Improvements in software defined networking allow for policy to be informed and modified by data-driven applications that can adjust policy to accommodate fluctuating requirements at line speed. However, there is some concern that over-correction can occur and cause unintended consequences depending on the data received. This is particularly problematic for network security features, such as machine-learning intrusion detection systems. We present Safeguard, a rule-based policy that overlaps a data-driven policy to prevent unintended responses for edge cases in network traffic. We develop a reference implementation of a network traffic classifier that enforces firewall rules for malicious traffic, and show how additional rulesets to allow known-good traffic are essential in utilizing a data-driven network policy.

翻译：软件定义网络的进步使得策略能够由数据驱动型应用提供信息并进行修改，这些应用能够以线速调整策略以适应波动的需求。然而，人们担心可能会发生过度校正，并根据接收到的数据导致意外后果。这对于机器学习入侵检测系统等网络安全功能尤其成问题。我们提出了Safeguard，这是一种基于规则的策略，它与数据驱动策略重叠，以防止对网络流量边缘情况产生意外响应。我们开发了一个网络流量分类器的参考实现，用于对恶意流量强制执行防火墙规则，并展示了允许已知良性流量的附加规则集对于利用数据驱动网络策略至关重要。