NeTS-NBD: Automatic Validation, Optimization, and Adaptation of Distributed Firewalls for Network Performance and Security

随着互联网成为我们日常计算和通信基础设施的重要组成部分，它也发展成为一个难以描述的复杂分布式系统。人们对网络拓扑、ip可达性和路由动态进行了大量研究，以分析端到端数据包转发性能。然而，很少有系统地研究沿着路径发生的其他数据包转换的影响，例如防火墙、数据包过滤和服务质量映射。其中，防火墙无处不在，因为它们已成为商业和企业网络中不可或缺的安全防御机制。正如路由器错误配置可能导致不可预测的路由问题一样，错误配置的防火墙可能无法执行预期的安全策略，或者可能导致较高的数据包处理延迟。不幸的是，为大型、复杂的企业网络配置防火墙是一项要求很高且容易出错的任务，即使对于经验丰富的管理员也是如此。防火墙可以分布在网络的许多部分或跨层（ip层过滤与应用层解决方案），以协同实现全局的网络范围策略。随着分布式防火墙规则的连接，预测最终的端到端行为以及它是否满足更高级别的安全策略变得极其困难。智力优势：在这个项目中，主要研究者（pi）建议为分布式防火墙的策略检查、优化和自动重新配置开发一个统一的框架。这项研究将提供新颖的分析、设计技术和工具，以更好地保护我们的关键信息基础设施免受攻击。pi将探索为企业提供一致和有效的安全保护，这些企业可能在地理上分布着由不同的本地Internet服务提供商提供服务的业务网络。他们采用了一种跨学科的技术方法，利用在网络、安全、编程语言和编译器领域具有专业知识的三个pi之间的多路通信来设计一个集成的解决方案。特别是，pi通过将其作为静态程序分析问题，利用来自编程语言和编译器领域的成熟而严格的技术，提出了对问题的系统处理。pi将执行以下密切相关的任务：安全策略验证：pi首先对防火墙配置中所有可能的策略异常（包括不一致和低效率）进行分类。他们将把防火墙建模为有限状态转换系统，并在这些有限状态表示上应用符号模型检查技术来检测防火墙内和防火墙间的策略异常。策略验证方法包括两个阶段。首先，他们执行控制流分析并确定所有可能的流路径。其次，它们执行数据流分析并检查每个路径上的异常情况。识别大多数防火墙内部和防火墙之间的异常可以在一次遍历中完成。每个路径的处理结果进一步用于识别路径间的错误配置。针对性能的策略优化：在典型的防火墙设置中，将数据包与规则列表进行顺序比较，直到数据包匹配规则为止。具有复杂规则集的防火墙可能会导致网络通信的严重延迟，因此成为瓶颈（特别是在高速网络中），并成为DoS攻击的诱人目标。因此，优化包过滤以满足网络QoS （Quality of Service）的要求是非常重要的。此外，配置的规则总数和规则顺序对防火墙的负载和效率也有重要影响。pi通过将过滤规则表示为二进制决策图（BDD）并从内部BDD表示生成“最优过滤规则集”来解决这个问题。他们还应用数据流分析将相同或类似的规则从不同的路径提升到一个共同的位置，以减少流量。它们将在优化步骤中利用底层网络拓扑、路由和流量分布信息来提高防火墙检查的效率，从而提高数据包转发的性能。这种方法的主要优点是能够主动防止防火墙中的漏洞，因为静态分析可以在实际部署防火墙之前应用。更广泛的影响：提议的研究工作将帮助系统和网络管理员更安全、更有效地配置网络系统。针对本科生和研究生的教育部分是对研究活动的补充。研究成果将被纳入新的和现有的课程。这些pi将积极参与加州大学戴维斯分校的少数族裔外展项目，从代表性不足的群体中招募学生进入科学和工程领域。此外，本项目开发的防火墙配置工具将分发给教学使用

As the Internet becomes an essential part of our everyday computing and communication infrastructure, it has also grown to be a complex distributed system that is hard to characterize. There have been numerous studies on network topology, IP-reachability, and routing dynamics to analyze end-to-end packet forwarding performance. However, there is very little systematic investigation into the influence of other packet transformations that happen along the path, e.g., firewalls, packet filtering, and quality-of-service mapping. Among these, firewalls are ubiquitous as they become indispensable security defense mechanisms used in business and enterprise networks. Just as router mis-configurations can lead to unpredictable routing problems, misconfigured firewalls may fail to enforce the intended security policies, or may incur high packet processing delay. Unfortunately, firewall configuration for a large, complex enterprise network is a demanding and error-prone task, even for experienced administrators. Firewalls can be distributed in many parts of the network or across layers (IP-layer filtering versus application-layer solutions) to cooperatively achieve a global, network-wide policy. As distributed firewall rules are concatenated, it becomes extremely difficult to predict the resulting end-to-end behavior and whether it meets the higher-level security policy.Intellectual merit: In this project, the principal investigators (PIs) propose to develop a unified framework for policy-checking, optimization, and auto-reconfiguration of distributed firewalls. This research will provide novel analysis, design techniques, and tools to better protect our critical information infrastructures from attacks. The PIs will explore providing consistent and efficient security protection for an enterprise that may have geographically distributed business networks served by different local Internet Service Providers. They adopt an inter-disciplinary technical approach that leverages multi-way communications among the three PIs with expertise in networking, security, and programming languages and compilers areas to design an integrated solution. In particular, the PIs propose a systematic treatment of the problem by casting it as a static program analysis question, exploiting well-established and rigorous techniques from the area of programming languages and compilers. The PIs will pursue the following closely related tasks:Policy Validation for Security: The PIs first classify all possible policy anomalies (including both inconsistency and inefficiency) in firewall configurations. They will model firewalls as finite-state transition systems and apply symbolic model checking techniques on these finite-state representations to detect both intra-firewall and inter-firewall policy anomalies. The policy validation method consists of two phases. First, they perform control-flow analysis and identify all possible flow paths. Second, they perform data-flow analysis and check for anomalies on every path. Identifying most intra-firewall and inter-firewall anomalies can be accomplished in one traversal. The processing results of each path are further used to identify inter-path misconfigurations.Policy Optimization for Performance: In a typical firewall setting, a packet is compared against a list of rules sequentially until the packet matches a rule. Firewalls with complex rule sets can cause significant delays on network traffic and therefore becomes a bottleneck (especially in high-speed networks) and an attractive target for DoS attacks. Therefore, it is important to optimize packet filtering to provide network Quality of Service (QoS) requirement. In addition, the total number of rules configured and the order of rules also play major roles in the load and efficiency of a firewall. The PIs approach this problem by representing filtering rules as binary decision diagrams (BDDs) and generating "optimal filter rule sets" from the internal BDD representation. They also apply dataflow analysis to hoist same or similar rules from different paths to a common location to reduce traffic. They will leverage the underlying network topology, routing, and traffic distribution information in the optimization step to improve the efficiency of firewall checking, which enhances packet-forwarding performance. The key advantage of this approach is the ability to pro-actively prevent vulnerabilities in firewalls since static analysis can be applied before the actual deployment of firewalls.Broader Impacts: The proposed research efforts will help system and network administrators to configure networked systems more securely and efficiently. The educational component, which is directed at both undergraduate and graduate students, complements the research activities. Research results will be incorporated into new and existing courses. The PIs will actively participate in UC Davis' minority outreach programs to recruit students from underrepresented groups into science and engineering. In addition, firewall configuration tools developed in the project will be distributed for teaching