Vasudevan Nagendra

Vasudevan Nagendra, Abhishek Pokala, Arani Bhattacharya et al.

Proactive detection of network configuration bugs is important to ensure its proper functioning and reduce cost of network administrator. In this research, we propose to build the control plane verification engine MAVERICK that detects the bugs in the network control plane i.e., network device configurations and control plane states. MAVERICK automatically infers signatures for the control plane configurations (e.g., ACLs, route-maps, route-policies and so on) and states that allows administrators to automatically detect bugs with minimal human intervention. MAVERICK achieves this by effectively leveraging any structural deviation i.e., outliers in the network configurations that is organized as simple or complexly nested key-value pairs. The outliers that are calculated using signature-based outlier detection mechanism are further characterized for its severity and ranked or re-prioritized according to their criticality. We consider a wide set of heuristics and domain expertise factors for effectively to reduce both false positives and false negatives.Our evaluation on four medium to large-scale enterprise networks show that MAVERICK can automatically detect the bugs present in the network with approximately 75% accuracy. Further-more, With minimal administrator input i.e., with a few minutes of signature re-tuning, MAVERICK allows the administrators to effectively detect approximately 94 - 100% of the bugs present in the network, thereby ranking down less severe bugs and removing false positives.

Vasudevan Nagendra, Arani Bhattacharya, Vinod Yegneswaran et al.

Consumer IoT is characterized by heterogeneous devices with diverse functionality and programming interfaces. This lack of homogeneity makes the integration and security management of IoT infrastructures a daunting task for users and administrators. In this paper, we introduce VISCR, a Vendor-Independent policy Specification and Conflict Resolution engine that enables conflict-free policy specification and enforcement in IoT environments. VISCR converts the topology of the IoT infrastructure into a tree-based abstraction and translates existing policies from heterogeneous vendor-specific programming languages such as Groovy-based SmartThings, OpenHAB, IFTTT-based templates, and MUD-based profiles into a vendor-independent graph-based specification. Using the two, VISCR can automatically detect rouge policies, conflicts, and bugs for coherent automation. Upon detection, VISCR infers new policies and proposes them to users as alternatives to existing policies for fine-tuning and conflict-free enforcement. We evaluated VISCR using a dataset of 907 IoT apps, programmed using heterogeneous automation specifications in a simulated smart-building IoT infrastructure. In our experiments, among 907 IoT apps, VISCR exposed 342 of IoT apps as exhibiting one or more violations. VISCR detected 100% of violations reported by existing state-of-the-art tool, while detecting new types of violations in an additional 266 apps. In terms of performance, VISCR can generate 400 abstraction trees (used in specifying policies) with 100K leaf nodes in <1.2sec. In our experiments, VISCR took 80.7 seconds to analyze our infrastructure of 907 apps; a 14.2X reduction compared to the state-of-the-art. After the initial analysis, VISCR is capable of adopting new policies in sub-second latency to handle changes.