Global Verification and Dynamic Optimization of Network Security Polices

流量访问控制策略对计算机网络的安全和性能起着至关重要的作用。该方案为研究策略对网络安全和性能的影响提供了理论基础和实用技术。该项目建议开发一个框架来验证不同安全设备之间的端到端安全属性。理想情况下，这样的框架将能够发现策略不一致和安全违规，并帮助纠正问题。该提案的第二部分提出了新的流量驱动的统计策略优化技术，动态调整策略结构，以最大限度地减少数据包匹配开销和分配过滤负载。特别的努力已经表明，这些技术是有效的，强大的，实际deployable.We期望这项研究的结果奠定了基础，在该地区的政策验证和优化的新的研究方向。此外，本文的研究成果还可以应用于安全测试与评估、异常检测、网络防御等领域。因此，总的来说，我们希望这个项目能够显着提高网络安全的执行和性能。

Traffic access control polices play a critical role in the security and performance of computer networks. This proposal presents a theoretical foundation and practical techniques to study of the impact of policies on network security and performance. This project proposes to develop a framework to validate end-to-end security properties across different security devices. Ideally, such a framework would enable the discovery of policy inconsistencies and of security violations, and assist to correct the problems. The second part of this proposal presents novel traffic-driven statistical policy optimization techniques that adapt the policy structure dynamically to minimize packet matching overhead and distribute the filtering load. Special effort has been taken to show that these techniques are efficient, robust, and practically deployable.We expect the results of this research to lay foundations for new research directions in the area of policy verification, and optimization. Moreover, the results of this research can benefit other areas such as security testing and evaluation, anomaly detection, and network defense. Thus, in general, we expect this project to significantly improve both the enforcement and performance of network security.