Tutorial eBooks PDF File Download

Microsoft Windows provides a variety of methods by which security software can perform network traffic filtering and other security-related tasks. However, these same capabilities can be used by malicious software, also known as malware, to tap into the operating system’s network architecture in order to circumvent security software, open backdoors, and steal information. A number of articles have been published that discuss and compare the features of different software firewalls, but there are few resources that explore the filtering techniques that these firewalls use. Understanding these filtering techniques is not only useful for choosing a software firewall and troubleshooting problems with it, but it also helps to understand, detect, and prevent the malware threats that exploit inherent weaknesses in them. This paper provides a better understanding of how network traffic is processed by Microsoft Windows operating systems, and how various security tools such as personal firewalls and host intrusion prevention systems monitor network activity to protect a system. It also explores how malware can attack the networking architecture of Windows to disable or circumvent some of these security tools and steal information. The paper focuses on the processing path of TCP/IP network traffic, although most other protocols follow a similar path.