ANALYSIS OF LINUX OS SECURITY TOOLS FOR PACKET FILTERING AND PROCESSING

Open-source software and its components are widely used in various products, solutions, and applications, even in closed-source. Majority of them are made on Linux or Unix based systems. Netfilter framework is one of the examples. It is used for packet filtering, load-balancing, and many other manipulations with network traffic. Netfilter based packet filter iptables has been most common firewall tool for Linux systems for more than two decades. Successor of iptables – nftables was introduced in 2014. It was designed to overcome various iptables limitations. However, it hasn’t received wide popularity and transition is still ongoing. In recent years researchers and developers around the world are searching for solution to increase performance of packet processing tools. For that purpose, many of them trying to utilize eBPF (Extended Berkeley Packet Filter) with XDP (Express Data Path) data path. This paper focused on analyzing Linux OS packet filters and comparing their performances in different scenarios.

FMNISCF: Fine-Grained Multi-Domain Network Interconnection Security Control Framework

The integrated air-ground multi-domain network provides users with a set of shared infrastructures. Security policies can be defined flexibly in the context of multi-domain network semantics. The packet filter module in the security gateway can run efficiently, which is an urgent requirement in this network environment. The framework combined with multi-domain network semantics implements the transformation into rules. It replaces the traditional manual method of configuring rules. The framework supports the whole life cycle management of rules from generation state and distribution state to execution state. In the aspect of security, the map security and semantic security are analyzed and optimized, respectively. Finally, through a series of experiments, compared with iptables/DPDK-IPFW/BSD-IPFW/BSD-pfsense, the high efficiency of the scheme is verified.

Comparison of Seismocardiography Based Heart Rate Measurement Method

The article describes a new alternative method of detecting the Aorta Open fiducial point based on digital signal processing formulated from the average seismocardiogram cycle obtained from the 6-degree-of-freedom Micro Electro-Mechanical Systems Inertial Measurement Unit, enabling estimation of heartbeat during heart muscle contraction without reference to electrocardiogram time period. Using the seismocardiography data obtained from the Inertial Measurement Unit, the authors then process the data using two methods: 1) Empirical Mode Decomposition and 2) Jerk signal, which is extracted as a first derivative of the Inertial Measurement Unit signal. As an example, we compare the two proposed methods to the existing method. Our Method 2 allows us to detect Aorta Open-Aorta Open value between 400ms and 450ms using Berkeley Packet Filter 5-15 Hz with dynamic peak threshold from the Hilbert envelope. Thus, the evaluation of the new method’s effectiveness is confirmed by the estimation of the Aorta Open-Aorta Open fiducial point as closer to the reference. Therefore, the result of our research, especially using jerk signal, can be considered a more accurate alternative for estimating heart rate or heartbeat based on seismocardiogram.

МОДЕЛЬ АБСТРАКТНОГО МЕРЕЖЕВОГО ПАКЕТНОГО ФІЛЬТРА З МОЖЛИВІСТЮ КЛАСИФІКАЦІЇ ОДНОРАНГОВОЇ ВЗАЄМОДІЇ

Develop a mathematical model of an abstract network packet filter with the ability to classify Peer-to-Peer interactions. Used methods of mathematical modeling, simulation modeling for the method of group method of data handling and methods of mathematical statistics. Verification of effectiveness of the proposed models and methods is performed by comparing various metrics of the classifier of peer-to-peer interaction. The combination of different approaches in the synthesis of network filter rules allows us to abstract from the transport layer protocols, the rules are described as a binary tree that is searched for peer-to-peer interaction properties.