Traditional allocation models focus exclusively on performance and function in a purely reactive mode of post-anomaly detection. In this paper, we propose a proactive resource allocation model with a security-oriented approach, formulated as an integer linear programming (ILP) problem. The model incorporates easy-to-simulate suspicion variables into user-level functionalities, which narrow down multi-slice spoofing, reduce the need to throttle high-risk users, and enable the identification of coordinated attacks in real time, thanks to the conflict-detection variables. Experimental validation demonstrates that the framework proactively detects malicious actors, ensures resources are allocated fairly for legitimate uses, and maintains computational viability at the edge for orchestration.
Sameer Ali, H. Rifà-Pous· International Conference on...· 0 citations
The adaptive outline lessens controller CPU utilization, speeds up mitigation response times, lowers end-to-end latency, and keeps higher throughput when compared to static mitigation procedures, according to experimental evaluations carried out in a precise SDN emulation environment.
Nirzari Patel, H. Patel· International journal of com...· 0 citations
As cyber threats increasingly employ cryptographically concealed and stealthy communication, traditional signature-based Network Intrusion Detection Systems (NIDS) encounter severe limitations in achieving end-to-end operational visibility. This study delivers a quantitative comparative analysis contrasting signature-based frameworks against metadata-driven Network Detection and Response (NDR) within a unified Security Information and Event Management (SIEM) platform. Configured with a massive ruleset of 47,192 active signatures, the NIDS engine was evaluated against the behavioral metadata abstraction of NDR across five structured attack scenarios mapping the Cyber Kill Chain. Experimental results reveal a critical Visibility Gap in post-exploitation defenses; while NIDS achieved a 60\% Detection Rate by intercepting noisy initial reconnaissance and exploit payloads, it suffered total blindness during post-exploitation maneuvers. Conversely, the NDR engine achieved a 100\% Detection Rate, isolating deterministic forensic indicators including a 716.33-second encrypted command and control (C2) session and a 7.07 MB volumetric data exfiltration burst. Furthermore, architectural benchmarking revealed that massive rule compilation induced structural management plane synchronization failures. These findings synthesize into validated recommendations for sensor optimization, establishing an operational framework for specialized role allocation and computational efficiency to eliminate visibility blind spots within enterprise Security Operations Center (SOC) environments.
Christian Hary, Muhammad Salman· Jurnal Locus Penelitian dan...· 0 citations
A 5G network slicing intrusion detection mechanism, called the DDoS Defense Model on 5G Network Slices (2D5NS) which integrates machine learning and real-time traffic monitoring techniques to detect and mitigate DDoS attacks within an O-RAN is proposed.
Kun-Lin Tsai, Shih-Ting Chiu, Chihhsiong Shih et al.· Computer Modeling in Enginee...· 0 citations
Perimeter-based security appliances, such as firewalls or Intrusion Detection Systems, are ineffective against modern attacks that use pivoting, wherein attackers"pivot"traffic through compromised hosts to gain access to additional targets that would otherwise be inaccessible. Due to the legitimate appearance of the relayed traffic, pivoting is extremely difficult to detect. Although the consequences of these attacks are known to be severe, existing defenses suffer from drawbacks such as high processing delays, low accuracy, or reliance on network-wide participation, making them inconvenient or even ineffective. This work presents Stitch, a host-based system that uses the programmable kernel to detect pivoting in real time. By observing host-traversing flows, Stitch uses process tracing to effectively combine system and network-level information, connecting incoming and outgoing communications and identifying pivoting characteristics between them. Showing 31% gains in accuracy over state-of-the-art pivoting defenses and a maximum false positive rate of 0.006% over two separate real-world deployments, Stitch covers the gap in current pivot detection solutions by providing accurate, lightweight, and independent coverage for vulnerable hosts in a network.
Ava Powelson, Carson Kuzniar, Hyojoon Kim et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
