Global Verification and Dynamic Optimization of Network Security Polices

流量访问控制策略对计算机网络的安全和性能起着至关重要的作用。本文为研究策略对网络安全和性能的影响提供了理论基础和实践技术。该项目建议开发一个框架来验证跨不同安全设备的端到端安全属性。理想情况下，这样的框架将能够发现策略不一致和安全违规，并帮助纠正问题。第二部分提出了一种新的流量驱动的统计策略优化技术，该技术动态调整策略结构以最小化数据包匹配开销并分配过滤负载。已经付出了特别的努力来证明这些技术是有效的、健壮的和实际可部署的。我们期望本研究的结果为政策验证和优化领域的新研究方向奠定基础。此外，本文的研究结果对安全测试与评估、异常检测和网络防御等领域也有一定的借鉴意义。因此，总的来说，我们期望这个项目能够显著提高网络安全的执行和性能。

Traffic access control polices play a critical role in the security and performance of computer networks. This proposal presents a theoretical foundation and practical techniques to study of the impact of policies on network security and performance. This project proposes to develop a framework to validate end-to-end security properties across different security devices. Ideally, such a framework would enable the discovery of policy inconsistencies and of security violations, and assist to correct the problems. The second part of this proposal presents novel traffic-driven statistical policy optimization techniques that adapt the policy structure dynamically to minimize packet matching overhead and distribute the filtering load. Special effort has been taken to show that these techniques are efficient, robust, and practically deployable.We expect the results of this research to lay foundations for new research directions in the area of policy verification, and optimization. Moreover, the results of this research can benefit other areas such as security testing and evaluation, anomaly detection, and network defense. Thus, in general, we expect this project to significantly improve both the enforcement and performance of network security.