Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
RefinementEngine automates the translation of high-level security intents into deployable network configurations, addressing the manual and error-prone processes in Security Operations Centers (SOCs). It leverages network topology, device capabilities, and Cyber Threat Intelligence (CTI) to generate device-specific settings that implement desired security intents and counter reported threats. Validation through real-world packet and web filtering policies demonstrates the engine's correctness, practical applicability, and adaptability to new threat data.
Stop manually translating security intent into network rules: RefinementEngine automates the entire process, slashing errors and speeding up deployment.
Translating security intent into deployable network enforcement rules and maintaining their effectiveness despite evolving cyber threats remains a largely manual process in most Security Operations Centers (SOCs). In large and heterogeneous networks, this challenge is complicated by topology-dependent reachability constraints and device-specific security control capabilities, making the process slow, error-prone, and a recurring source of misconfigurations. This paper presents RefinementEngine, an engine that automates the refinement of high-level security intents into low-level, deployment-ready configurations. Given a network topology, devices, and available security controls, along with high-level intents and Cyber Threat Intelligence (CTI) reports, RefinementEngine automatically generates settings that implement the desired intent, counter reported threats, and can be directly deployed on target security controls. The proposed approach is validated through real-world use cases on packet and web filtering policies derived from actual CTI reports, demonstrating both correctness, practical applicability, and adaptability to new data.