用自然语言配置防火墙，让管理员轻松管理策略。
Natural Language Interface for Firewall Configuration
- 通过中间表示分离意图与设备语法，支持多厂商配置。
- 原型可编译为 Palo Alto PAN OS 命令，且有三层验证保障安全。
- 适合需要简化配置、提升可审计性的企业运维人员。
本文提出并实现了面向企业防火墙的自然语言接口框架，使管理员能以自然语言表达访问控制策略，并自动转换为厂商特定配置。该框架采用紧凑的中间表示层，将人类意图与设备语法解耦，当前原型可编译为 Palo Alto PAN OS 命令行配置，同时具备扩展性。大型语言模型仅作为辅助解析器生成类型化的中间表示对象，而编译与执行过程保持确定性。原型集成三层验证机制：静态语法检查器用于验证结构和厂商约束；安全门禁阻止过于宽松的规则（如 any to any 允许）；基于 Batfish 的模拟器在合成设备模型上验证配置语法与引用完整性。论文描述了系统架构、实现及在合成网络上下文数据集上的测试方法，并探讨了该方法如何演变为可扩展、可审计、以人为中心的防火墙策略管理流程。
原文摘要 · Abstract (English)
This paper presents the design and prototype implementation of a natural language interface for configuring enterprise firewalls. The framework allows administrators to express access control policies in plain language, which are then translated into vendor specific configurations. A compact schema bound intermediate representation separates human intent from device syntax and in the current prototype compiles to Palo Alto PAN OS command line configuration while remaining extensible to other platforms. Large language models are used only as assistive parsers that generate typed intermediate representation objects, while compilation and enforcement remain deterministic. The prototype integrates three validation layers, namely a static linter that checks structural and vendor specific constraints, a safety gate that blocks overly permissive rules such as any to any allows, and a Batfish based simulator that validates configuration syntax and referential integrity against a synthetic device model. The paper describes the architecture, implementation, and test methodology on synthetic network context datasets and discusses how this approach can evolve into a scalable auditable and human centered workflow for firewall policy management.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。