NeTS-NBD: Automatic Validation, Optimization, and Adaptation of Distributed Firewalls for Network Performance and Security

随着互联网成为我们日常计算和通信基础设施的重要组成部分，它也成长为一个难以描述的复杂的分布式系统。已经有大量关于网络拓扑、IP可达性和路由动态的研究来分析端到端的分组转发性能。然而，对于路径上发生的其他数据包转换的影响，例如防火墙、数据包过滤和服务质量映射，很少有系统的调查。其中，防火墙无处不在，成为企业网络中不可缺少的安全防御机制。正如路由器配置错误可能导致不可预知的路由问题一样，错误配置的防火墙可能无法实施预期的安全策略，或者可能导致较高的数据包处理延迟。遗憾的是，为大型、复杂的企业网络配置防火墙是一项要求很高且容易出错的任务，即使对于经验丰富的管理员也是如此。防火墙可以分布在网络的许多部分或跨层(IP层过滤与应用层解决方案)，以协作实现全球、网络范围的策略。由于分布式防火墙规则是级联的，因此预测产生的端到端行为以及它是否符合更高级别的安全策略变得非常困难。智力优势：在这个项目中，主要调查者(PI)建议为分布式防火墙的策略检查、优化和自动重新配置开发一个统一的框架。这项研究将提供新的分析、设计技术和工具，以更好地保护我们的关键信息基础设施免受攻击。PIS将探索为可能在地理上分布的商业网络由不同的本地互联网服务提供商提供服务的企业提供一致和有效的安全保护。他们采用跨学科的技术方法，利用在网络、安全和编程语言和编译器领域具有专业知识的三个PI之间的多路通信来设计一个综合解决方案。特别是，PI建议通过将其作为静态程序分析问题来系统地处理该问题，利用来自编程语言和编译器领域的成熟和严格的技术。PI将执行以下密切相关的任务：安全策略验证：PI首先对防火墙配置中所有可能的策略异常(包括不一致和低效)进行分类。他们将防火墙建模为有限状态转换系统，并对这些有限状态表示应用符号模型检查技术来检测防火墙内和防火墙间的策略异常。策略验证方法由两个阶段组成。首先，他们执行控制流分析并确定所有可能的流动路径。其次，它们执行数据流分析并检查每条路径上的异常。识别大多数防火墙内和防火墙间异常可以在一次遍历中完成。每条路径的处理结果进一步用于识别路径间错误配置。性能策略优化：在典型的防火墙设置中，数据包与规则列表进行顺序比较，直到该数据包与规则匹配。具有复杂规则集的防火墙可能会导致网络流量的严重延迟，因此成为瓶颈(尤其是在高速网络中)，并成为DoS攻击的有吸引力的目标。因此，优化数据包过滤以满足网络服务质量(Qos)要求是非常重要的。此外，配置的规则总数和规则的顺序也对防火墙的负载和效率起着重要作用。PI通过将过滤规则表示为二叉决策图(BDDS)并从内部BDD表示生成“最佳过滤规则集”来解决这个问题。它们还应用数据流分析，将相同或相似的规则从不同路径提升到公共位置，以减少流量。它们将在优化步骤中利用底层网络拓扑、路由和流量分布信息来提高防火墙检查的效率，从而增强数据包转发性能。这种方法的主要优势是能够主动预防防火墙中的漏洞，因为可以在实际部署防火墙之前应用静态分析。广泛影响：拟议的研究工作将帮助系统和网络管理员更安全、更高效地配置联网系统。针对本科生和研究生的教育部分是对研究活动的补充。研究成果将纳入新的和现有的课程。PI将积极参与加州大学戴维斯分校的少数族裔外联计划，从代表不足的群体中招募学生进入科学和工程专业。此外，还将分发项目中开发的防火墙配置工具用于教学

As the Internet becomes an essential part of our everyday computing and communication infrastructure, it has also grown to be a complex distributed system that is hard to characterize. There have been numerous studies on network topology, IP-reachability, and routing dynamics to analyze end-to-end packet forwarding performance. However, there is very little systematic investigation into the influence of other packet transformations that happen along the path, e.g., firewalls, packet filtering, and quality-of-service mapping. Among these, firewalls are ubiquitous as they become indispensable security defense mechanisms used in business and enterprise networks. Just as router mis-configurations can lead to unpredictable routing problems, misconfigured firewalls may fail to enforce the intended security policies, or may incur high packet processing delay. Unfortunately, firewall configuration for a large, complex enterprise network is a demanding and error-prone task, even for experienced administrators. Firewalls can be distributed in many parts of the network or across layers (IP-layer filtering versus application-layer solutions) to cooperatively achieve a global, network-wide policy. As distributed firewall rules are concatenated, it becomes extremely difficult to predict the resulting end-to-end behavior and whether it meets the higher-level security policy.Intellectual merit: In this project, the principal investigators (PIs) propose to develop a unified framework for policy-checking, optimization, and auto-reconfiguration of distributed firewalls. This research will provide novel analysis, design techniques, and tools to better protect our critical information infrastructures from attacks. The PIs will explore providing consistent and efficient security protection for an enterprise that may have geographically distributed business networks served by different local Internet Service Providers. They adopt an inter-disciplinary technical approach that leverages multi-way communications among the three PIs with expertise in networking, security, and programming languages and compilers areas to design an integrated solution. In particular, the PIs propose a systematic treatment of the problem by casting it as a static program analysis question, exploiting well-established and rigorous techniques from the area of programming languages and compilers. The PIs will pursue the following closely related tasks:Policy Validation for Security: The PIs first classify all possible policy anomalies (including both inconsistency and inefficiency) in firewall configurations. They will model firewalls as finite-state transition systems and apply symbolic model checking techniques on these finite-state representations to detect both intra-firewall and inter-firewall policy anomalies. The policy validation method consists of two phases. First, they perform control-flow analysis and identify all possible flow paths. Second, they perform data-flow analysis and check for anomalies on every path. Identifying most intra-firewall and inter-firewall anomalies can be accomplished in one traversal. The processing results of each path are further used to identify inter-path misconfigurations.Policy Optimization for Performance: In a typical firewall setting, a packet is compared against a list of rules sequentially until the packet matches a rule. Firewalls with complex rule sets can cause significant delays on network traffic and therefore becomes a bottleneck (especially in high-speed networks) and an attractive target for DoS attacks. Therefore, it is important to optimize packet filtering to provide network Quality of Service (QoS) requirement. In addition, the total number of rules configured and the order of rules also play major roles in the load and efficiency of a firewall. The PIs approach this problem by representing filtering rules as binary decision diagrams (BDDs) and generating "optimal filter rule sets" from the internal BDD representation. They also apply dataflow analysis to hoist same or similar rules from different paths to a common location to reduce traffic. They will leverage the underlying network topology, routing, and traffic distribution information in the optimization step to improve the efficiency of firewall checking, which enhances packet-forwarding performance. The key advantage of this approach is the ability to pro-actively prevent vulnerabilities in firewalls since static analysis can be applied before the actual deployment of firewalls.Broader Impacts: The proposed research efforts will help system and network administrators to configure networked systems more securely and efficiently. The educational component, which is directed at both undergraduate and graduate students, complements the research activities. Research results will be incorporated into new and existing courses. The PIs will actively participate in UC Davis' minority outreach programs to recruit students from underrepresented groups into science and engineering. In addition, firewall configuration tools developed in the project will be distributed for teaching