A Secure Next-Generation Firewall Architecture Against DDoS Attacks

In the rapidly advancing world of systems and technologies, evolving network security is not just a priority, it is a critical necessity. The focus of network infrastructures and information systems should remain on how to make them secure against cyberattacks. The rate of cyber criminals has significantly risen over the past few years, and it is of the utmost importance to strengthen cybersecurity measures and raise awareness to protect sensitive assets from potential threats. The undeniable demand for effective security solutions continues to grow, as cyber breaches have become widespread, affecting systems and networks across various industries. This trend emphasizes the urgency to implement advanced methods and strategies to counter the rising number and sophistication of cyberattacks, which pose serious threats to both individuals and organizations globally. The primary goal of current security metrics is to anticipate and manage common cyber threats, particularly Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. This involves leveraging predictive scenarios and advanced security tools to identify vulnerabilities and forecast attack patterns. When a threat is detected, automated, real-time defense mechanisms are immediately employed to mitigate the attack's impact. This research aims to develop a secure Next-Generation Firewall architecture against DDoS attacks. It incorporates the use of Next-Generation Firewall (NGFW), Voice over Internet Protocol (VoIP) Traffic, Security Information and Event Management (SIEM), Web Server, Kali Linux, and Layer 2 Switches and Routers across three distinct network layers of Access, Demilitarized Zone (DMZ), and Core. By combining these technologies, the mechanism ensures robust protection and efficient threat mitigation at each network layer. Initially, we will configure a network topology on the EVE-NG platform and VMware Workstation. The Next-Generation Firewall configuration and policy are pivotal in real-time detection and mitigation strategies against DDoS attacks, establishing a secure network architecture. It prevents unauthorized access, enforces strict access controls, and uses advanced threat prevention techniques, which protect the integrity and ensure the availability of critical network resources. VoIP traffic, an essential service within organizations, is highly sensitive and often subjected to DDoS attacks. Due to its reliance on real-time communication and strict latency requirements,disruptions in VoIP services can severely impact operational availability. SIEM management equips the network and data security ecosystem with actionable insights and analytics-driven intelligence, enabling real-time security monitoring, advanced threat identification, incident management, and anomaly detection based on behavioral analytics. The Web Server serves as the web interface in the DMZ layer and counts as another prime target for DDoS attackers. Kali Linux system plays the role of the DDoS attacker in the simulated environment and generates flooding traffic to overwhelm and disrupt services. Switches connect network devices at different layers, primarily at Layer 2 (Data Link Layer) to forward frames based on “Media Access Control” (MAC) addresses. Routers deliver packets from source to destination by optimal paths through routing protocols to provide efficient data transmission across interconnected networks. After thoroughly assessing all security requirements, the network infrastructure advances ahead of potential DDoS attackers, having built an adaptive defense architecture designed to protect its services. The integration of the NGFW and SIEM work in tandem to create a dynamic, resilient security architecture that not only detects and mitigates threats but also continuously evolves to address emerging risks in the ever-changing cyber landscape. The evaluation of both scenarios, one without security controls and the other with defense mechanisms in place, revealed substantial differences in Firepower’s resource metrics. Processor load dropped significantly, from a peak of 88% to an average utilization of 23% across all processing cores. System memory usage declined slightly to 59%, while network bandwidth demand decreased sharply, with outbound data flow falling from 352.86 kbit/s to 10.77 kbit/s. Intrusion prevention logs confirmed that Firepower detected and blocked attack patterns at an early stage, which minimized the time required to identify threats and remove unauthorized traffic. A direct comparison of these scenarios demonstrated the risks of an unprotected network, where unrestricted attack traffic overwhelmed resources and exposed critical services. In contrast, the deployment of Firepower’s multi-layered security policies, alongside Wazuh SIEM’s endpoint analysis, provided a strong mitigation strategy that preserved network stability, optimized resource usage, and ensured uninterrupted service. These results validated the strength of the proposed security architecture to prevent large-scale DDoS flood attacks and protect network infrastructures.