Test frameworks for network security devices

在互联网带来诸多好处的同时，众所周知的危险也随之而来。连接到互联网的电脑面临着源源不断的攻击。第一道防线是防火墙。家庭防火墙可以作为PC软件提供，也可以作为“家庭路由器”出售。强大的商业防火墙可保护Web服务器和企业局域网，以及用于制造和发电的工业网络。每个防火墙都包含一组过滤规则，旨在允许合法的Internet数据包并过滤掉所有其他数据包。不幸的是，很难制定出准确做到这一点的规则。今天的互联网应用使用复杂的协议，黑客经常让他们的攻击数据包看起来非常类似于合法数据包。因此，防火墙过滤规则既长又复杂，而且经常包含错误。系统测试有助于在安装防火墙之前发现错误。IP语音(VoIP)是一种令人兴奋的新应用：一种廉价的全球可用的互联网电话服务。不幸的是，VoIP协议也很复杂。目前还不清楚如何修改现有的过滤规则以允许VoIP流量并仍然阻止非法流量。如果没有这方面的研究，VoIP的好处将伴随着重大的安全缺陷。该研究项目将从两个方面提高防火墙的有效性：(1)通过开发软件来自动测试过滤规则，在防火墙安装之前发现错误；(2)通过开发和测试专门针对新的VoIP协议的防火墙过滤规则。

Along with the many benefits of the Internet come the well known dangers. Computers connected to the Internet face a steady stream of attacks. The first line of defense is the firewall. Home firewalls are available as PC software or inexpensive appliances sold as "home routers". Powerful commercial firewalls protect web servers and business LANs, as well as industrial networks used for manufacturing and power generation. Each firewall contains a set of filtering rules designed to permit legal Internet packets and to filter out all other packets. Unfortunately, it is difficult to develop rules which do this precisely. Today's Internet applications use complex protocols and hackers often make their attack packets look very similar to legal packets. As a result, firewall filtering rules are long and complex, and often contain errors. Systematic testing can help find the errors before the firewalls are installed. Voice over IP (VoIP) is an exciting new application: an Internet telephone service which is inexpensive and globally available. Unfortunately, the VoIP protocols are also complex. It is not yet understood how to modify existing filtering rules to allow VoIP traffic and still block illegal traffic. Without research in this area, the benefits of VoIP will come with significant security drawbacks. This research project will improve firewall effectiveness in two ways: (1) by developing software to automatically test filtering rules, revealing errors before the firewalls are installed, and (2) by developing and testing firewall filtering rules specifically aimed at the new VoIP protocols.