Study of methods for endpoint aware inspection in a next generation firewall

Area of Science:

• Cybersecurity
• Network Security
• Computer Science

Background:

• The rise of remote work and cloud computing challenges traditional network perimeters.
• Next-generation firewalls (NGFWs) face difficulties in distinguishing legitimate from malicious traffic.
• Endpoint application identification is essential for accurate security and minimizing false positives/negatives.

Purpose of the Study:

• To analyze research and methods for endpoint-aware protection within NGFWs.
• To review academic research and current NGFW implementations.
• To identify gaps and future research directions in endpoint-aware inspection.

Main Methods:

• Categorization of endpoint application identification into passive and active methods.
• Analysis of passive methods, including traffic fingerprinting for various protocols.
• Examination of active methods: active scanning, endpoint metadata analysis, and content injection.

Main Results:

• Passive methods utilize traffic fingerprinting for protocol analysis.
• Active methods involve scanning, metadata analysis, and content injection.
• Current implementations and academic research show diverse approaches to endpoint identification.

Conclusions:

• No single method provides a comprehensive solution for endpoint-aware inspection in NGFWs.
• Several areas require further research to enhance endpoint-aware security.
• This study is the first to comprehensively review endpoint-aware inspection research and implementations for NGFWs.