Submitted by Automa??o e Estat?stica (sst@bczm.ufrn.br) on 2017-12-04T22:14:23Z No. of bitstreams: 1 EdmilsonPereiraDaCostaJunior_DISSERT.pdf: 2118431 bytes, checksum: 87f09da8ed14aa4157990289aa46f4eb (MD5) / Approved for entry into archive by Arlan Eloi Leite Silva (eloihistoriador@yahoo.com.br) on 2017-12-11T20:56:25Z (GMT) No. of bitstreams: 1 EdmilsonPereiraDaCostaJunior_DISSERT.pdf: 2118431 bytes, checksum: 87f09da8ed14aa4157990289aa46f4eb (MD5) / Made available in DSpace on 2017-12-11T20:56:25Z (GMT). No. of bitstreams: 1 EdmilsonPereiraDaCostaJunior_DISSERT.pdf: 2118431 bytes, checksum: 87f09da8ed14aa4157990289aa46f4eb (MD5) Previous issue date: 2017-08-25 / O firewall de borda desempenha um papel fundamental para seguran?a das redes corporativas, agindo como primeira barreira de defesa ao delimitar um per?metro seguro. Entretanto, a cultura do Bring Your Own Device dificulta a no??o de dom?nio seguro, contribuindo para a cria??o de vetores de ataques dentro do per?metro seguro. Os sistemas de firewall distribu?do surgiram com a proposta de prover prote??o de hosts individuais a ataques originados na pr?pria rede interna. Em tais sistemas, as regras s?o criadas de modo centralizado e ent?o distribu?das e aplicadas em todos os servidores que comp?em o firewall, restringindo quais servi?os devem estar dispon?veis. N?o obstante, vulnerabilidades em software podem tornar os servi?os de rede vulner?veis a ataques, uma vez que firewalls usualmente n?o analisam os protocolos de aplica??o. Neste sentido, a partir da descoberta da vulnerabilidade at? a publica??o e aplica??o dos patches de corre??o existe uma janela de exposi??o que deve ser reduzida. Dado este cen?rio, o presente trabalho apresenta uma proposta de um sistema de firewall distribu?do auto-adaptativo. Esta proposta ? baseada no monitoramento de hosts e no uso de um sistema de avalia??o de vulnerabilidades para detectar servi?os vulner?veis, integrado com componentes capazes de decidir e aplicar regras de firewall nos hosts afetados. Desse modo, esta abordagem ? capaz de responder a vulnerabilidades descobertas nesses hosts, contribuindo para mitigar o risco de explora??o da vulnerabilidade. Nosso sistema foi avaliado no contexto de um estudo de caso que simula um ambiente de rede corporativa, onde os resultados alcan?ados demonstram sua viabilidade. / The border firewall play a fundamental role for corporate network security, acting as the first defense barrier delimiting a secure perimeter. However, the culture of Bring Your Own Device weakens the notion of secure domain, contributing to the creation of attack vectors inside the secure perimeter. Distributed firewall systems emerged with the proposal of protecting individual hosts against attacks originating from inside the network. In such systems, firewall rules are created centrally, then distributed and enforced on all servers that compose the firewall, restricting which services should be available. Meanwhile, software vulnerabilities can make network services vulnerable to attacks, since firewalls usually do not scan application protocols. In this sense, from the discovery of a vulnerability until the publication and application of patches there is an exposure window that must be reduced. Given this scenario, the present work presents a proposal of a self-adaptive distributed firewall system. This proposal is based on monitoring hosts and using a vulnerability assessment system to detect vulnerable services, integrated with components capable of deciding and applying firewall rules on affected hosts. In this way, our approach is able to respond to vulnerabilities discovered in these hosts, helping to mitigate the risk of exploiting the vulnerability. Our system was evaluated in the context of a case study that simulates a corporate network environment, where the results achieved demonstrate its viability.