Delimiting access in networks based on virtual connection models

An urgent scientific and technical task at present is to develop and improve methods and means of access control in IP networks based on detecting and blocking virtual connections that pose a threat to information security of network resources. In this paper we propose an approach to solving this problem, based on the representation of each virtual connection in the form of state model. This model includes both deterministic parameters of the network, transport and application levels of interconnection, as well as statistical characteristics of IP-packet flow. The parameters of the model are analysed by the firewall, which runs in stealth mode. It is based on the set-theoretic virtual connection model proposed by the author, as well as on the filtering rules algebra, which formally describes the policy of access to network resources. A description of the developed virtual connection state models, a technique to detect flood attacks based on analysis of statistical characteristics of virtual connections, as well as firewall architecture that implements the results obtained in the work are presented.