% summary

In the last few years we saw how far technology succeeded, especially in the IT world.
New paradigms as SDN and NFV have started to overthrow the traditional way to do networking and this gives the possibility to grow up to all the new computation environment, especially the ones regarding the ``Cloud''.

Electronic devices are increasingly widespread and used by anyone, from all generations, who are always connected to Internet exchanging a big amount of data.
They are so helpful to stay in contact with family and friends often far from us, but also to work remotely, especially in these few past months we saw the real potential of these devices.

New paradigms were born around these technologies as \textit{Software Defined Networking} (SDN) and \textit{Network Function Virtualization} (NFV) which have their natural application in data centers, where the ``Cloud computing'' has started to gain more and more relevance.
The management cost of the network infrastructure decreases using the combination of both technologies, which carry features such as flexibility and resiliency. Those paradigms have some limitations, though, for instance, they do not guarantee any performance.

The continuous expansion of those new technologies and connected smart-devices lead to new vulnerabilities to be exploited by cyber attacks. The security request in cloud environment has begun to be a critical issue to be faced by Cloud Providers, which find in SND and NFV\break technologies the solutions they are looking for.
Customers are not only interested in security matters, but also they want to get the best quality for the services they pay for, this turns in high performance requirements, in terms of latency and bandwidth that network devices need to be achieved, without lost in security.
Usually high level protection and high level performance are conflicts requirements, which get the network providers to choose service quality over security functions for business reasons.

Management of security controls still suffer the lack of dynamism. This is due to manual operations and device configurations that the network administrator has to face every time a change happens in the cloud infrastructure. 

In view of the highlighted problems, this thesis gives its contribution in the design and in the implementation of a framework which aims to provide an \textit{automatic policy-driven security} system. The main goal is to support the network administrator in the definition of security policies, which are customizable for each users, analysing anomalies and conflicts to avoid misconfigurations. The outcome of the tool is a distribution of the filtering rules in such a way the overall infrastructure gains the best performance without any leakage in security protection.

The major contribution provided by this thesis has been the modeling of the security policy and the cloud infrastructure, represented as XSD schemas and the definition of the optimization model. The optimization problem has been modeled as a binary programming model, which, starting from the traffic pattern analysis, understands what are the filtering points crossed by specific packets. The model allows the choice of the filtering control to be configured to achieve the better performance, minimized delay and maximized bandwidth.

Performance tests have been designed and executed to evaluate scalability features of each network node based on number of enforced rules. The results of these tests have been used to determine the coefficients and weights of each filtering point that will be used in the optimization model.

The problem that came out is a MaxSMT problem, which is an NP-complete problem. For this reason the implementation was done through the integration of the \textit{z3 Prover} inside the framework, which is the standard \textit{de facto} between SAT solvers. It provides operations of ``preprocessing'' and ``cube\&conquer'', associated to heuristics, to discard suboptimal solutions to avoid the computational time to explode.

The effectiveness and the validation of the optimization model has been proved by the\break implementation of
performance tests. They show great improvements for what regards latency reduction, larger bandwidth and CPU consumption if compared.

The testing phase highlights that the goal defined at the beginning have been successfully achieved.

The results have highlighted the fact that the distribution can take advantage by the resources already present in the cloud infrastructure, like the built-in filtering modules of OpenStack, instead of instantiating new ones.
This saves hardware resources and improves performances.