Finding Network Misconfigurations by Automatic Template Inference
Finding Network Misconfigurations by Automatic Template Inference
复制标题
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
S. Kakarla;Alan Tang;Ryan Beckett;Karthick Jayaraman;T. Millstein;Y. Tamir;G. Varghese
中科院分区：
文献类型：
--
作者：
S. Kakarla;Alan Tang;Ryan Beckett;Karthick Jayaraman;T. Millstein;Y. Tamir;G. Varghese
检测路由器配置错误的网络验证通常需要明确的正确性规范。不幸的是，规范通常要么不存在，要么不完整，要么是用英语非正式地编写的。我们描述了一种方法来推断可能的网络配置错误没有规范，通过一种形式的自动离群值检测。与以前的技术不同，我们的方法可以识别离群值，即使是复杂的，结构化的配置元素，有各种故意的节点之间的差异，如访问控制列表，前缀列表和路由策略。给定一组配置元素，我们的算法自动推断出一组参数化模板，将（可能的）故意差异建模为模板内的变化，同时将（可能的）错误差异建模为模板间的变化。我们已经在一个名为SELFSTARTER的工具中实现了我们的算法，我们称之为结构化泛化，并使用它来自动识别来自大型云提供商的数据中心网络集合中的配置离群值，来自同一云提供商的广域网，以及大型大学的校园网络。SELFSTARTER在所有三个网络中发现了错误配置，包括43个以前未知的错误，并且正在一家主要云提供商的配置管理系统中采用。
Network verification to detect router configuration errors typically requires an explicit correctness specification. Unfortunately, specifications often either do not exist, are incomplete, or are written informally in English. We describe an approach to infer likely network configuration errors without a specification through a form of automated outlier detection. Unlike prior techniques, our approach can identify outliers even for complex, structured configuration elements that have a variety of intentional differences across nodes, like accesscontrol lists, prefix lists, and route policies. Given a collection of configuration elements, our algorithm automatically infers a set of parameterized templates, modeling the (likely) intentional differences as variations within a template while modeling the (likely) erroneous differences as variations across templates. We have implemented our algorithm, which we call structured generalization, in a tool called SELFSTARTER and used it to automatically identify configuration outliers in a collection of datacenter networks from a large cloud provider, the wide-area network from the same cloud provider, and the campus network of a large university. SELFSTARTER found misconfigurations in all three networks, including 43 previously unknown bugs, and is in the process of adoption in the configuration management system of a major cloud provider.