An Autoblocking Mechanism for Firewall Service

Abstract

A distributed denial-of-service (DDoS) attack could cause the incoming connections per second exceeding the capacity of the firewall device and the network system might be paralyzed. By analyzing the syslog of firewall, we design an effective mechanism to block malicious source IPs automatically from the router. We have undergone a field trial on campus for two years. The collected data shows that our approach significantly reduces suspicious traffic and improve the stability of overall network service.