AL-SAFE: A Secure Self-Adaptable Application-Level Firewall for IaaS Clouds

Overview & Synopsis

The conventional design of application-level firewalls has an inherent deficiency: limited isolation between the firewall and vulnerable applications which increases the probability of a successful attack that disables the firewall (i.e removing hooks from packet filtering functions). Hence, an important question is: Can we retain the same level of increased visibility while limiting the attack surface between any in- fected application and a trusted application-level firewall? To address this question we designed and implemented AL-SAFE a two-level application- level firewall that operates outside of the virtual machine it is monitoring in a completely separate domain.