用自然语言自动配置网络访问控制规则，避免冲突并减少冗余
Automating Conflict-Aware ACL Configurations with Natural Language Intents
- 通过大模型理解自然语言意图，自动生成完整ACL规则
- 检测并解决新旧规则间100级以上的冲突，减少约40%规则新增
- 适合云网络运维人员，显著提升配置效率与准确性
ACL配置对管理网络流量可达性至关重要，但随着网络拓扑和已有规则的复杂化，其配置难度急剧上升。操作员需（1）理解新策略意图并转化为具体ACL规则，（2）检查并解决新旧规则间的冲突，（3）部署到全网。现有系统严重依赖人工，尤其在前两步中耗时、易错且难以扩展。我们提出Xumi，利用具备网络领域知识的大模型，自动精准地将自然语言意图转换为完整的ACL规则，减少人工负担。Xumi随后检测所有潜在冲突，生成经修正的可部署意图，并在操作员指导下确定最优部署方案，以最小化规则新增。评估表明，相比现有实践，Xumi使整个配置流程提速超10倍，解决了约100个冲突，现代云网络中规则新增量降低约40%。
原文摘要 · Abstract (English)
ACL configuration is essential for managing network flow reachability, yet its complexity grows significantly with topologies and pre-existing rules. To carry out ACL configuration, the operator needs to (1) understand the new configuration policies or intents and translate them into concrete ACL rules, (2) check and resolve any conflicts between the new and existing rules, and (3) deploy them across the network. Existing systems rely heavily on manual efforts for these tasks, especially for the first two, which are tedious, error-prone, and impractical to scale. We propose Xumi to tackle this problem. Leveraging LLMs with domain knowledge of the target network, Xumi automatically and accurately translates the natural language intents into complete ACL rules to reduce operators' manual efforts. Xumi then detects all potential conflicts between new and existing rules and generates resolved intents for deployment with operators' guidance, and finally identifies the best deployment plan that minimizes the rule additions while satisfying all intents. Evaluation shows that Xumi accelerates the entire configuration pipeline by over 10x compared to current practices, addresses O(100) conflicting ACLs and reduces rule additions by ~40% in modern cloud network.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。