1- Introduction

2- Current state and recent initiatives of Turkey in cyberspace

3- Country-wide large-scale cyber-attacks in Turkey

4- National cyber firewall projects

5- Background of the study and related work

6- Seddulbahir – Turkey

7- Conclusion

References

Abstract

This research introduces “Seddulbahir,” the first Turkish national cyber-firewall system. Proposed as the first of its kind, Seddulbahir resists possible cyber-attack threats against Turkey’s internet infrastructure. Seddulbahir uses the artificial neural network radial basis function (RBF-NN) approach to generate rules that can detect 21 different attacks classified as probing, DoS (Denial of Service), U2R (User-to-Root), and R2L (Remote-to-Local) through the analysis of 66 different network service flows and based on three communication protocols. Results indicate that our proposed approach detects abnormal traffic with high efficiency, low cost, and has a wide detection range, providing accurate, flexible, and effective results in contrast to traditional methods. This paper also outlines the current state of cyberspace in Turkey, provides an analysis and detailed model of the latest cyber-attacks generated against Turkey, and investigates the working mechanisms of national cyber firewall systems used by developed countries such as Russia, China, and the United States.

Introduction

In developed countries such as the U.S.A., U.S.S.R., the United Kingdom, and China and after World War II, the superpowers diversified their investments in various innovative cyber infrastructures. Since then, these governments have developed new cyber security approaches and policies, established cyber-armies, and designed new hardware and software technologies in order to emerge as global cyber-powers. The main theme behind these investments was not “how to harm” but “how to benefit by inflicting harm” through using aggressive Internet tactics that would hinder and/or stop potential perpetrators. One of the main reasons, among others, of this diversification of development in cyberspace is that traditional military strikes are observable by the people under attack at the moment they occur, and their effects can be anticipated. On the other hand, a cyber-weapon attack is not seen or easily anticipated, and the attack itself typically involves temporary damage and no permanent harm. The possible military wars that might occur between developed countries leads to permanent harm and considerable loss in terms of power, politic, demographic, societal, financial, economic and international dimensions, as experienced in WWII. For this reason, cyber weapons emerged and are used in war between developed countries. Today, these wars take place in the cyber world. However, in developing or underdeveloped countries, this advancement seems less while military battles continue.

The proliferation of the Internet brings tremendous impact on the society, and simultaneously shows its power in unmasking the illness of the society and challenging the authority of political regimes (Schwartz, 2005). The regulation on the Internet could be seen all around the world ( Thomas et al., 1998) and China is a typical example to pierce the governance on the Internet and how people react to the regulation. The Chinese Internet market has expanded rapidly over the past decade and the Internet penetration rate in China has reached 53.2% by the end of 2016 (CNNIC, 2017). Research questions about how Chinese people use the Internet for political or civil purposes and how Chinese government regulates the Internet have garnered enormous attention internationally (e.g., King et al., 2013; King et al., 2014; Roberts, 2015; Kou et al., 2017). The Great Fire Wall (GFW thereafter) is a well-known Internet regulation system which endorses stringent governance to filter sensitive or untrue contents and block access to Western websites such as Facebook, Twitter, YouTube and Google. Prior studies have made great efforts to explore what kind of content are likely to be censored (e.g., Hughes and Wacker, 2003; King et al., 2013; King et al., 2014), how the filtering system works in different place and by different censors (e.g., Dong, 2012; Lacharite, 2002), how censorship is conducted on social media (e.g., Bamman et al., 2012; MacKinnon, 2009). With most of the previous research mainly focusing on the mechanism or the technical infrastructure of Internet regulation, only a few studies have explored how Chinese netizens cope with the censorship system (e.g., Mulvenon, and Chase, 2005; Guo and Feng, 2011; Yang and Liu, 2014; Roberts, 2015), and even few of them addressed the impact of Internet censorship on the public with a causation relationship. This study aims to examine the influence of Internet censorship on Chinese users’ tendency of self-censorship through a controlled experiment.

The Internet has been used in various types of devices like laptop, desktop, smartphones, household equipment, sensors, Internet of Things etc. So it becomes the essential part of our daily life. As a connectivity of the network increases day by day, there are a lot of network security threats in our daily life. In recent years, all kinds of security attacks break out continuously such as in Russia there were over 100 user accounts were hacked, Dailymotion sites data were hacked 85.2 email addresses extracted, Myspace data hacked, a malicious attack on the Reserve Bank of India [1]. That’s why it has become extremely important to protect our server or web assets. How should we proceed to establish a secure environment? There are many ways to ensure the security of your dedicated server, we will discuss firewalls their usage and configuration and which may be best for a different application.

LINUX FIREWALL A

firewall is an important tool that protects itself and other hosts on a network from an attacker on untrusted network[2]. A firewall can be very beneficial if it was used as a filter towards all of the Internet access to and from the system passes through it. A firewall system can also be configured to conceal multiple hosts behind a single Internet protocol address using a process known as Network Address Translation. The firewall protected server’s schema as shown in figure 1.

II. KEY TECHNOLOGY

A. NETFILTER

Netfilter is a packet filtering framework provided by the Linux kernel which allows different networking related operations to be implemented in the form of customized handlers[3][4]. It gives different functions and operations for network address translation, packet filtering, and port translation. It serves the functionality that is needed for guiding packets over a network likewise for serving a capacity to block the packets from reaching sensitive location with a computer network.

The Main function of a firewall is to protect the network from an untrusted network, by filtering the packets passing throw it, the process of filtering those packets is done across a secure policy. A firewall in a computer network performs a role that is very similar to that of a firewall in a building. Just as a firewall made out of concrete protects one part of a building, a firewall in a network ensures that if something bad happens on one side of the firewall, computers on the other side won’t be affected. Unlike a building firewall, which protects against a very specific threat (fire), a network firewall has to protect against many different kinds of threats like Viruses, Worms, DoS [1, 11-16]

II. TERMS AND VOCABULARY

In order to understand how firewall works, we have to know a little about networks, here is some important terms: Firewall: S. Cobb [2] define a firewall as a collection of components or a system that is placed between two networks and possesses the following properties: • All traffic from inside to outside, and vice-versa, must pass through it. • Only authorized traffic, as defined by the local security policy, is allowed to pass through it. • The firewall itself is immune to penetration. Packet: A packet is the unit of data that is routed between an origin and a destination on the Internet or any other network. When any file (e-mail message, HTML file, Graphics Interchange Format file, Uniform Resource Locator request, and so forth) is sent from one place to another on the Internet, the Transmission Control Protocol (TCP) layer of TCP/IP divides the file into “chunks” of an efficient size for routing. Each of these packets is separately numbered and includes the Internet address of the destination. The individual packets for a given file may travel different routes through the Internet (or the network). When they have all arrived, they are reassembled into the original file (by the TCP layer at the receiving end) [11-16]. TCP/IP: In order to understand the TCP/IP we quote from this article[4]: TCP is a protocol that runs on top of IP. IP takes care of delivering packets. For the remainder of this article, it is relevant that each IP packet contains two addresses: the address of the source of the packet and the address of the destination of the packet. TCP adds a reliable, connection oriented service to IP. It makes sure that there is a reliable data stream between source and destination. TCP avoids duplication of transmitted data and avoids delivering data out of order. In order to be able to setup multiple connections between two hosts, TCP adds so-called ports to IP addresses. These ports identify the connection endpoints on the source and destination. The combination of source port, source address, destination port and destination address are unique for every TCP connection. TCP uses a three-way handshake to setup a connection.

Firewalls are the first line of defense and the most widely used tool in cyber security. They can be very powerful if applied correctly, but they are limited in their scope. Packets are analyzed as they come in and compared to a set of priorities. The limitation is that the priorities can only read and act on the header information of the packet: this includes data like the type, source IP address and port number, and the destination IP address and port number. Therefore the ability to act on incoming packets is quick but may miss attacks that are based on packet content. For example, a cross-site scripting attack could come from any IP; a firewall cannot predict where this attack will come from, so a new tool is needed to analyze packet content. Intrusion Detection Systems (IDS) serve exactly that purpose. IDS’ can be very powerful due to their ability to look inside packets at all the information. Consider the scenario: an IDS could look at a packet attempting a cross-site scripting and notice the exact text attempting the attack and compare that to a known cross-site scripting signature. A limitation for an IDS is that it can be slower. When taking into account its ability to analyze more data, a slower analysis time is certainly reasonable. Traditional and current firewall systems are failing. The increase in both the number of attacks and the complexity of attacks has put the conventional system out of date. The Hiscox Cyber Readiness Report 2017 [1] interviewed 3000 companies across the U.S., U.K., and Germany. According to the report 53% of companies were poorly prepared and only 30% were very prepared for cyber-attacks. This lack of preperation is concerning as cyber-attacks have such an effect on both the economy and people’s personal lives. The total cost of cybercrime was $450 billion, and 2 billion personal records were stolen in 2016 [2]. The most recent WannaCry ransomware attack in May of 2017 infected more than 230,000 computers in 150 countries. It encrypted all the files on a system and demanded a $300 payment to unencrypt them. This attack was especially harmful in Europe where it infected multiple hospitals’ systems [3]. Not only as computer users do we have to be concerned about our own security, but the security of companies and organizations that we rely.