% introduction

In the last few years we saw how far technology has succeeded, especially in the IT world.
New paradigms as SDN and NFV have started to overthrow the traditional way to do networking and this gives the possibility to grow up to all the new computation environment, especially the ones regarding the ``Cloud''.

All of us use a huge number of devices which are always connected to the network and they steadily send great amount of data around Internet.
Generally these smart-devices are well integrated with the paradigms previous mentioned. Keywords as Cloud computing has been used to mean technological progress and future hi-tech.
They are so helpful to stay in contact with family and friends often far from us, but also work remotely, especially in these few past months we saw the real potential of these devices.

Alongside the continuous expansion of these connected devices, it grows the areas to be\break exploited which could be victim of cyber attacks due to new vulnerabilities introduced. NIST statistics~\cite{vuln} show that in last three years the discovered vulnerabilities grow from 14,086 in 2017, to 17,308 in 2018 until they reach 20,362 in 2019 and this trend will not stop.

For those reasons a lot of security issues rise each day, they are not coming only from big enterprises, but also from the common users, who start to question themselves on the security of their own data and the protection of their privacy. 

Pre-existing infrastructures suffer the growing demand of bigger bandwidth and high-speed connections for all the ``Real Time'' applications, which puts under pressure the network devices.
The Network Service Providers prefer to get the best quality of their services to their paying customers and this leads to a less care on the network security to save hardware and software resources to spend on own services.

The amount of data and information produced by smart-devices have become huge and they cannot be handled and stored by companies, which have started to move into cloud solutions. For this purpose nowadays the cyber security for those infrastructures is a daily topic to be studied and a lot of works is being done in this direction to make the cloud environment completely protected. 
The justification, to spend efforts by companies and by the Research world, it is to seek in the impact of a cyber attack on the global economy, for example the ``Indian Banks data breach'' in 2016 3.2 millions of credit cards where stolen.

The annual study examination of the financial impact, by IBM~\cite{ibm-breach} on data breaches of\break organization. It highlights the cost of data breach has risen 12\% over the last past five years and now it costs \$3.92 million on average. The picture depicted below (Figure~\ref{fig:damge}) shows the trend of cost damages to organizations from 2005 to 2019.

%\begin{figure}[H]
%	\centerline{\includegraphics[width=0.8\textwidth, height=0.25\textheight]
%		{data-branch.jpg}}
%	\caption{Damage in U.S. dollars due to cyber-attacks}
%	\label{fig:damge}
%\end{figure}


\begin{figure}[H]
	\centerline{\includegraphics[width=0.82\textwidth]
		{latex_files/pdf/cyber-attacks.pdf}}
	\caption{Data breaches and }
	\label{fig:damge}
\end{figure}

These protection leakages are fed by networking administrators that have to face security issues without strong tools and suitable systems, which lead in discrepancies in the security policy definition that brings misconfigurations and incorrect operations.

Management of security controls still suffer the lack of dynamism in management functions and security controls. This is due to manual operations and device configurations that the network administrator has to face every time a change happens in the cloud infrastructure. In a cloud environment creating new instances and moving them from a server to another it is an ordinary operation. Due to the frequency of changes in software network, handling policy migration could be an impossible manual task. In addition, the manual configuration of security devices is prone to errors.

Enforcement of security requirements could limit the power and effectiveness of software\break networks, therefore, it is an important research goal supporting security administrators when enforcing security policies in software networks.

Current technologies as Software Defined Networking and Network Function Virtualization are already used to provide security, but these technologies are exploited to provide functionalities in the same way that are provided in a traditional network. For this reason further activities can be carried out regarding security management and resource optimization.

The main objective of this thesis is to extend elasticity and easy management exploited in the networking also to security controls. The aim of the project is to develop a framework which gets support to the security administrator during the policy definition and the infrastructure management. Moreover it is focused on the optimization of security polices thorough the conflict analysis, which finds anomalies, and the optimization of resources utilization to get better performance as expressed as latency, bandwidth and CPU consumption.

In the workflow entailed by the tool, high-level security requirements are specified by the security administrator. However, the actual device configuration is automatically performed by the tool, hence avoiding human errors and misconfigurations. Any topology change triggers an automatic reconfiguration of all filtering controls, which are building blocks of firewall, with rules that enforce the desired security requirements.
\pagebreak

The main contribution of this thesis is the optimized distribution model which, starting from the traffic pattern analysis, understands what are the filtering points crossed by specific packets. 
The model allows the choice of the filtering control to configure to achieve the better performance, minimized delay and maximized bandwidth. 
This gets a first optimization goal that is to reduce the number of rules in each filtering point, which provides a second optimization result to get a better use of the available resources.

The framework takes advantage of the virtualization to optimize the location of security rules in distinct point over the infrastructure providing dynamism and flexibility in security controls as well as they are provided in the networking.

A \textit{Proof of Concept} is developed as support for this thesis work to evaluate the system previous defined and to confirm the feasibility of it. 
This objective is achieved through the analysis of a cloud infrastructure (e.g. OpenStack, Kubernetes) that relies on SDN and NFV technologies, which are used to perform an optimal distribution.
The optimization model is proved by the implementation of tests for performance and validation of it, which highlight excellent scalability features.  

From this thesis work it comes out that the same networking flexibility can be reached also for security controls, without losing in performance if compared to physical appliances. Moreover, the automation of security and management operations get to better usage of resources and to an increase of the security level provided.

The thesis is structured in the following chapters and topics.
\begin{itemize}
	\item 
	Chapter \ref{chap:intro} briefly introduces the problems and the idea of this thesis;
	\item
	Chapter \ref{chap:background} describes all the background knowledge studied to develop this thesis. It starts from the virtualization and cloud computing, to talk about virtualized networking and firewalls;
	\item
	Chapter \ref{chap:state-of-art} presents the new networking paradigms and the network security policies principles. The former topic explains \textit{Software Defined Networking} (SDN) and \textit{Network Function Virtualization} (NFV) architectures and what are the advantages of these technologies, the latter is about security analysis and conflicts;
	\item
	Chapter \ref{chap:goals} defines the thesis' goal, moreover it provides a use-case definition to understand the problem to be solved;
	\item
	Chapter \ref{chap:infra_analysis} analyses the infrastructure on which the thesis is developed and it performs performance tests on it;
	\item
	Chapter \ref{chap:solution_design} provides a complete description of the solution design and the system workflow. It defines the proposed model for the optimization and distribution;
	\item
	Chapter \ref{chap:implementation} shows what choices were taken to implement the security system and what libraries were exploited to achieve the tasks; 
	\item
	Chapter \ref{chap:testing} presents all the tests to validate and to evaluate the solution proposed;
	\item
	Chapter \ref{chap:conclusion} analyses the results obtained from the performance tests and it summarizes the goals achieved. The chapter exposes additional research direction that may be followed to extend and to improve the system functionalities;
	\item
	Appendix \ref{cap:programmerManual} is the manual for future developers which will maintain and develop additional functions to understand the code structure and how the different modules interact between them;
	\item
	Appendix \ref{cap:pathModels} presents forwarding models used to design the distribution model.
\end{itemize}


