Blacknurse Attack: Model and Simulation

The BlackNurse attack is a novel low-rate Denial of Service (LDoS) threat with significant destructive potential against firewalls. We develop a BlackNurse attack model and examine its effects on session-based firewalls, focusing on session table utilization, CPU load, and network throughput. Our experiments show that even at 15 Mbit/s, BlackNurse can increase CPU load to <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{9 0 \%}$</tex> and severely disrupt network traffic. We also analyze CPU load changes (0s-60s) under varying attack packet types, firewall session table capacities (1-20), and packet transmission rates (<tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$1 \mathrm{k} / \mathrm{s}-30 \mathrm{k} / \mathrm{s}$</tex>). These findings underscore the efficiency of the BlackNurse attack and its serious implications for firewall security, providing critical insights for optimizing firewall design and strengthening defense strategies.