Firewall fingerprinting

—Firewalls are critical security devices handling all traffic in and out of a network. Firewalls, like other software and hardware network devices, have vulnerabilities, which can be exploited by motivated attackers. However, because firewalls are usually placed in the network such that they are transparent to the end users, it is very hard to identify them and use their corresponding vulnerabilities to attack them. In this paper, we study firewall fingerprinting, in which one can use firewall decisions on TCP packets with unusual flags and machine learning techniques for inferring firewall implementation.

• Type: Journal
• Year: 2012
• Where: INFOCOM
• Authors: Amir R. Khakpour, Joshua W. Hulst, Zihui Ge, Alex X. Liu, Dan Pei, Jia Wang
• Keywords: Communications, Critical Security, INFOCOM 2012, Network Firewalls, Tcp Packets