Test frameworks for network security devices

随着互联网的诸多好处而来的是众所周知的危险。连接到互联网的计算机面临着源源不断的攻击。第一道防线是防火墙。家庭防火墙可以作为个人电脑软件或作为“家庭路由器”出售的廉价设备获得。强大的商业防火墙保护web服务器和商业局域网，以及用于制造和发电的工业网络。每个防火墙都包含一套过滤规则，旨在允许合法的互联网数据包，并过滤掉所有其他数据包。不幸的是，很难制定出精确做到这一点的规则。今天的互联网应用程序使用复杂的协议，黑客经常使他们的攻击数据包看起来与合法数据包非常相似。因此，防火墙过滤规则长而复杂，并且经常包含错误。系统测试可以帮助在安装防火墙之前找到错误。IP语音（VoIP）是一种令人兴奋的新应用：一种廉价且全球可用的互联网电话服务。不幸的是，VoIP协议也很复杂。目前尚不清楚如何修改现有的过滤规则，以允许VoIP流量，同时仍然阻止非法流量。如果没有这方面的研究，VoIP的好处将伴随着重大的安全缺陷。本研究项目将通过两种方式提高防火墙的有效性：(1)通过开发软件来自动测试过滤规则，在防火墙安装之前发现错误；(2)通过开发和测试专门针对新VoIP协议的防火墙过滤规则。

Along with the many benefits of the Internet come the well known dangers. Computers connected to the Internet face a steady stream of attacks. The first line of defense is the firewall. Home firewalls are available as PC software or inexpensive appliances sold as "home routers". Powerful commercial firewalls protect web servers and business LANs, as well as industrial networks used for manufacturing and power generation. Each firewall contains a set of filtering rules designed to permit legal Internet packets and to filter out all other packets. Unfortunately, it is difficult to develop rules which do this precisely. Today's Internet applications use complex protocols and hackers often make their attack packets look very similar to legal packets. As a result, firewall filtering rules are long and complex, and often contain errors. Systematic testing can help find the errors before the firewalls are installed. Voice over IP (VoIP) is an exciting new application: an Internet telephone service which is inexpensive and globally available. Unfortunately, the VoIP protocols are also complex. It is not yet understood how to modify existing filtering rules to allow VoIP traffic and still block illegal traffic. Without research in this area, the benefits of VoIP will come with significant security drawbacks. This research project will improve firewall effectiveness in two ways: (1) by developing software to automatically test filtering rules, revealing errors before the firewalls are installed, and (2) by developing and testing firewall filtering rules specifically aimed at the new VoIP protocols.